From 4b5608ea8e4f6d7fff1503f0d936e5afb31c9b6c Mon Sep 17 00:00:00 2001 From: Garrett Allen <98648590+Gerrrt@users.noreply.github.com> Date: Sun, 8 Nov 2026 18:21:10 -0800 Subject: [PATCH 1/2] =?UTF-8?q?docs(range):=20=C2=A74=20ran=20on=20gandalf?= =?UTF-8?q?,=20and=20its=20management=20plane=20is=20closed=20(#421)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The firewall on gandalf was off since the install, and Proxmox's detected local_network was the whole of VLAN 30, as on Saruman. host.fw now carries ADR-0014's three rules and phoenix's 8006 rule. cluster.fw sets the alias to 10.0.30.30. The firewall was enabled at ACCEPT, read back and flipped to DROP. The runbook records the run and the cp -i alias that stalled the flip. The roadmap moves #421 on to §5. Refs #421 Co-Authored-By: Claude Opus 5.5 --- docs/changelog.md | 16 ++++++++++++++++ docs/roadmap.md | 5 +++-- docs/runbooks/build-the-playground.md | 17 ++++++++++++++++- 3 files changed, 35 insertions(+), 3 deletions(-) diff --git a/docs/changelog.md b/docs/changelog.md index b24dae78..e689d6c3 100644 --- a/docs/changelog.md +++ b/docs/changelog.md @@ -19,6 +19,22 @@ docstring gives: it is a record, not a claim about now. ## 2026-11-09 +- **[#421](https://github.com/Gerrrt/HomeLab/issues/421): `gandalf`'s + management plane is closed, `build-the-playground.md` §4.** The firewall + had been off since the install, so ADR-0014's rules did not exist yet and + the whole of VLAN 30 could reach 8006 and 22. Proxmox's detected + `local_network` was `10.0.30.0/24`, as it had been on `Saruman` + ([#566](https://github.com/Gerrrt/HomeLab/issues/566)). `host.fw` now + carries ADR-0014's three rules and `phoenix`'s 8006 rule. `cluster.fw` + sets the alias to `10.0.30.30`, which leaves that address alone in the + `management` set. The firewall was enabled at `policy_in: ACCEPT`, read + back and then flipped to `DROP`. The session from Hicks stayed up. The + flip first stalled on an `overwrite?` prompt, because root's `cp` on + `gandalf` is `cp -i`, and §4 now says so. There are no guests, so no guest + NIC needed clearing. There is no collector or alert drill, because + ADR-0017 gives `gandalf` no agent. §7's read-back at each power-on stands + in for them. + - **`GuestDiskWillFillIn24h` paged for `garuda`, and the disk goes from 80 to 120 GB.** `/` went from 51.6 to 57.2 GiB between 21:24 and 21:44 UTC on 2026-11-08 and was flat afterwards; six hours of window read the one step as diff --git a/docs/roadmap.md b/docs/roadmap.md index 5df81cef..ef4ef84d 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -288,8 +288,9 @@ Gated on the domain, on a household observation, or on something to publish. `gandalf`.** Gated on #414 and the SOC: an attack VM pointed at an uninstrumented estate teaches nothing. Both are met. The host is installed as of 2026-11-07: Proxmox VE 9, the `range` pool and both bridges, the - runbook's §1 and §2. §3 ran the same night: `Saruman` is at `.20`. Next is - §4, closing `gandalf`'s management plane, then §5–§9. + runbook's §1 and §2. §3 ran the same night: `Saruman` is at `.20`. §4 + closed `gandalf`'s management plane on 2026-11-09. Next is §5, the attack + VM, then §6–§9. The name is [ADR-0106](adr/0106-name-the-range-host-gandalf-and-leave-ifrit-to-its-disabled-amt.md)'s. → [runbook](runbooks/build-the-playground.md) diff --git a/docs/runbooks/build-the-playground.md b/docs/runbooks/build-the-playground.md index 105c1572..a9bf765c 100644 --- a/docs/runbooks/build-the-playground.md +++ b/docs/runbooks/build-the-playground.md @@ -43,7 +43,7 @@ decision and on this runbook. The machine is ready too. `gandalf`, a refurbished ThinkCentre M80q, was bought on 2026-10-05 and has its 32 GB and its SATA range disk ([ADR-0096](../adr/0096-fit-ifrits-range-disk-as-a-sata-ssd-in-the-tinys-bay.md)) -fitted. **§1, §2 and §3 were done on 2026-11-07** +fitted. **§1, §2 and §3 were done on 2026-11-07, and §4 on 2026-11-09** ([#421](https://github.com/Gerrrt/HomeLab/issues/421)), and the parts as fitted are in [`hardware.md`](../hardware.md). The node is named `gandalf`, and `ifrit` names its disabled Intel AMT @@ -378,6 +378,21 @@ them. ### On `gandalf` +> **Ran on `gandalf` 2026-11-09** ([#421](https://github.com/Gerrrt/HomeLab/issues/421)), +> from a root shell on the node reached over SSH from Hicks. It found what +> `Saruman` found: with no `cluster.fw`, `pve-firewall localnet` reported +> `using detected local_network: 10.0.30.0/24`. After the alias it reported +> `using user defined local_network: 10.0.30.30`, and the +> `PVEFW-0-management-v4` set held `10.0.30.30` alone. The flip left the SSH +> session from Hicks up. The empty `management-v6` set means nothing reaches +> 8006 over IPv6 at all. +> +> **Write the files with `command cp -f`, not `cp`.** Root's shell on +> `gandalf` aliases `cp` to `cp -i`. A new file is written with no prompt, but +> the flip overwrites `cluster.fw`, so a plain `cp` waits on an +> `overwrite?` prompt that a script never answers, and `policy_in` stays +> `ACCEPT`. + Run the steps below in the same order. Seven things differ from the `Saruman` run they record: From 59db4a38c5da49e3329058270a3d9784cc46b6fc Mon Sep 17 00:00:00 2001 From: Garrett Allen <98648590+Gerrrt@users.noreply.github.com> Date: Sun, 8 Nov 2026 18:26:42 -0800 Subject: [PATCH 2/2] docs(range): keep dates out of the roadmap, and record the morpheus probe (#421) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit roadmap.md allows no dates except a gate, so the #421 entry now names the order and leaves when each step ran to the changelog and the runbook. The §4 probe from morpheus read 8006 exit=1 and control exit=0, and the runbook note and the changelog entry now say so. Refs #421 Co-Authored-By: Claude Opus 5.5 --- docs/changelog.md | 3 ++- docs/roadmap.md | 8 +++----- docs/runbooks/build-the-playground.md | 3 ++- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/changelog.md b/docs/changelog.md index e689d6c3..0eccd1fc 100644 --- a/docs/changelog.md +++ b/docs/changelog.md @@ -28,7 +28,8 @@ docstring gives: it is a record, not a claim about now. carries ADR-0014's three rules and `phoenix`'s 8006 rule. `cluster.fw` sets the alias to `10.0.30.30`, which leaves that address alone in the `management` set. The firewall was enabled at `policy_in: ACCEPT`, read - back and then flipped to `DROP`. The session from Hicks stayed up. The + back and then flipped to `DROP`. The session from Hicks stayed up, and §4's + probe from `morpheus` read `8006 exit=1` and `control exit=0`. The flip first stalled on an `overwrite?` prompt, because root's `cp` on `gandalf` is `cp -i`, and §4 now says so. There are no guests, so no guest NIC needed clearing. There is no collector or alert drill, because diff --git a/docs/roadmap.md b/docs/roadmap.md index ef4ef84d..90f1a242 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -286,11 +286,9 @@ Gated on the domain, on a household observation, or on something to publish. - **[#421](https://github.com/Gerrrt/HomeLab/issues/421) Build the range on `gandalf`.** Gated on #414 and the SOC: an attack VM pointed at an - uninstrumented estate teaches nothing. Both are met. The host is installed - as of 2026-11-07: Proxmox VE 9, the `range` pool and both bridges, the - runbook's §1 and §2. §3 ran the same night: `Saruman` is at `.20`. §4 - closed `gandalf`'s management plane on 2026-11-09. Next is §5, the attack - VM, then §6–§9. + uninstrumented estate teaches nothing. Both are met. The runbook's §1–§4 + are behind it: the host, its bridges, `Saruman` at `.20` and the closed + management plane. Next is §5, the attack VM, then §6–§9, in order. The name is [ADR-0106](adr/0106-name-the-range-host-gandalf-and-leave-ifrit-to-its-disabled-amt.md)'s. → [runbook](runbooks/build-the-playground.md) diff --git a/docs/runbooks/build-the-playground.md b/docs/runbooks/build-the-playground.md index a9bf765c..8f97fc9b 100644 --- a/docs/runbooks/build-the-playground.md +++ b/docs/runbooks/build-the-playground.md @@ -385,7 +385,8 @@ them. > `using user defined local_network: 10.0.30.30`, and the > `PVEFW-0-management-v4` set held `10.0.30.30` alone. The flip left the SSH > session from Hicks up. The empty `management-v6` set means nothing reaches -> 8006 over IPv6 at all. +> 8006 over IPv6 at all. The probe from `morpheus`, aimed at `10.0.30.30`, +> read `8006 exit=1` and `control exit=0`. > > **Write the files with `command cp -f`, not `cp`.** Root's shell on > `gandalf` aliases `cp` to `cp -i`. A new file is written with no prompt, but