fscotto/infra
1
0
Fork 0
mirror of https://github.com/fscotto/infra.git synced 2026-09-27 19:03:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update Atlas NAS validation status and remaining TODOs

Browse Source
This commit is contained in:
Fabio Scotto di Santolo
2026-09-16 10:25:38 +02:00
parent a97c64b08f
commit e46a2b22d7
1 changed files with 19 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
AGENTS.md
View File

@@ -170,19 +170,24 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
service ports only in the WireGuard firewalld zone. service ports only in the WireGuard firewalld zone.
## Atlas NAS TODO ## Atlas NAS TODO
- Provide the required Vault variables and validate the first remote bootstrap on the real Rocky Linux 9 host. Completed validation: the existing RAIDZ2 pool and datasets, SELinux, LAN firewall, SSH, Cockpit with
Before the first apply, confirm the pool, mountpoints, LAN subnet and firewalld zone. Keep the selected 45Drives plugins, encrypted SMB3 `Archive`, the Aegis-only NFSv4 `photobook` export, and
`atlas_manage_media_stack` disabled until `/dev/dri`, the container paths and the Immich database secret are validated. the Prometheus--Atlas WireGuard path are operational. Aegis has validated NFSv4.2 read, write, delete,
- Validate the complete baseline on the target: OpenZFS kmod loading, existing pool import, dataset and `all_squash` mapping to UID/GID `1100` end-to-end.
mounts, SSH reconnect, Cockpit and all selected 45Drives plugins, NFSv4, SMB and Syncthing. - Complete the Phase 1 Navidrome cutover: stop the Prometheus writer, copy and verify its complete
- Finalize dataset properties and the shared UID/GID, group and POSIX ACL model; test the same files `/opt/navidrome/data/` directory (including SQLite sidecars) under
through both NFS and SMB before considering multiprotocol access complete. `/zpool/archive/app_data/navidrome/`, then set `backend_phase1_start_services: true` and validate
Navidrome on Atlas through WireGuard. Do not delete the source until a restore test succeeds.
- Start and validate the rendered Syncthing Quadlet only after its device IDs, star topology, folders,
folder modes, ignore rules, and GUI/API protection are declared. Validate its GUI and native transfer
ports through WireGuard only.
- Decide whether a common SMB/NFS namespace is required. `Archive` (SMB) and `photobook` (NFS) are
intentionally distinct today; only if a shared namespace is selected, finalize its UID/GID, group,
and POSIX ACL model and test the same files through both protocols.
- Keep `atlas_manage_media_stack` disabled until the future Immich deployment has validated `/dev/dri`,
container paths, and the required Vault database secret.
- Add Ansible-managed ZFS snapshot retention and scrub timers. Use Cockpit Scheduler for visibility - Add Ansible-managed ZFS snapshot retention and scrub timers. Use Cockpit Scheduler for visibility
or manual operations, not as the only source of configuration, and never automate snapshot rollback. or manual operations, not as the only source of configuration, and never automate snapshot rollback.
- Manage the Syncthing star topology, device IDs, folders, folder modes, ignore rules and protected GUI
or API access for the selected clients.
- Validate the managed WireGuard path and its LAN/VPN-only firewalld rules before enabling remote services;
never expose SSH, Cockpit, NFS, SMB or Syncthing through public port forwarding.
- Add the Atlas-initiated least-privilege Prometheus backup pull: Prometheus exposes only prepared - Add the Atlas-initiated least-privilege Prometheus backup pull: Prometheus exposes only prepared
read-only dumps through a dedicated account and Atlas retains the private SSH key, pinned host key, read-only dumps through a dedicated account and Atlas retains the private SSH key, pinned host key,
atomic pull, verification, retention and systemd service/timer. atomic pull, verification, retention and systemd service/timer.
@@ -195,8 +200,9 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
failed backup timers, plus a controlled Rocky kernel/OpenZFS update and reboot procedure. failed backup timers, plus a controlled Rocky kernel/OpenZFS update and reboot procedure.
- Document and test disaster recovery: rebuild Atlas with Ansible, import the existing pool, restore - Document and test disaster recovery: rebuild Atlas with Ansible, import the existing pool, restore
from snapshot/USB/Hetzner, preserve Vault and Borg recovery material offline, and define RPO/RTO. from snapshot/USB/Hetzner, preserve Vault and Borg recovery material offline, and define RPO/RTO.
- Optionally design iCloud photo ingestion as a separate workflow after the storage and backup layers - Optionally design iCloud photo ingestion and an Aegis persistent NFS mount as a separate workflow
are validated; do not make it a dependency of the Atlas baseline. after the storage and backup layers are validated; do not make either a dependency of the Atlas
baseline.
## Coding Agent Notes ## Coding Agent Notes
- Shared agent definitions and lifecycle flags live in `ai_agents` in `ansible/inventory/group_vars/all.yml`. - Shared agent definitions and lifecycle flags live in `ai_agents` in `ansible/inventory/group_vars/all.yml`.