diff --git a/docs/design-decisions.md b/docs/design-decisions.md index fcce2a0..6e65bce 100644 --- a/docs/design-decisions.md +++ b/docs/design-decisions.md @@ -4038,6 +4038,20 @@ - **Security hardening** (Suricata content, crowdsec, Zenarmor, acme, SIEM) -> DEFERRED per closed-test posture to post-teardown / Roosevelt; recorded in the review doc, not pinned to a VR1 step. +**Verification 2026-07-18 (install attempt on `office1-opnsense`, operator-run via firmware API).** +- `os-qemu-guest-agent`: **package INSTALLED but NON-FUNCTIONAL.** Daemon not running/enabled AND the + libvirt domain has **no `org.qemu.guest_agent.0` virtio-serial channel** (`opnsense-edge` module defines + none -- grep-confirmed), so `virsh ... guest-ping` returns "QEMU guest agent is not configured". + **Making qga work is therefore NOT a plugin install -- it is: (1) inject the guest-agent channel into + the domain XML in `modules/opnsense-edge` (provider XSLT-or-equivalent -- verify the exact dmacvicar + mechanism when building; do NOT assume a `qemu_agent` arg exists); (2) enable the qga service on the + edge; (3) restart the edge.** NEW DC edges get (1) at creation (born with the channel, no restart); + `office1-opnsense` retrofits at its NEXT SCHEDULED restart. Functional enablement DEFERRED accordingly. +- `os-iperf`: **first install FAILED** -- two back-to-back `core/firmware/install` POSTs collided on the + OPNsense firmware LOCK (the 2nd ran while the 1st held it). **Lesson for the profile-installer: install + ONE plugin at a time and POLL `upgradestatus` to completion before the next.** Re-run of `os-iperf` + pending. + **Problem.** `office1-opnsense` was updated to OPNsense 26.7 and is a near-stock install (only `os-git-backup`, itself unconfigured). The edge is the reusable per-site boundary profile that will land on Roosevelt baremetal, so "what should be on the base edge?" is a real, transferable question. diff --git a/docs/session-ledger.md b/docs/session-ledger.md index d4905fe..ae6a04e 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -761,8 +761,15 @@ VR1 VMs); `os-node_exporter` -> `dc-dc-phase6` Step 10 gated on COS-edge scope; VR1 profile -> `dc-dc-phase2` edge section (+ build the reusable profile-installer there); security -> deferred (posture). **FOUR sub-decisions STILL OPEN** (COS-edge scope, `os-frr`, `os-tailscale`, edge-NTP) -- a one-line directive does -not rule them. As-built row updated (FreeBSD base 14.3->15.1 too). Docs committed on branch -`dc-dc-stage3-phase2-dc-substrate` (not pushed; operator away from workstations). +not rule them. As-built row updated (FreeBSD base 14.3->15.1 too). +**INSTALL VERIFIED 2026-07-18 (operator ran the firmware POSTs via `!`):** `os-qemu-guest-agent` package +INSTALLED but NON-FUNCTIONAL -- daemon off + `opnsense-edge` module defines no `org.qemu.guest_agent.0` +libvirt channel (grep-confirmed), so `guest-ping` fails. Functional qga = channel-in-module + service-enable ++ edge RESTART -> DEFERRED to next scheduled edge restart (new DC edges born with the channel). `os-iperf` +did NOT install: two back-to-back firmware POSTs collided on the OPNsense firmware LOCK -> re-run pending +(profile-installer must be one-at-a-time + poll). Records reconciled to this reality (D-129 Verification +note, phase2 pin, as-built). Docs committed on branch `dc-dc-stage3-phase2-dc-substrate` (not pushed; +operator away from workstations). ## OPEN WORK -- VR0 / DC0 (the running testcloud) diff --git a/docs/vr1-office1-as-built.md b/docs/vr1-office1-as-built.md index 6ef31e9..9e40994 100644 --- a/docs/vr1-office1-as-built.md +++ b/docs/vr1-office1-as-built.md @@ -39,7 +39,7 @@ | Host | Address | What runs on it | Level | |---|---|---|---| | **vcloud** | `10.17.11.248` (lab), `10.10.0.10` on `virbr2`, `172.30.1.1` on `virbr11` | libvirt/KVM hypervisor; OpenTofu runs from here | L1 (itself a KVM guest) | -| **office1-opnsense** | LAN `10.10.0.1` / WAN `172.30.1.2` | **OPNsense 26.7** (FreeBSD base **15.1**-RELEASE-p1; both bumped from 26.1.11 / FreeBSD 14.3 on 2026-07-18; 0 outdated pkgs) edge router: routing, NAT, **Kea DHCP**, firewall. Plugins: `os-git-backup` (UNCONFIGURED); `os-qemu-guest-agent` + `os-iperf` directed 2026-07-18 (D-129 VR1 profile, firmware-API install operator-gated -- confirm live). See `docs/opnsense-edge-addon-review-20260718.md` + D-129. | L2 | +| **office1-opnsense** | LAN `10.10.0.1` / WAN `172.30.1.2` | **OPNsense 26.7** (FreeBSD base **15.1**-RELEASE-p1; both bumped from 26.1.11 / FreeBSD 14.3 on 2026-07-18; 0 outdated pkgs) edge router: routing, NAT, **Kea DHCP**, firewall. Plugins: `os-git-backup` (UNCONFIGURED); `os-qemu-guest-agent` INSTALLED 2026-07-18 but NON-FUNCTIONAL (daemon off + no libvirt guest-agent channel -- functional enablement DEFERRED to next edge restart, D-129); `os-iperf` re-install pending (first attempt lost to the firmware lock). See `docs/opnsense-edge-addon-review-20260718.md` + D-129. | L2 | | **voffice1** | `10.10.0.20` (Kea reservation) | **MAAS 3.7.2** region+rack + PostgreSQL 16.14; **LXD 5.21.5** (registered to MAAS as VM host `office1-lxd`) | L2 | | **office1-netbox** | `10.10.1.10` | **NetBox 4.6** (netbox-docker; `/opt/netbox-docker`, `docker compose up -d`) on `:8000`; **`restart: unless-stopped`** on all 5 services (2026-07-17 -- survives instance reboot) | L3 (LXD VM) | | **office1-tailscale** | `10.10.1.11` / tailnet **`100.64.0.53`** (`fd7a:115c:a1e0::35`) | **Tailscale 1.98.8**, subnet router advertising `10.10.0.0/22`. Joined the **SELF-HOSTED** control plane `https://tailscale.baldurkeep.com:443` | L3 (LXD VM) | diff --git a/runbooks/dc-dc-phase2-tofu-dc-substrate.md b/runbooks/dc-dc-phase2-tofu-dc-substrate.md index 0e58970..176d03c 100644 --- a/runbooks/dc-dc-phase2-tofu-dc-substrate.md +++ b/runbooks/dc-dc-phase2-tofu-dc-substrate.md @@ -168,9 +168,14 @@ D-113 firmware API (`scripts/opnsense-api.sh POST core/firmware/install/`) -- `qemu-guest-agent` gives the inner libvirt host clean guest coordination (graceful shutdown/fsfreeze/IP report; pairs with D-127 autostart), `iperf` validates the transit path. **Verify the `qemu-guest-agent` daemon is - RUNNING, not just the package present.** BUILD a small idempotent profile-installer here (thin wrapper - over `opnsense-api.sh`, `--check`) so every DC edge is provisioned identically. NOT the Roosevelt-metal - profile (that set is baremetal-only) and NOT `os-node_exporter` (gated on the COS-edge scope, D-129). + RUNNING and answers `virsh ... guest-ping` -- not just the package present.** BUILD a small idempotent + profile-installer here (thin wrapper over `opnsense-api.sh`, `--check`); it MUST install **one plugin at + a time and poll `core/firmware/upgradestatus` to completion** before the next -- back-to-back installs + collide on the OPNsense firmware lock and the later one fails silently (measured 2026-07-18). **For qga + to actually work, `modules/opnsense-edge` must define the `org.qemu.guest_agent.0` virtio-serial + channel in the domain XML** (verified ABSENT 2026-07-18; NEW DC edges then boot with it, no retrofit). + NOT the Roosevelt-metal profile (baremetal-only) and NOT `os-node_exporter` (gated on the COS-edge + scope, D-129). Node count is R-3 = 3 control + 2 compute + **4 storage = 9/DC** (Step 6's "8" is superseded). The Model A single-root layout is preserved as a revert (git tag `model-a-fallback` + `docs/model-a-fallback-plan.md`).