docs: phoenix is built at 10.0.30.70 on Saruman, the lab has its first off-host client, and Saruman admits it to 8006 (#436) - #544
Merged
Conversation
…t off-host client, and Saruman admits it to 8006 (#436) The build-day commit build-the-jumpbox.md §8 describes, landed as one change because check_docs.py makes the "Not built yet" marker and a network.md row mutually exclusive and ties hardware.md's Alloy agent count to the marker: - network.md gains the phoenix row in the ImaginationLAN table; the planned guest note becomes a description, keeping the sentence that this is the one address on the segment with a path to 8006, which firewall-claims.yaml cannot say; Saruman's guest count goes to two; the WAN note stops saying the jumpbox does not exist and keeps saying the endpoint question is open. - architecture.md drops the marker from the phoenix row and recounts Saruman's guests: two running, seven planned. - hardware.md: five Alloy agents. - observability.md names phoenix as the lab stores' first client from off alexander, and says it too reaches nothing on VLAN 99. - roadmap.md and fit-the-saruman-ssds.md §9 (two guests to move, not one). - build-the-jumpbox.md gains a status block in the shape of the lab guest's. The build date and the §1, §4 and §7 results are placeholders until the runbook has been run; this must not merge before then. Refs #436 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…7c1e42 # Conflicts: # docs/network.md
…7c1e42 # Conflicts: # docs/architecture.md
…7c1e42 # Conflicts: # docs/architecture.md
…erver ISO (#436) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…row assumed (#436) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…moved and 9 rejects, and the token secret goes into the file and nowhere else (#436) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… never enabled — phoenix's 8006 line is decided and unwritten (#436, #566) Two findings from running build-the-jumpbox.md §4. The node name is the hostname with its capital, so the runbook's /nodes/saruman ACL, host.fw path and API URL were wrong; all three now read Saruman, with a note that pveum does not check the path. And pve-firewall on Saruman is disabled with neither cluster.fw nor host.fw present: ADR-0014's rules are applied by the playground runbook, which has not run. The door section says so, the line was not written, and #566 carries enabling the firewall with all four rules. The sentences in network.md and architecture.md that said the rule stands now say decided and unwritten, and ADR-0043 gets a marked note on the premise. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ur Loki jobs (#436) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…eholder left (#436) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Nothing on the running lab — this is the repository half of a build that happens on
Saruman,morpheus,phoenixand the Mac. It records thatphoenixexists: thenetwork.mdrow, the**Not built yet**marker gone fromarchitecture.md,Sarumanat two guests running and seven planned,hardware.mdat five Alloy agents,observability.mdnaming the lab stores' first client from offalexander, the roadmap entry, the SSD runbook's §9 (two guests to move), and a status block at the top of the jumpbox runbook.Why
check_docs.pyinverts the check on a**Not built yet**row: while the marker stands, the host must be absent fromnetwork.md, and its Alloy agent is not counted. So the row, the marker and the count must change together, and they must not change before the guest is real. This is that change, held as a draft. The ports the agent pushes to were opened ahead of it in #543.Closes #436 — on merge, which waits for §7.
Blast radius
None from this diff. The build it records changes two things the checkboxes ask about, both decided by ADR-0043 and written up there and in the runbook:
/etc/pve/nodes/saruman/host.fwadmitting10.0.30.70to8006, the first address on VLAN 30 with a path to the Proxmox API (ADR-0014's rule superseded on that one point, ADR-0039's first consequence amended). Outside pf, sofirewall-claims.yamlcannot see it;network.mdsays it in prose instead.secrets/*.sops.yaml— the Proxmox API token lives in~/.config/proxmox/phoenix.envonphoenix, mode 600, not in the repository:check_sops_rules.pyfails asecrets/phoenixrule until astacks/phoenixexists, and ADR-0043 records the deviation from the issue's "credential intosecrets/".Verification
make check-docspasses with the marker gone, the row present and "five Alloy agents";scripts/lint.shpassesmake validate— CI runs the full set on this PRup{instance="phoenix"}with both jobs at1, three or more Loki jobs,make validategreen inphoenix's own checkout) go here and into the runbook's status block before this leaves draft🤖 Generated with Claude Code