diff --git a/docs/docs/reference/networking/address-plan.md b/docs/docs/reference/networking/address-plan.md index a0c9f68..6b5d2f3 100644 --- a/docs/docs/reference/networking/address-plan.md +++ b/docs/docs/reference/networking/address-plan.md @@ -40,7 +40,7 @@ traffic retains its source addresses. | `10` | Management | `10.10.10.0/24` | `10.10.10.1` | IncusOS management, network-device management, and `nas01` management | | `30` | Storage | `10.10.30.0/24` | None (not routed) | Incus node storage network on the compute-facing `sw-core01` links | | `40` | Sandbox/workload | `10.10.40.0/24` | `10.10.40.1` | `sandbox01`, Incus instances attached over the cluster fast links, and other explicitly attached workload endpoints | -| `50` | Services | `10.10.50.0/24` | `10.10.50.1` | Long-lived service VMs on members that carry `fast50` (today `nas01`); see [ADR-0008](../../decisions/0008-give-service-vms-a-dedicated-services-vlan.md) | +| `50` | Services | `10.10.50.0/24` | `10.10.50.1` | Long-lived service VMs on members that carry `fast50` (today `nas01` and `lab02`); see [ADR-0008](../../decisions/0008-give-service-vms-a-dedicated-services-vlan.md) | | `70` | OOB | `10.10.70.0/24` | `10.10.70.1` | MS-02 AMT, `pikvm01`, `kvm01`, and management-switch administration | VLAN 20 and `10.10.20.0/24` are retired. The lab does not retain a PXE or @@ -70,6 +70,7 @@ by the `GilmanLab/fleet` `cluster/` project and mirrored in each node's seed. | `ovncentral01` OVN central | `10.10.10.15` | Static VM interface on `nas01`'s unmanaged `mgmt` bridge | | `agentcompute01` MCP service | `10.10.10.16` | Static `/32` on a routed Incus NIC through `lab01`'s `_vmgmt` interface; host gateway `169.254.0.1` | | `media01` media stack | `10.10.50.20` | Static VM interface; macvlan on `nas01`'s IncusOS `fast50` interface | +| `win01` Windows desktop | `10.10.50.30` | Static guest-configured address; macvlan on `lab02`'s IncusOS `fast50` interface | ### Hosts @@ -209,10 +210,11 @@ LAGs, one per MS-02 SFP+ pair: `bond-lab01` (ports 1–2), `bond-lab02` (ports interface. VLANs 30 and 40 are tagged on the three LAGs and port 7: VLAN 30 is the node storage network, and VLAN 40 carries Incus instance traffic so workloads stay off the management plane. VLAN 50 (services) is tagged only on -port 7. These links are not required for IncusOS management boot. The -host-side counterpart, converged by the `GilmanLab/fleet` `cluster/` project, -is the `vlan_tags` allow-list plus an IncusOS-declared VLAN interface per -carried VLAN (`fast30`, `fast40`, and `fast50` on `nas01`). Instances must +port 7 and `bond-lab02`. These links are not required for IncusOS management +boot. The host-side counterpart, converged by the `GilmanLab/fleet` `cluster/` +project, is the `vlan_tags` allow-list plus an IncusOS-declared VLAN interface +per carried VLAN (`fast30`, `fast40`, and `fast50` on `nas01` and `lab02`). +Instances must attach to an IncusOS-owned interface, never with an Incus-created `vlan=` sub-interface on `fast`: the visible `fast` device is an IncusOS-internal VLAN-filtering bridge, and only IncusOS-declared VLANs receive bridge diff --git a/docs/docs/runbooks/windows-vm.md b/docs/docs/runbooks/windows-vm.md new file mode 100644 index 0000000..1525fe4 --- /dev/null +++ b/docs/docs/runbooks/windows-vm.md @@ -0,0 +1,124 @@ +--- +title: Deploy and use the Windows VM +description: Install win01 unattended on lab02, connect over Remote Desktop, activate it, and recover it. +--- + +# Deploy and Use the Windows VM + +`win01` is a Windows 11 Pro desktop VM on `lab02`, used over Remote Desktop. +It sits on the services VLAN at `10.10.50.30`, so home and tailnet clients +reach it through `gw01`. The OpenTofu root is `GilmanLab/fleet` +`incus/windows/`; its README lists the devices and the install media design. + +| Access | Value | +| --- | --- | +| Remote Desktop | `10.10.50.30` | +| Administrator | `josh`, password in `GilmanLab/secrets` `services/windows/win01.sops.yaml` | + +## Preconditions + +- `nas01:` Incus remote with the operator client certificate. The OpenTofu + provider on macOS needs + `INCUS_CONF="$HOME/Library/Application Support/incus"`. +- `AWS_PROFILE=lab-admin` with a live SSO session (state backend and SOPS). +- `lab02` `fast50` converged by `fleet-cluster network`, and VLAN 50 tagged on + `sw-core01` `bond-lab02` (`GilmanLab/networking`). +- A Windows 11 multi-edition ISO from + and the stable + `virtio-win.iso` from + . +- A Windows 11 **Pro** licence. Home cannot host Remote Desktop. + +## Safety impact + +Creating the VM touches only `lab02`. The instance has `prevent_destroy`; a +`tofu destroy` fails rather than deleting the installed system disk. The +unattend ISO wipes the VM's own disk 0 only, and only while the install media +are attached. Never attach the VM to `fast40`: a macvlan there breaks +`lab02`'s OVN gateway. + +## Install + +From `GilmanLab/fleet` `incus/windows/`: + +```bash +export AWS_PROFILE=lab-admin GLAB_AWS_STATE_BUCKET=glab-lab-tfstate-186067932323 +export INCUS_CONF="$HOME/Library/Application Support/incus" +just init +just stage-install-media ~/Downloads/win11.iso ~/Downloads/virtio-win.iso \ + ~/code/glab/secrets/services/windows/win01.sops.yaml +just plan -var running=false -var install_media=true && just apply +incus config set nas01:win01 image.os=Windows +just plan -var install_media=true && just apply +``` + +Setup reboots several times and finishes in about 20 minutes. It is done when +Remote Desktop answers: + +```bash +nc -z -w 5 10.10.50.30 3389 && echo ready +``` + +Then detach and delete the install media: + +```bash +just plan && just apply +just remove-install-media +``` + +## Connect + +1. Copy the password: + + ```bash + AWS_PROFILE=lab-admin sops decrypt --extract '["win01"]["admin_password"]' \ + ~/code/glab/secrets/services/windows/win01.sops.yaml | pbcopy + ``` + +2. In the Windows App (Microsoft Remote Desktop) on macOS, add PC + `10.10.50.30`, user `josh`, and paste the password. + +The media library is available read-only at `\\10.10.50.20\media` with the +`media` account from the media stack runbook. + +## Activate + +**Settings → System → Activation → Change product key**, enter the purchased +Windows 11 Pro key. The install uses Microsoft's generic Pro key, which selects +the edition but never activates. + +## Recovery + +- No Remote Desktop after install: `C:\win01-setup.log` records the + first-logon script. Without a working session, open the graphical console + with `remote-viewer` installed. On macOS the default Incus config path + contains a space, which `remote-viewer` cannot open, so point + `INCUS_CONF` at a symlink: + + ```bash + ln -sfn "$HOME/Library/Application Support/incus" /tmp/incusconf + INCUS_CONF=/tmp/incusconf incus console nas01:win01 --type=vga + ``` + +- Watch the firmware during install with + `incus console nas01:win01 --show-log`. The system disk boots first; on an + empty disk the firmware logs `NVMe ... Not Found` and starts the installer + from USB. `Time out` on the USB entry means the ISO was not staged through + `just stage-install-media`, which removes the "Press any key" prompt. +- Restart an interrupted install: an install stopped part-way leaves files on + the disk, and Setup then stops at "It looks like you started an upgrade" + before reading the answer file. Wipe the system disk and boot again; + `rebuild` clears `image.os`, so set it again: + + ```bash + incus stop -f nas01:win01 + incus rebuild nas01:win01 --empty + incus config set nas01:win01 image.os=Windows + incus start nas01:win01 + ``` + +## Escalate + +- `nc` to `10.10.50.30:3389` fails from home but the VM is running: check the + VLAN 50 tag on `bond-lab02` and the `fast50` interface on `lab02` + (`incus query "nas01:/os/1.0/system/network?target=lab02"`). diff --git a/docs/mkdocs.yml b/docs/mkdocs.yml index b4fbae2..8bbbc31 100644 --- a/docs/mkdocs.yml +++ b/docs/mkdocs.yml @@ -64,6 +64,7 @@ nav: - Deploy the VyOS gateway configuration: runbooks/vyos-gateway-deployment.md - Deploy private image runners: runbooks/private-image-runners.md - Deploy and operate the media stack: runbooks/media-stack.md + - Deploy and use the Windows VM: runbooks/windows-vm.md plugins: - search