diff --git a/docs/changelog.md b/docs/changelog.md index b24dae78..0eccd1fc 100644 --- a/docs/changelog.md +++ b/docs/changelog.md @@ -19,6 +19,23 @@ docstring gives: it is a record, not a claim about now. ## 2026-11-09 +- **[#421](https://github.com/Gerrrt/HomeLab/issues/421): `gandalf`'s + management plane is closed, `build-the-playground.md` §4.** The firewall + had been off since the install, so ADR-0014's rules did not exist yet and + the whole of VLAN 30 could reach 8006 and 22. Proxmox's detected + `local_network` was `10.0.30.0/24`, as it had been on `Saruman` + ([#566](https://github.com/Gerrrt/HomeLab/issues/566)). `host.fw` now + carries ADR-0014's three rules and `phoenix`'s 8006 rule. `cluster.fw` + sets the alias to `10.0.30.30`, which leaves that address alone in the + `management` set. The firewall was enabled at `policy_in: ACCEPT`, read + back and then flipped to `DROP`. The session from Hicks stayed up, and §4's + probe from `morpheus` read `8006 exit=1` and `control exit=0`. The + flip first stalled on an `overwrite?` prompt, because root's `cp` on + `gandalf` is `cp -i`, and §4 now says so. There are no guests, so no guest + NIC needed clearing. There is no collector or alert drill, because + ADR-0017 gives `gandalf` no agent. §7's read-back at each power-on stands + in for them. + - **`GuestDiskWillFillIn24h` paged for `garuda`, and the disk goes from 80 to 120 GB.** `/` went from 51.6 to 57.2 GiB between 21:24 and 21:44 UTC on 2026-11-08 and was flat afterwards; six hours of window read the one step as diff --git a/docs/roadmap.md b/docs/roadmap.md index 5df81cef..90f1a242 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -286,10 +286,9 @@ Gated on the domain, on a household observation, or on something to publish. - **[#421](https://github.com/Gerrrt/HomeLab/issues/421) Build the range on `gandalf`.** Gated on #414 and the SOC: an attack VM pointed at an - uninstrumented estate teaches nothing. Both are met. The host is installed - as of 2026-11-07: Proxmox VE 9, the `range` pool and both bridges, the - runbook's §1 and §2. §3 ran the same night: `Saruman` is at `.20`. Next is - §4, closing `gandalf`'s management plane, then §5–§9. + uninstrumented estate teaches nothing. Both are met. The runbook's §1–§4 + are behind it: the host, its bridges, `Saruman` at `.20` and the closed + management plane. Next is §5, the attack VM, then §6–§9, in order. The name is [ADR-0106](adr/0106-name-the-range-host-gandalf-and-leave-ifrit-to-its-disabled-amt.md)'s. → [runbook](runbooks/build-the-playground.md) diff --git a/docs/runbooks/build-the-playground.md b/docs/runbooks/build-the-playground.md index 105c1572..8f97fc9b 100644 --- a/docs/runbooks/build-the-playground.md +++ b/docs/runbooks/build-the-playground.md @@ -43,7 +43,7 @@ decision and on this runbook. The machine is ready too. `gandalf`, a refurbished ThinkCentre M80q, was bought on 2026-10-05 and has its 32 GB and its SATA range disk ([ADR-0096](../adr/0096-fit-ifrits-range-disk-as-a-sata-ssd-in-the-tinys-bay.md)) -fitted. **§1, §2 and §3 were done on 2026-11-07** +fitted. **§1, §2 and §3 were done on 2026-11-07, and §4 on 2026-11-09** ([#421](https://github.com/Gerrrt/HomeLab/issues/421)), and the parts as fitted are in [`hardware.md`](../hardware.md). The node is named `gandalf`, and `ifrit` names its disabled Intel AMT @@ -378,6 +378,22 @@ them. ### On `gandalf` +> **Ran on `gandalf` 2026-11-09** ([#421](https://github.com/Gerrrt/HomeLab/issues/421)), +> from a root shell on the node reached over SSH from Hicks. It found what +> `Saruman` found: with no `cluster.fw`, `pve-firewall localnet` reported +> `using detected local_network: 10.0.30.0/24`. After the alias it reported +> `using user defined local_network: 10.0.30.30`, and the +> `PVEFW-0-management-v4` set held `10.0.30.30` alone. The flip left the SSH +> session from Hicks up. The empty `management-v6` set means nothing reaches +> 8006 over IPv6 at all. The probe from `morpheus`, aimed at `10.0.30.30`, +> read `8006 exit=1` and `control exit=0`. +> +> **Write the files with `command cp -f`, not `cp`.** Root's shell on +> `gandalf` aliases `cp` to `cp -i`. A new file is written with no prompt, but +> the flip overwrites `cluster.fw`, so a plain `cp` waits on an +> `overwrite?` prompt that a script never answers, and `policy_in` stays +> `ACCEPT`. + Run the steps below in the same order. Seven things differ from the `Saruman` run they record: