From 6afbd56dc4850f557802ec98a0b8de513a0b6899 Mon Sep 17 00:00:00 2001
From: Garrett Allen <98648590+Gerrrt@users.noreply.github.com>
Date: Mon, 9 Nov 2026 12:06:17 -0800
Subject: [PATCH 1/2] fix(packer): drop tpl-kali's build-time eth0 DHCP stanza
 before templating (#790)

The preseed writes /etc/network/interfaces.d/eth0 so the build has a
network. Left in the template, ifupdown raised it beside cloud-init's
static stanza on a static-only clone; with no DHCP server dhcpcd fell
back to 169.254.x.x and added a link-local default route, failing
build-the-playground.md section 8 check four on gandalf. The first
provisioner now removes it beside cloud-init clean, for 902 and 910.
Every clone gets a NoCloud drive, and every caller sets ipconfig0, so
DHCP clones still bring eth0 up through cloud-init.

Neither template is rebuilt yet; that runs from phoenix.

Refs #790.
Refs #421.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/changelog.md                        | 16 ++++++++++++++++
 docs/runbooks/build-the-lab-templates.md |  9 +++++++++
 packer/kali.pkr.hcl                      | 12 ++++++++++++
 packer/kali/preseed.cfg.pkrtpl           |  5 ++++-
 4 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/docs/changelog.md b/docs/changelog.md
index b8327181..12f90c6a 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -19,6 +19,21 @@ docstring gives: it is a record, not a claim about now.
 
 ## 2026-11-09
 
+- **`tpl-kali`'s build now removes its own eth0 DHCP stanza before
+  templating.** The preseed writes `/etc/network/interfaces.d/eth0` so the
+  build has a network ([#790](https://github.com/Gerrrt/HomeLab/issues/790)),
+  and its comment said a clone's cloud-init configured its network on top.
+  That was wrong for a static clone. On `gandalf`, a throwaway clone of 902
+  at `172.30.30.199` on `vmbr1` raised both that stanza and cloud-init's
+  static one. dhcpcd got no lease, fell back to `169.254.x.x`, added
+  `default dev eth0 scope link`, and failed `build-the-playground.md` §8
+  check four ([#421](https://github.com/Gerrrt/HomeLab/issues/421)).
+  `packer/kali.pkr.hcl`'s first provisioner now deletes the file beside
+  `cloud-init clean`, for 902 and 910 alike. The installer's `ens18` stanza
+  stays, because no `ens18` exists on Kali. `packer-smoke.sh`,
+  `make-attack-vm.sh` and `garuda`'s module all set `ipconfig0` to DHCP, so
+  their `eth0` still comes up through cloud-init. Neither template has been
+  rebuilt with the change yet; until it is, both still carry the stanza.
 - **[#574](https://github.com/Gerrrt/HomeLab/issues/574): the current-state
   documents now say the UPS shutdown is armed and not proved.**
   `security.md`'s mains-loss row still said that as of 2026-09-20 nothing
@@ -37,6 +52,7 @@ docstring gives: it is a record, not a claim about now.
   for the graphs to read, so it says nothing about whether the subscription
   is up. The rack visit in runbook §5 to §7 still owes the forced-shutdown
   proof and the mains pull.
+||||||| parent of a3b8893 (fix(packer): drop tpl-kali's build-time eth0 DHCP stanza before templating (#790))
 
 - **The in-house ntfy topics are renamed so a phone can tell them apart.**
   The iOS ntfy app shows a subscription by its topic name and has no display
diff --git a/docs/runbooks/build-the-lab-templates.md b/docs/runbooks/build-the-lab-templates.md
index 270c566a..b286917a 100644
--- a/docs/runbooks/build-the-lab-templates.md
+++ b/docs/runbooks/build-the-lab-templates.md
@@ -496,6 +496,15 @@ not from a second disc.
 > with 0 failed units and no account expiring at the epoch, the check
 > [#1196](https://github.com/Gerrrt/HomeLab/issues/1196) owed 902.
 
