docs: add win01, VLAN 50 on lab02, and the Windows VM runbook

docs/docs/reference/networking/address-plan.md

@@ -40,7 +40,7 @@ traffic retains its source addresses.
 | `10` | Management | `10.10.10.0/24` | `10.10.10.1` | IncusOS management, network-device management, and `nas01` management |
 | `30` | Storage | `10.10.30.0/24` | None (not routed) | Incus node storage network on the compute-facing `sw-core01` links |
 | `40` | Sandbox/workload | `10.10.40.0/24` | `10.10.40.1` | `sandbox01`, Incus instances attached over the cluster fast links, and other explicitly attached workload endpoints |
-| `50` | Services | `10.10.50.0/24` | `10.10.50.1` | Long-lived service VMs on members that carry `fast50` (today `nas01`); see [ADR-0008](../../decisions/0008-give-service-vms-a-dedicated-services-vlan.md) |
+| `50` | Services | `10.10.50.0/24` | `10.10.50.1` | Long-lived service VMs on members that carry `fast50` (today `nas01` and `lab02`); see [ADR-0008](../../decisions/0008-give-service-vms-a-dedicated-services-vlan.md) |
 | `70` | OOB | `10.10.70.0/24` | `10.10.70.1` | MS-02 AMT, `pikvm01`, `kvm01`, and management-switch administration |
 
 VLAN 20 and `10.10.20.0/24` are retired. The lab does not retain a PXE or
@@ -70,6 +70,7 @@ by the `GilmanLab/fleet` `cluster/` project and mirrored in each node's seed.
 | `ovncentral01` OVN central | `10.10.10.15` | Static VM interface on `nas01`'s unmanaged `mgmt` bridge |
 | `agentcompute01` MCP service | `10.10.10.16` | Static `/32` on a routed Incus NIC through `lab01`'s `_vmgmt` interface; host gateway `169.254.0.1` |
 | `media01` media stack | `10.10.50.20` | Static VM interface; macvlan on `nas01`'s IncusOS `fast50` interface |
+| `win01` Windows desktop | `10.10.50.30` | Static guest-configured address; macvlan on `lab02`'s IncusOS `fast50` interface |
 
 ### Hosts
 
@@ -209,10 +210,11 @@ LAGs, one per MS-02 SFP+ pair: `bond-lab01` (ports 1–2), `bond-lab02` (ports
 interface. VLANs 30 and 40 are tagged on the three LAGs and port 7: VLAN 30
 is the node storage network, and VLAN 40 carries Incus instance traffic so
 workloads stay off the management plane. VLAN 50 (services) is tagged only on
-port 7. These links are not required for IncusOS management boot. The
-host-side counterpart, converged by the `GilmanLab/fleet` `cluster/` project,
-is the `vlan_tags` allow-list plus an IncusOS-declared VLAN interface per
-carried VLAN (`fast30`, `fast40`, and `fast50` on `nas01`). Instances must
+port 7 and `bond-lab02`. These links are not required for IncusOS management
+boot. The host-side counterpart, converged by the `GilmanLab/fleet` `cluster/`
+project, is the `vlan_tags` allow-list plus an IncusOS-declared VLAN interface
+per carried VLAN (`fast30`, `fast40`, and `fast50` on `nas01` and `lab02`).
+Instances must
 attach to an IncusOS-owned interface, never with an Incus-created `vlan=`
 sub-interface on `fast`: the visible `fast` device is an IncusOS-internal
 VLAN-filtering bridge, and only IncusOS-declared VLANs receive bridge

