# dc1 step-B gate FINAL: site-headend-install --check on vvr1-dc1 -- 2026-07-22T21:37:37Z
OK: maas snap 3.7.2-17972-g.35e297c4d (3.7/stable)
OK: MAAS rackd running
OK: enrolled to region http://10.10.0.20:5240/MAAS
== node-host (Model B) readiness ==
  [ok] libvirt/qemu installed
  [ok] nested KVM ON (kvm_amd)
  [ok] jessea123 in libvirt group
  [ok] inner pool dir /var/lib/libvirt/vr1-dc1-inner
  [ok] opnsense base /var/lib/libvirt/vr1-dc1-inner/opnsense-26.7-nano.qcow2
  [ok] SEC-010 transit FORWARD-drop present + transit interface 'enp1s0' exists
  [ok] D-125 WAN bridge 'br-vr1-dc1-wan' present + uplink 'enp2s0' enslaved
  [gate] DEPLOY-TIME (unprovable here, like the depth-4 boot gate): before the OPNsense chain
         rides it, prove egress in ISOLATION -- attach a throwaway guest to 'br-vr1-dc1-wan',
         confirm it gets a vcloud-ISP address and pings out. FAIL => revert to the D-125
         double-NAT fallback, NOT a redesign.
check-exit=0