[Gerrrt]

What changed

gandalf is ready for tpl-kali's build (build-the-lab-templates.md §5, step 2's gandalf half). phoenix@pve now exists on gandalf, with PhoenixBuilder on /vms, /storage/range, /storage/local and vmbr0, and PVEAuditor on /nodes/gandalf. A PhoenixIsoCleanup grant on local was revoked after review, because Kali's build uploads no answer disc. The Kali 2026.2 installer is on gandalf's local, and kali_iso_file now defaults to it. The runbook records the grants and how phoenix should hold gandalf's token. The roadmap and changelog are updated.

Why

Refs #421 and #790. The roadmap names §5, the attack VM, as next. It clones tpl-kali, which Packer builds from phoenix through gandalf's own API. That API had no user, no role and no ISO.

Blast radius

gandalf only. It has no guests. The new user has no token yet, so nothing can authenticate as it. Its grants leave out local-lvm (ADR-0096 keeps range disks off the M.2) and vmbr1 (the range NIC belongs to the clone). They grant nothing under /nodes beyond audit, so the token cannot touch the host firewall. The role leaves out Saruman's Pool.*.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml. No token was made. The runbook has the operator make it at the build, so its secret goes straight to phoenix.

Verification

Ran on gandalf, as root:

• The API certificate: issuer PVE Cluster Manager CA, SANs include 10.0.30.30, no custom pveproxy-ssl.pem. Nothing was reissued.

• pveum acl list | grep phoenix shows the five grants above. pveum role list shows PhoenixBuilder with the jumpbox list plus VM.GuestAgent.Audit, and no PhoenixIsoCleanup. pvesh get /nodes reads gandalf.

• The ISO was downloaded from cdimage.kali.org and passed sha256sum -c against the hash pinned in scripts/collect-iso-store-state.sh. pvesm list local --content iso lists local:iso/kali-linux-2026.2-installer-amd64.iso.

• Not run: the build, the smoke test and the -force rebuild. Those are Build tpl-kali (VMID 902) on ifrit once it exists #790's, from phoenix.

• scripts/check_docs.py passes. make validate exits 0 with 43 checks skipped, because this host has no docker daemon and no pipx. That includes packer validate, shellcheck and markdownlint.

• make validate passes (it passes with 43 skipped; see above)

• Deployed to the lab and confirmed working (gandalf's user, grants and ISO, read back)

• Docs updated (docs/, service README, or docs/roadmap.md)

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The runbook unnecessarily grants Gandalf datastore deletion and storage-configuration privileges for a Kali build that generates no answer disc.

2 open issues

• Remove unnecessary PhoenixIsoCleanup storage permissions · New
• Source phoenix.env before gandalf.env to set the build password · New

What changed in this PR

Prepares gandalf for building the range’s tpl-kali template from phoenix. The template build and its verification remain outstanding under #790.

Changes:

• Sets the Kali ISO default to the installer staged on gandalf.
• Documents applied permissions, separate API credentials, CA trust, and the range storage override.
• Records the preparation in the changelog and links the template build into the roadmap.

File	Description
packer/​variables.pkr.hcl	Updates the Kali ISO default and explanatory comment.
docs/​runbooks/​build-the-lab-templates.md	Documents gandalf permissions and build setup.
docs/​roadmap.md	Links the attack VM’s template-build dependency.
docs/​changelog.md	Records completed host preparation and remaining verification.

_{Review effort: Balanced}

[Gerrrt]

Revoked: PhoenixIsoCleanup is removed from phoenix@pve on gandalf's local and the role deleted there. The runbook table and the changelog entry now say why.

🤖 Addressed by Claude Code

[Gerrrt]

Fixed: §5 step 2 now sources phoenix.env (for PKR_VAR_build_password) and then gandalf.env to override the three API variables, with the one-line command.

🤖 Addressed by Claude Code