ADR-0029
puts the four lab servers on Windows Server evaluation licences — 180 days —
and the two endpoints on bought Windows 11 Pro keys. It says to read
slmgr /dlv on build day rather than write down a rearm count, and
stacks/lab/prometheus/rules/lab.rules.yaml already carries
LabWindowsEvaluationExpiring firing at thirty days.
That alert currently has no answer. When it fires, the reply is
build-the-lab-domain.md §1–§4 by
hand, on a mirror the runbook itself warns is "genuinely a day's work" for six
Windows installers — a boot is a 300–1500 IOPS burst against ADR-0029's ~90 IOPS
budget.
With Packer, the answer is a command. The domain has a rebuild clock built
into it, and this is the thing that makes the clock cheap.
What to build
- Ubuntu Server — cloud-init,
nocloud datasource. The base for
alexander, odin, the Zeek host in
#437, and anything else.
- Kali — Debian preseed, not cloud-init. Needed for
#421's attack VM.
- Windows 11 Pro — Autounattend, VirtIO drivers, and the TPM 2.0 blocks
Packer has since gained support for. carbuncle and siren.
- Windows Server 2025 — the same, from the evaluation image.
bahamut, leviathan, titan, ramuh.
Each Windows build needs three ISOs: the installer, an Autounattend
answer-file disc, and the VirtIO disc — Windows ships no drivers for Proxmox's
emulated hardware, and that disc also carries the Windows guest agent.
The SID trap, which bites this estate specifically
A computer's SID is created at install, so every guest cloned from one template
shares it — and a domain join fails when the DC shares a SID with the joining
server. ADR-0029 has two domain controllers, bahamut and leviathan, so
this is not hypothetical.
Two fixes exist. Sysprep on a full clone with /oobe /generalize /unattend: is
the documented one. Rebuilding from Packer and renaming the template is the
one to take — same result, and it is the operation this issue exists to make
cheap anyway.
Verification
A template exists; a guest cloned from it comes up with the right hostname, the
SSH key authorised, and qemu-guest-agent reporting an address to Proxmox.
Then the real test: build the same template twice and confirm the second is
usable, because that is exactly what licence expiry will ask for.
What it waits on
#436 — the toolchain needs
somewhere to live.
Purchases this needs
None. The two Windows 11 Pro keys are already on the roadmap's list under
#414.
Corrected 2026-09-19
Gate (#436, now phoenix per ADR-0043) is unchanged. One coupling runs backwards across milestones: the Ubuntu template here is named as the base for the Zeek host in #437, which sits in the Saruman milestone ahead of this. #437 can be built by hand first; the template then rebuilds it.
Corrected 2026-09-20
Unblocked. #436 closed 2026-09-20: phoenix is built at 10.0.30.70 on Saruman, admitted to 8006 by token (#544), with the lab's Prometheus and Loki publishing to it (#543). The toolchain has somewhere to live, so this is the first buildable item in automation and the one the rest of the milestone stacks on. One thing to know before installing anything on it: #566 — Saruman's own firewall is not enabled, so the ADR-0043 line that admits phoenix to 8006 is not yet a rule anywhere. Not a gate on this, but the two touch the same host in the same week.
ADR-0029
puts the four lab servers on Windows Server evaluation licences — 180 days —
and the two endpoints on bought Windows 11 Pro keys. It says to read
slmgr /dlvon build day rather than write down a rearm count, andstacks/lab/prometheus/rules/lab.rules.yamlalready carriesLabWindowsEvaluationExpiringfiring at thirty days.That alert currently has no answer. When it fires, the reply is
build-the-lab-domain.md§1–§4 byhand, on a mirror the runbook itself warns is "genuinely a day's work" for six
Windows installers — a boot is a 300–1500 IOPS burst against ADR-0029's ~90 IOPS
budget.
With Packer, the answer is a command. The domain has a rebuild clock built
into it, and this is the thing that makes the clock cheap.
What to build
noclouddatasource. The base foralexander,odin, the Zeek host in#437, and anything else.
#421's attack VM.
Packer has since gained support for.
carbuncleandsiren.bahamut,leviathan,titan,ramuh.Each Windows build needs three ISOs: the installer, an Autounattend
answer-file disc, and the VirtIO disc — Windows ships no drivers for Proxmox's
emulated hardware, and that disc also carries the Windows guest agent.
The SID trap, which bites this estate specifically
A computer's SID is created at install, so every guest cloned from one template
shares it — and a domain join fails when the DC shares a SID with the joining
server. ADR-0029 has two domain controllers,
bahamutandleviathan, sothis is not hypothetical.
Two fixes exist. Sysprep on a full clone with
/oobe /generalize /unattend:isthe documented one. Rebuilding from Packer and renaming the template is the
one to take — same result, and it is the operation this issue exists to make
cheap anyway.
Verification
A template exists; a guest cloned from it comes up with the right hostname, the
SSH key authorised, and
qemu-guest-agentreporting an address to Proxmox.Then the real test: build the same template twice and confirm the second is
usable, because that is exactly what licence expiry will ask for.
What it waits on
#436 — the toolchain needs
somewhere to live.
Purchases this needs
None. The two Windows 11 Pro keys are already on the roadmap's list under
#414.
Corrected 2026-09-19
Gate (#436, now
phoenixper ADR-0043) is unchanged. One coupling runs backwards across milestones: the Ubuntu template here is named as the base for the Zeek host in #437, which sits in the Saruman milestone ahead of this. #437 can be built by hand first; the template then rebuilds it.Corrected 2026-09-20
Unblocked. #436 closed 2026-09-20:
phoenixis built at10.0.30.70onSaruman, admitted to 8006 by token (#544), with the lab's Prometheus and Loki publishing to it (#543). The toolchain has somewhere to live, so this is the first buildable item in automation and the one the rest of the milestone stacks on. One thing to know before installing anything on it: #566 —Saruman's own firewall is not enabled, so the ADR-0043 line that admitsphoenixto 8006 is not yet a rule anywhere. Not a gate on this, but the two touch the same host in the same week.