docs/docs/runbooks/windows-vm.md

@@ -0,0 +1,124 @@
+---
+title: Deploy and use the Windows VM
+description: Install win01 unattended on lab02, connect over Remote Desktop, activate it, and recover it.
+---
+
+# Deploy and Use the Windows VM
+
+`win01` is a Windows 11 Pro desktop VM on `lab02`, used over Remote Desktop.
+It sits on the services VLAN at `10.10.50.30`, so home and tailnet clients
+reach it through `gw01`. The OpenTofu root is `GilmanLab/fleet`
+`incus/windows/`; its README lists the devices and the install media design.
+
+| Access | Value |
+| --- | --- |
+| Remote Desktop | `10.10.50.30` |
+| Administrator | `josh`, password in `GilmanLab/secrets` `services/windows/win01.sops.yaml` |
+
+## Preconditions
+
+- `nas01:` Incus remote with the operator client certificate. The OpenTofu
+  provider on macOS needs
+  `INCUS_CONF="$HOME/Library/Application Support/incus"`.
+- `AWS_PROFILE=lab-admin` with a live SSO session (state backend and SOPS).
+- `lab02` `fast50` converged by `fleet-cluster network`, and VLAN 50 tagged on
+  `sw-core01` `bond-lab02` (`GilmanLab/networking`).
+- A Windows 11 multi-edition ISO from
+  <https://www.microsoft.com/software-download/windows11> and the stable
+  `virtio-win.iso` from
+  <https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/stable-virtio/>.
+- A Windows 11 **Pro** licence. Home cannot host Remote Desktop.
+
+## Safety impact
+
+Creating the VM touches only `lab02`. The instance has `prevent_destroy`; a
+`tofu destroy` fails rather than deleting the installed system disk. The
+unattend ISO wipes the VM's own disk 0 only, and only while the install media
+are attached. Never attach the VM to `fast40`: a macvlan there breaks
+`lab02`'s OVN gateway.
+
+## Install
+
+From `GilmanLab/fleet` `incus/windows/`:
+
+```bash
+export AWS_PROFILE=lab-admin GLAB_AWS_STATE_BUCKET=glab-lab-tfstate-186067932323
+export INCUS_CONF="$HOME/Library/Application Support/incus"
+just init
+just stage-install-media ~/Downloads/win11.iso ~/Downloads/virtio-win.iso \
+  ~/code/glab/secrets/services/windows/win01.sops.yaml
+just plan -var running=false -var install_media=true && just apply
+incus config set nas01:win01 image.os=Windows
+just plan -var install_media=true && just apply
+```
+
+Setup reboots several times and finishes in about 20 minutes. It is done when
+Remote Desktop answers:
+
+```bash
+nc -z -w 5 10.10.50.30 3389 && echo ready
+```
+
+Then detach and delete the install media:
+
+```bash
+just plan && just apply
+just remove-install-media
+```
+
+## Connect
+
+1. Copy the password:
+
+   ```bash
+   AWS_PROFILE=lab-admin sops decrypt --extract '["win01"]["admin_password"]' \
+     ~/code/glab/secrets/services/windows/win01.sops.yaml | pbcopy
+   ```
+
+2. In the Windows App (Microsoft Remote Desktop) on macOS, add PC
+   `10.10.50.30`, user `josh`, and paste the password.
+
+The media library is available read-only at `\\10.10.50.20\media` with the
+`media` account from the media stack runbook.
+
+## Activate
+
+**Settings → System → Activation → Change product key**, enter the purchased
+Windows 11 Pro key. The install uses Microsoft's generic Pro key, which selects
+the edition but never activates.
+
+## Recovery
+
+- No Remote Desktop after install: `C:\win01-setup.log` records the
+  first-logon script. Without a working session, open the graphical console
+  with `remote-viewer` installed. On macOS the default Incus config path
+  contains a space, which `remote-viewer` cannot open, so point
+  `INCUS_CONF` at a symlink:
+
+  ```bash
+  ln -sfn "$HOME/Library/Application Support/incus" /tmp/incusconf
+  INCUS_CONF=/tmp/incusconf incus console nas01:win01 --type=vga
+  ```
+
+- Watch the firmware during install with
+  `incus console nas01:win01 --show-log`. The system disk boots first; on an
+  empty disk the firmware logs `NVMe ... Not Found` and starts the installer
+  from USB. `Time out` on the USB entry means the ISO was not staged through
+  `just stage-install-media`, which removes the "Press any key" prompt.
+- Restart an interrupted install: an install stopped part-way leaves files on
+  the disk, and Setup then stops at "It looks like you started an upgrade"
+  before reading the answer file. Wipe the system disk and boot again;
+  `rebuild` clears `image.os`, so set it again:
+
+  ```bash
+  incus stop -f nas01:win01
+  incus rebuild nas01:win01 --empty
+  incus config set nas01:win01 image.os=Windows
+  incus start nas01:win01
+  ```
+
+## Escalate
+
+- `nc` to `10.10.50.30:3389` fails from home but the VM is running: check the
+  VLAN 50 tag on `bond-lab02` and the `fast50` interface on `lab02`
+  (`incus query "nas01:/os/1.0/system/network?target=lab02"`).

docs/mkdocs.yml

@@ -64,6 +64,7 @@ nav:
       - Deploy the VyOS gateway configuration: runbooks/vyos-gateway-deployment.md
       - Deploy private image runners: runbooks/private-image-runners.md
       - Deploy and operate the media stack: runbooks/media-stack.md
+      - Deploy and use the Windows VM: runbooks/windows-vm.md
 
 plugins:
   - search