From 4434c7a6daf5388413298af354100fe0e54c8fe4 Mon Sep 17 00:00:00 2001 From: Garrett Allen <98648590+Gerrrt@users.noreply.github.com> Date: Sat, 5 Sep 2026 14:59:32 +0000 Subject: [PATCH] docs: record that the lab guest is built and its log sources verified (#262) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `alexander` runs `stacks/lab` as of 2026-09-05, and §7 passed with all three Loki jobs — auth.log, syslog and journal. That last part is the point: the files existing and Alloy actually tailing them are different facts, and the second is the one that fails silently. #62 and #63 were both collectors that ran healthy and produced nothing. **26.04 ships rsyslog.** §0 chose Ubuntu over Debian because config.alloy tails two files a journald-only install does not have, then had to stop claiming the LTS provides them, because Ubuntu has been narrowing its default install and a runbook cannot know what a future reader will install. Now one LTS is confirmed: both files present, `syslog:adm 0640`, which is the ownership LOG_READ_GID is derived from. Recorded as a data point rather than a guarantee — §7 stays the check. The status block follows replace-the-smart-storage-battery.md's shape, which is this repository's convention for a runbook whose job is done: what was built, what was proven, and what bit on the way. Both things that bit are named with their fixes, because the symptoms are the kind someone hits again — a sops error about recipients (#321), and validate telling a guest to install the estate's timers (#323). The certificate copy in §5 now says `garnet@` rather than a `you@` placeholder. The estate's other scripts already carry `robo@10.0.99.20` and `atropos@10.0.99.30`; a runbook that has to be edited before it can be pasted is one that gets pasted wrong. The roadmap entry said the deploy was what remained of #264. It is not. Co-Authored-By: Claude Opus 5 --- docs/roadmap.md | 11 ++++++----- docs/runbooks/build-the-lab-guest.md | 19 +++++++++++++++++-- 2 files changed, 23 insertions(+), 7 deletions(-) diff --git a/docs/roadmap.md b/docs/roadmap.md index 33b2261..c867e92 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -507,11 +507,12 @@ what left this one unfireable for months. `*_URL` variables changed, and that file has two sinks, so a lab without a Prometheus points the second one at `10.0.99.20` and inverts the isolation the ADR exists for. - [#264](https://github.com/Gerrrt/HomeLab/issues/264) is built: - `stacks/lab/` holds the compose file, both configs, four alert rules and - their unit tests, and the secrets template. What is left of it is a deploy, - which needs [#262](https://github.com/Gerrrt/HomeLab/issues/262) — the guest - on `Saruman` — to exist first. + [#264](https://github.com/Gerrrt/HomeLab/issues/264) is built **and + running**: `stacks/lab/` is deployed on `alexander` + ([#262](https://github.com/Gerrrt/HomeLab/issues/262), 2026-09-05), the guest + on `Saruman` that ADR-0020 called for. Four services, its own age key, its own + leaf from the estate's CA, and three Loki log sources confirmed on the host — + the check the Ubuntu-over-Debian decision exists for. → [runbook](runbooks/build-the-lab-guest.md) Building it made the tooling stack-aware (`render-config.sh` derives its required keys per stack rather than demanding the estate's ten, `reload-config.sh` skips services a stack does not declare, diff --git a/docs/runbooks/build-the-lab-guest.md b/docs/runbooks/build-the-lab-guest.md index 5829fcd..7be56c8 100644 --- a/docs/runbooks/build-the-lab-guest.md +++ b/docs/runbooks/build-the-lab-guest.md @@ -6,6 +6,21 @@ KVM or `shiva`), an Ubuntu Server ISO, and a shell on the monitoring host for the certificate in §5 +> **Status — 2026-09-05: `alexander` is built and `stacks/lab` is running.** +> +> Ubuntu 26.04 LTS, `10.0.30.40`, `bc:24:11` OUI. §7 passed with all three Loki +> jobs — `/var/log/auth.log`, `/var/log/syslog` and `/var/log/journal` — so the +> file sources are collecting and not merely configured. +> +> **26.04 ships rsyslog**, which §0 could not assume: both files are present and +> `syslog:adm 0640`, the ownership `LOG_READ_GID` is derived from. That is one +> LTS confirmed, not a guarantee about the next one — §7 stays the check. +> +> Two things bit on the way through and are fixed rather than described: the +> lab's `.sops.yaml` rule matched nothing, so §4 encrypted to the estate's key +> (#321), and `make validate` told the guest to install the estate's timers +> (#323). Both are in the repository's history if the symptoms recur. + This builds the host [ADR-0020](../adr/0020-run-the-lab-stack-in-a-guest-with-its-own-prometheus.md) called for: a guest, **not** the hypervisor, because a compose stack is Docker and Docker would rewrite the iptables of the box whose own firewall ADR-0014 @@ -244,14 +259,14 @@ so a fresh clone on `alexander` does not have it and `scp` would fail into a directory that is not there: ```bash -ssh you@10.0.30.40 'mkdir -p HomeLab/certificates && chmod 700 HomeLab/certificates' +ssh garnet@10.0.30.40 'mkdir -p HomeLab/certificates && chmod 700 HomeLab/certificates' CERTS=/home/robo/code/Gerrrt/HomeLab/certificates scp -3 -p \ robo@10.0.99.20:$CERTS/ca.pem \ robo@10.0.99.20:$CERTS/grafana-lab.matrix.elysium.pem \ robo@10.0.99.20:$CERTS/grafana-lab.matrix.elysium-key.pem \ - you@10.0.30.40:HomeLab/certificates/ + garnet@10.0.30.40:HomeLab/certificates/ ``` `-3` routes the copy through the Mac without writing either file to its disk,