abiba
7b8cc5f9ac
CT 111 (tdunna, 192.168.68.129) is Theo's box and is report-only per the captain (2026-08-17, re-confirmed 2026-09-10). The contract defined AMBER as 'GC scheduled for next run' and its Execution loop called gc-executor for EVERY threat with no guest-level exclusion - so a single AMBER reading there would have scheduled apt clean / journal vacuum / log+tmp deletion against someone else's box. The only marker was frontmatter report_only_agents, which names an AGENT while the scan unit is a GUEST. - Gate the Execution loop on a guest/host-keyed report_only_guests block (guest id, hostname and IP all match); an excluded guest is alerted and skipped, so no gc-executor call is constructed for it at any level. - Carry the ruling in the contract body next to the loop, not only in frontmatter. - scripts/disk-gc-plan.py: executable planner that reads the contract's authoritative exclusion block and emits the action plan; tests/ covers it. - Correct the stale fleet map against pvesh /cluster/resources: CT 105 -> amdpve (was minipve), CT 111 -> storepve (was amdpve), add guests 118/119/120, and fix the '15 CTs' counts (20 guests: 17 LXC + 3 QEMU VMs). - scripts/pct-run.sh: same stale map (105/111 wrong node, 120 missing) - this is why pct-run 111/105 failed. - Fold in disk-gc-ct100-probe-gap-20260911: CT 100 verifiably works through pct-run now that the map is correct; documented that the scanner must probe it like any other guest, never via a local-only path (the scanner runs inside CT 100).
104 lines
3.1 KiB
Bash
Executable File
104 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# pct-run — Run commands inside Proxmox CTs by CT ID only. No IPs needed.
|
|
# Usage: pct-run <CT_ID> [command...]
|
|
# If no command given, opens a shell.
|
|
#
|
|
# Source of truth: Proxmox pct config on each node.
|
|
# No hardcoded IPs. No prose contract drift.
|
|
|
|
set -euo pipefail
|
|
|
|
# ── CT ID → PVE Node mapping (maintained HERE, not in prose contracts) ──
|
|
declare -A CT_NODES=(
|
|
# amdpve (192.168.68.15)
|
|
[105]=amdpve # kagentz (was hwepve — corrected 2026-09-12; live per pvesh)
|
|
[112]=amdpve # tanko
|
|
[113]=amdpve # baggy
|
|
[115]=amdpve # scottdenya
|
|
[120]=amdpve # adguard2 (added 2026-09-12)
|
|
# minipve (192.168.68.12)
|
|
[100]=minipve # abiba (was hwepve)
|
|
[102]=minipve # adguard (was acerpve)
|
|
[104]=minipve # authentik
|
|
[110]=minipve # gitea
|
|
[116]=minipve # syslog-api
|
|
[119]=minipve # infisical-vault
|
|
# storepve (192.168.68.6)
|
|
[106]=storepve # ra-h-os
|
|
[107]=storepve # proxmox-backup
|
|
[108]=storepve # media
|
|
[111]=storepve # tdunna (was amdpve — corrected 2026-09-12; live per pvesh)
|
|
[117]=storepve # zulip
|
|
[118]=storepve # jdownloader
|
|
# acerpve (192.168.68.9) — no CTs (bare metal GPU .8)
|
|
# ocupve (192.168.68.5) — no CTs (bare metal GPU .110)
|
|
#
|
|
# REMOVED CTs (migrated to bare metal, decommissioned, or VMs):
|
|
# 101 llm-gpu → bare metal 192.168.68.8 (RTX 3090) [QEMU VM on acerpve]
|
|
# 103 ocu-llm → bare metal 192.168.68.110 (RTX 5070) [QEMU VM on ocupve]
|
|
# 109 docker-vm → KVM VM 192.168.68.7 (use direct SSH) [QEMU VM on storepve]
|
|
)
|
|
|
|
# Each node must be root-accessible via SSH hostname
|
|
# (Ensure ~/.ssh/config or /etc/hosts has these resolvable)
|
|
|
|
# ── PVE node → IP (needed only because SSH needs an address) ──
|
|
declare -A NODE_IPS=(
|
|
[amdpve]=192.168.68.15
|
|
[minipve]=192.168.68.12
|
|
[storepve]=192.168.68.6
|
|
[acerpve]=192.168.68.9
|
|
[ocupve]=192.168.68.5
|
|
)
|
|
|
|
resolve_node() {
|
|
local ct_id="$1"
|
|
local node="${CT_NODES[$ct_id]:-}"
|
|
if [[ -z "$node" ]]; then
|
|
echo "ERROR: CT $ct_id not found in mapping" >&2
|
|
exit 1
|
|
fi
|
|
echo "$node"
|
|
}
|
|
|
|
node_ip() {
|
|
local node="$1"
|
|
local ip="${NODE_IPS[$node]:-}"
|
|
if [[ -z "$ip" ]]; then
|
|
echo "ERROR: Node $node not found in IP mapping" >&2
|
|
exit 1
|
|
fi
|
|
echo "$ip"
|
|
}
|
|
|
|
main() {
|
|
if [[ $# -lt 1 ]]; then
|
|
echo "Usage: pct-run <CT_ID> [command...]" >&2
|
|
echo " pct-run 112 cat /etc/hostname" >&2
|
|
echo " pct-run 100 systemctl status hermes-gateway" >&2
|
|
echo ""
|
|
echo "Known CTs:" >&2
|
|
for ct in $(echo "${!CT_NODES[@]}" | tr ' ' '\n' | sort -n); do
|
|
echo " CT $ct → ${CT_NODES[$ct]}" >&2
|
|
done
|
|
exit 1
|
|
fi
|
|
|
|
local ct_id="$1"
|
|
shift
|
|
local node
|
|
node=$(resolve_node "$ct_id")
|
|
local ip
|
|
ip=$(node_ip "$node")
|
|
|
|
if [[ $# -eq 0 ]]; then
|
|
# Interactive shell
|
|
exec ssh -t "root@${ip}" "pct enter ${ct_id}"
|
|
else
|
|
# One-shot command
|
|
ssh "root@${ip}" "pct exec ${ct_id} -- $*"
|
|
fi
|
|
}
|
|
|
|
main "$@"
|