Fork: 0
OpenStack / openstack-caracal-dc-dc
Transfer to URL with SHA Find file
Newer
Older
openstack-caracal-dc-dc / docs / changelog-20260718-opnsense-plugins-installer.md
@JANeumatrix JANeumatrix 1 day ago 2 KB D-129: build the OPNsense edge plugin profile-installer + sharpen pins
Raw Blame History

Changelog 2026-07-18 -- OPNsense edge plugin profile-installer (D-129)

Autonomous processing of the D-129 "engineering for the rest" that does NOT need the operator at a keyboard. Nothing was applied to the cloud (the live plugin install remains classifier-gated). Repo-only: one new script + harness + pin refinements. Gauntlet ALL GREEN (68), repo-lint 0-fail.

Items

  1. NEW scripts/opnsense-plugins.sh + tests/opnsense-plugins/run-tests.sh (17/17).

    • WHAT: a named-profile plugin installer for an OPNsense edge over the D-113 firmware API. list + apply <vr1-edge|metal-edge>. Thin orchestrator over scripts/opnsense-api.sh (auth/secret handling reused, never re-implemented).
    • WHY: closes the D-129 pin "build the reusable profile-installer at the DC-edge step". Encodes the two 2026-07-18 lessons so they are not re-learned: (a) install ONE plugin at a time and POLL core/firmware/upgradestatus -- back-to- back firmware/install POSTs collide on the OPNsense firmware lock and the second fails silently (this is why os-iperf did not install); (b) loudly warns that os-qemu-guest-agent is a package, NOT a working agent (needs the libvirt channel + service enable + restart). --dry-run is offline (no net/creds) so the harness proves the shape.
    • REVERT: git rm scripts/opnsense-plugins.sh tests/opnsense-plugins/run-tests.sh.

  2. D-129 + dc-dc-phase2 pin refined (doc-only).

    • WHAT: recorded the installer as BUILT (runbook now says USE it, not build it); logged the qga-channel design (add to modules/opnsense-edge as an OPT-IN var defaulting OFF, so the shared-module edit does NOT change the live office1-opnsense plan or dirty the DC0 outer plan; mechanism-to-verify on dmacvicar 0.9.8 -- native qemu_agent arg vs xml{xslt} injection, not assumed); logged the exact os-git-backup operator input needed (target repo + deploy key).
    • WHY: advances the items I cannot execute autonomously to "ready to implement safely" without touching the cloud or the imminent DC0 deploy.
    • REVERT: revert the D-129 Implementation-prep block + the phase2 pin edit.

Still operator-only (cannot be processed autonomously)

  • os-iperf re-install (classifier-gated firmware POST) -- operator-run or add a Bash permission rule.
  • qga functional enablement (module opt-in channel + service enable + edge RESTART).
  • os-git-backup wiring (choose repo + add the plugin's deploy key on GitBucket).
  • The four D-129 sub-decisions (COS-edge scope, os-frr, os-tailscale, edge-NTP).