| 2026-07-23 |
G12 dc1: SEC-016 power key wired + commissioning 9/9 READY -- [V] leg complete
...
- SEC-016 dedicated dc1 MAAS->libvirt power key minted, authorized on the
rack, installed in the region MAAS snap (per-host ssh config; dc0 SEC-012
key untouched -- true per-DC isolation); manifest updated (creds-audit CLEAN)
- maas-node-power.sh --commit: power_type=virsh on all 9, each verified by a
real query-power-state (proves the SEC-016 region->rack path)
- commissioned all 9 -> ALL 9 READY in ~3.5 min (no timeout, no SERVFAIL),
shapes EXACT to D-121 Option C; dc0's two stacked faults pre-empted by
pinned MACs + the dc-rack-net forwarder
- G12 [V] leg (dc1 build) COMPLETE; NEXT is close-out + operator-gated merge
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw
|
G12 dc1: rack-net install + region MAAS config + SEC-016 power-key ruling
...
- dc-rack-net install dc1 on the rack: check 10/10, forwarder answers
authoritative maas-internal SOA (D-131 fix; audit capture committed)
- region MAAS: D-120 range 10.12.68.100-.200, D-131 dns_servers=10.12.68.3
allow_dns=false, DHCP dhcp_on=true primary_rack=nmpcq4; dhcpd verified
RUNNING on virbr6 (behavioral, no Temporal incident)
- dc1 enlistment PROVEN via canary (machines 11->12 in ~2 min)
- SEC-016: operator-ruled "Mint a dedicated dc1 power key" (per-DC
isolation, not SEC-012 reuse) -- recorded before dependent wiring (GA-R5)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw
|
G12 dc1: dc-rack-net.sh dc1 site-table arm + harness (D-131 sub-1)
...
Adds the dc1 arm to the standing per-DC rack-legs + node-DNS forwarder
pattern. MEASURED/apex-committed values, network-name keyed (no virbrN):
- vr1-dc1-metal-admin 10.12.68.2/22 (rack MAAS/DHCP; apex-committed rack IP)
- vr1-dc1-metal-admin 10.12.68.3/22 (forwarder listen alias; D-120 static)
- vr1-dc1-provider-public 10.12.64.2/22 (edge-LAN; measured live 2026-07-23)
- upstream region BIND 10.10.0.20 over transit
Harness T15-T18 added; dc-rack-net 18/18, gauntlet ALL GREEN (76),
repo-lint 0-fail. The forwarder pre-empts dc0's commissioning SERVFAIL.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw
|
G12 dc1: edge bootstrap + v4 addressing COMPLETE (D-112c + D-113a2 proven on 26.7)
...
Edge phase for vr1-dc1, resuming the 2026-07-22 close handoff:
- D-112(c) console bootstrap: SSH + dc1 edge key materialized (payload
needed util.inc/shell_safe() -- dc0 lesson iv the .b64 artifact lacked)
- key-only SSH verified (15.1-RELEASE-p1)
- D-113(a2) API key minted via vendor model; GET core/firmware/status
exit 0, product_abi 26.7
- edge addressed: WAN 172.30.3.2/24 gw 172.30.3.1 (egress 0% loss),
LAN -> 10.12.64.1/22 (ruled provider-public gw), API at new LAN
- interim reach leg removed; rack provider-public leg 10.12.64.2/22 live
- creds consolidated to ~/vr1-dc1-creds/ (creds-audit CLEAN); rack edge-key
copy shredded -> SEC-015 (transient, remediated)
Two queued findings: bootstrap .b64 missing util.inc; opnsense-bootstrap-apikey.sh
scp transient post-restart-sshd failure (readiness-wait/retry candidate).
CURRENT-STATE G12 row + security-ledger SEC-015 + manifest updated (GA-R1/C1).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw
|
