[Gerrrt]

…ok (#421)

build-the-playground.md §5, and build-the-lab-templates.md §5 as run.

gandalf is not clustered, so it got its own phoenix@pve user, roles and token, with ACLs on range, local and both bridges. phoenix trusts gandalf's CA and keeps that token in gandalf.env, apart from phoenix.env. 902 was built twice from phoenix (10m33s, then 10m41s with -force), and packer-smoke.sh passed after each. The build needs phoenix.env sourced under gandalf.env, because the variables file refuses an empty build password even for Kali.

scripts/make-attack-vm.sh makes ragnarok, VMID 130: a full clone of 902 on range, net0 on vmbr0 by DHCP, net1 on vmbr1 at 172.30.30.10/24 with no gateway, firewall flags off. It then writes 99-no-forward.conf and runs §8's third check. Both sysctls read 0, there is no NAT, and the one default route is via 10.0.30.1. On the fresh clone, 0 failed units and 0 accounts expiring at the epoch, the check #1196 owed 902.

The changes:

• Packer: the Kali ISO is pinned to 2026.2, and the README row reads built.
• Current-state documents: architecture.md, network.md, the network diagram and the roadmap now name ragnarok.
• Changelog: a new entry for 2026-11-09.

Refs #421
Refs #790

What changed

Why

Blast radius

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

• make validate passes
• Deployed to the lab and confirmed working
• Docs updated (docs/, service README, or docs/roadmap.md)

[Copilot]

🟡 Changes recommended

Isolation checks can falsely report success because failed NAT reads appear clean, legacy SNAT rules are missed, and disabled SSH host-key verification allows an attacker to fabricate results.

2 open issues

• Verify the host key before trusting isolation results · New
• Require successful checks of nftables and legacy NAT · New

What changed in this PR

This PR records the completed Kali template build on gandalf and adds repeatable provisioning for ragnarok, the range’s dual-homed attack VM. Targets and Sliver remain future work.

Changes:

• Add a VM-cloning script that configures networking, disables forwarding, and checks isolation.
• Pin template 902’s installer and document builds through gandalf’s API.
• Update current-state documentation and record build, smoke-test, and epoch-expiry verification results.

File	Description
scripts/​README.md	Index the attack-VM provisioning script.
scripts/​make-attack-vm.sh	Clone, configure, and check ragnarok.
packer/​variables.pkr.hcl	Pin 902’s Kali installer filename.
packer/​README.md	Record 902 as built and smoke-tested.
packer/​kali.pkr.hcl	Update comments describing completed builds and ISO placement.
docs/​runbooks/​build-the-playground.md	Document attack-VM provisioning and operator access.
docs/​runbooks/​build-the-lab-templates.md	Document gandalf credentials, permissions, and build steps.
docs/​runbooks/​build-the-analyst-workstation.md	Record successful epoch-expiry verification on 902’s clone.
docs/​roadmap.md	Update range progress and remaining work.
docs/​network.md	Describe ragnarok and its network placement.
docs/​diagrams/​current/​network.svg	Label the range host’s new attack VM.
docs/​changelog.md	Record template builds and attack-VM deployment.
docs/​architecture.md	Describe gandalf’s first guest and dual-homed configuration.

_{Review effort: Balanced}