diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index d2ca92c..e9f33b4 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -47,10 +47,19 @@ the FreeBSD login prompt (D-112 boot path first-datapoint PASS on 26.7). The INNER tfstate lives ON voffice1 (vr1-dc0-substrate/terraform.tfstate -- new state-of-record location; add to the site backup set). ACTIVE - gate: G10 remaining -- edge D-112(c) console bootstrap + D-113 API - config + D-129 plugins (26.7 revalidation), D-125 throwaway-guest - egress isolation test, MAAS reach + `TF_VAR_maas_api_key` + region-side - metal-admin DHCP naming this rack primary_rack (step D), netem (E). + gate: G10 remaining. **Edge bootstrap DONE 2026-07-20**: D-112(c) + console bootstrap complete (key-only root SSH proven) and the D-113(a2) + API key minted via the vendor model -- `GET core/firmware/status` 200 + with `CORE_ABI 26.7`, the first proof the API path works on 26.7. + Measured: edge vtnet0 = LAN (provider-public), vtnet1 = WAN; edge still + on its FACTORY LAN `192.168.1.1/24`. Rack legs `10.12.4.2/22` + + `10.12.8.2/22` added INTERIM (non-persistent `ip addr`; script support + is a queued finding), plus a temporary `192.168.1.2/22` to reach the + factory LAN. REMAINING: D-125 throwaway-guest egress isolation test + (gate, before trusting the edge chain), edge re-address over REST + (LAN 10.12.4.1/22, WAN static on 172.30.2.0/24) + D-129 plugins, MAAS + reach + `TF_VAR_maas_api_key` + region-side metal-admin DHCP naming + this rack primary_rack (step D), netem (E). - The grounding audit is COMPLETE and EXITED (2026-07-19): Phases 1-6 all closed (charter `148dcef`; rulings `docs/audit/ga-rulings.md`; the Phase-5 sweep ran as six operator-gated batches in one session; exit diff --git a/docs/changelog-20260719-dc0-deploy-stepB.md b/docs/changelog-20260719-dc0-deploy-stepB.md index 859f67e..4f74e55 100644 --- a/docs/changelog-20260719-dc0-deploy-stepB.md +++ b/docs/changelog-20260719-dc0-deploy-stepB.md @@ -226,6 +226,51 @@ alternative: `virsh destroy vvr1-dc0`, D-122); module fixes revert by commit. +## 9. DC edge: D-112(c) console bootstrap + API key minted (26.7) -- REPLACEMENT CHAIN PROVEN + +- Per-env edge key minted on vcloud (`~/vr1-dc0-creds/vr1-dc0-edge_ed25519`, + 0600/0644, SEC-009 convention), staged to the rack the same way. +- Rack legs added (operator-ruled "10.12.4.2, manual now + script later"): + `10.12.4.2/22` on the provider-public inner bridge (virbr5, MEASURED) + + the D-124-ruled `10.12.8.2/22` on metal-admin (virbr2). INTERIM: `ip addr + add`, not persistent. **LOGGED FINDING (queued):** site-headend-install.sh + never implemented the rack legs despite main.tf's comment claiming it + consumes `vr1_dc0_rack_metal_admin_ip` -- add rack-leg support + harness + before step D closes. Also interim: `192.168.1.2/24` on virbr5 to reach + the edge's FACTORY LAN; REMOVE once the edge is re-addressed. +- **D-112(c) console bootstrap: DONE** (`~/d112c-console.log` on the rack). + Driver evolved v1->v6 against MEASURED failures, each real and worth + keeping for the runbook: + (i) serial console wraps long lines -> ship payload as <=160-char base64 + chunks (`openssl base64 -d`), never one long line; + (ii) `set-name` in the edge netplan is irrelevant here but the same class + bit the rack (item 4); + (iii) tcsh on the edge (documented trap) breaks nested-quoted `sed` -- + "Unmatched '"'"'" -- so NEVER patch files via quoted one-liners; re-ship + the whole payload instead; + (iv) `write_config()` needs an include beyond config.inc -- MEASURED + (`grep -l shell_safe /usr/local/etc/inc/*.inc` -> auth/console/filter/ + interfaces/rrd/system/util.inc), not guessed; + (v) writing config.xml does NOT materialize `/root/.ssh/authorized_keys` + -- must call the vendor's `local_user_set()` (auth.inc). This was the + actual reason key auth failed after a "successful" config write. +- VERIFIED: `ssh -i vr1-dc0-edge_ed25519 root@192.168.1.1` -> key-only auth + OK, `uname -r` = 15.1-RELEASE-p1, `ifconfig -l` = vtnet0/vtnet1. + INTERFACE MAPPING MEASURED: vtnet0 = LAN = provider-public plane (it + answered on virbr5), vtnet1 = WAN -- same order as the office1 edge. +- **API key minted via the vendor model** (`opnsense-bootstrap-apikey.sh` + + `opnsense-mint-apikey.php`, run ON the rack): key/secret 80 chars -> + `~/vr1-dc0-creds/opnsense-api.txt` (0600, secret never printed). + SMOKE TEST PASS: `GET core/firmware/status` -> HTTP 200, `CORE_ABI 26.7`. + **This is the first proof the D-113(a2) API path works on 26.7** (the + 26.7 revalidation the operator's base-version ruling called for). + Script note: the bootstrap script requires the minter BESIDE it (its + own dir), not in `scripts/` -- worth a usage-line DOCFIX. +- **Revert:** delete the API key (`POST auth/user/del_api_key/`, the + proven negative-tested path) + creds file; `ip addr del` the three + interim addresses; the console bootstrap reverts by re-imaging the edge + (inner `tofu destroy`/re-apply of the edge module). + ## 8. STAGE-CLOSE QUEUE ITEM (operator directive, 2026-07-20): OPNsense 26.7 review - Operator directive (verbatim intent): at the proper time/place, review the