+The preseed writes `/etc/network/interfaces.d/eth0`, a DHCP stanza, so the
+build has a network. The build's first provisioner deletes it before
+templating, so a clone's network is only what cloud-init writes from its
+`ipconfigN`. A template built before that change still holds the stanza. A
+static-only clone of one raises DHCP beside its static address, and with no
+DHCP server dhcpcd adds a `169.254.x.x` address and a link-local default
+route ([`build-the-playground.md`](build-the-playground.md) §8). Rebuild 902
+and 910 with this section and §5b to clear it.
+
 1. Admit the guest to that port on `phoenix` for the length of the build. If
    `ufw` is active, run `sudo ufw allow from 10.0.30.0/24 to any port 8800 proto tcp`,
    and delete the rule afterwards. Debian's build (§4) needs this step and
diff --git a/packer/kali.pkr.hcl b/packer/kali.pkr.hcl
index 2d148f67..20044d38 100644
--- a/packer/kali.pkr.hcl
+++ b/packer/kali.pkr.hcl
@@ -241,6 +241,18 @@ build {
       "ln -sf /dev/null /etc/systemd/system-generators/systemd-sslh-generator",
       "ln -sf /usr/lib/systemd/system/cloud-init.target /etc/systemd/system/multi-user.target.wants/cloud-init.target",
       "apt-get clean",
+      # The preseed's eth0 DHCP stanza is the build's network only. Left in
+      # the template, ifupdown raised it beside cloud-init's static stanza on
+      # a static-only clone, dhcpcd got no lease on vmbr1, fell back to
+      # 169.254.x.x and added `default dev eth0 scope link`: a target with a
+      # default route, which build-the-playground.md §8 check four fails
+      # (found 2026-11-09 on gandalf, a throwaway clone of 902). Every clone
+      # gets a NoCloud drive, so cloud-init writes each NIC's stanza, DHCP
+      # included. Removing the file does not take down the running build's
+      # eth0. The installer's ens18 stanza in /etc/network/interfaces stays:
+      # no ens18 exists on Kali (eth0 naming, see the preseed), so ifupdown
+      # never raises it.
+      "rm -f /etc/network/interfaces.d/eth0",
       "rm -f /etc/ssh/ssh_host_*",
       "cloud-init clean --logs --machine-id",
     ]
diff --git a/packer/kali/preseed.cfg.pkrtpl b/packer/kali/preseed.cfg.pkrtpl
index 5fa96865..b2083fbb 100644
--- a/packer/kali/preseed.cfg.pkrtpl
+++ b/packer/kali/preseed.cfg.pkrtpl
@@ -73,7 +73,10 @@ d-i grub-installer/bootdev string default
 # it. With only an ens18 stanza, eth0 never came up, the guest had no address, and
 # Packer timed out waiting for SSH (#790, two proof builds on Saruman, 2026-10-08).
 # interfaces sources interfaces.d, so this adds eth0 without editing the
-# installer's file. A clone's cloud-init configures its own network on top.
+# installer's file. It is the build's network only: kali.pkr.hcl's first
+# provisioner removes it before templating, because a clone that kept it raised
+# DHCP beside cloud-init's static stanza and got a link-local default route.
+# A clone's network is cloud-init's alone.
 #
 # The chage loop clears a bogus account-expiry (shadow field 8 == 1, i.e. the
 # epoch, 1970-01-02) that Kali's package postinsts leave on service accounts

From 5d9c31a0c28494db6f21b93e222b713e4a8b6482 Mon Sep 17 00:00:00 2001
From: Garrett Allen <98648590+Gerrrt@users.noreply.github.com>
Date: Mon, 9 Nov 2026 12:55:28 -0800
Subject: [PATCH 2/2] docs(changelog): drop conflict base sections left by the
 merge

The rebase and merge resolutions kept diff3 base blocks in the
2026-11-09 section. The changelog is now main's plus this PR's one entry.

Refs #790.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/changelog.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/docs/changelog.md b/docs/changelog.md
index 7d0349f5..3936f5c2 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -34,7 +34,7 @@ docstring gives: it is a record, not a claim about now.
   `make-attack-vm.sh` and `garuda`'s module all set `ipconfig0` to DHCP, so
   their `eth0` still comes up through cloud-init. Neither template has been
   rebuilt with the change yet; until it is, both still carry the stanza.
-||||||| 2391766
+
 - **ADR-0089's trigger 3 has fired: Wiki.js 3.x is stable, and the move is
   [#1339](https://github.com/Gerrrt/HomeLab/issues/1339).** `requarks/wiki`
   published `3.0.1`, its first stable 3.x release, on 2026-11-01. Five more
@@ -68,7 +68,6 @@ docstring gives: it is a record, not a claim about now.
   for the graphs to read, so it says nothing about whether the subscription
   is up. The rack visit in runbook §5 to §7 still owes the forced-shutdown
   proof and the mains pull.
-||||||| parent of a3b8893 (fix(packer): drop tpl-kali's build-time eth0 DHCP stanza before templating (#790))
 
 - **The in-house ntfy topics are renamed so a phone can tell them apart.**
   The iOS ntfy app shows a subscription by its topic name and has no display