From c0f71756ee355d9fdd0a1b55ab1074a10876f9f3 Mon Sep 17 00:00:00 2001 From: Charles N Wyble Date: Thu, 3 Sep 2026 23:12:37 -0500 Subject: [PATCH] answered --- questions-v10.md | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/questions-v10.md b/questions-v10.md index 1342acc..192e9d5 100644 --- a/questions-v10.md +++ b/questions-v10.md @@ -23,31 +23,45 @@ from v9 carried at the bottom. One-line answers fine. ruling, matching PFVCluster's class. OK, or flip some/all private (one-click each; say which)? +A: public is fine + **OQ2 (legacy overlaps).** Old repos `TSYS-CA` and `KNELSecretsManager` overlap the new `ca` / `secrets`. Archive them into the new scheme (redirect README), or leave as-is? +A; port them both to the new respective repository as it makes sense + **OQ3 (apt-satellite design).** Recommend: start with a flat pinned-mirror (the #758 tsys-ca pattern), graduate to aptly when the fleet grows. Approve? +Yes + **OQ4 (Prometheus placement).** Recommend: Prometheus + Alertmanager on tsys-librenms alongside LibreNMS (same vantage, no new VM); Grafana stays on Cloudron. Approve, or name a host? +No. Stay on cloudron. + **OQ5 (Kuma window automation).** `~/.creds/uptime-kuma.env` exists — may I wire it into `pve-snapshot.sh` so rollbacks auto-create the maintenance window (and close it after), instead of the current manual reminder? +Yes + **OQ6 (preprod ownership).** The 531xx preprod lane on tsys5: is THIS lane the driver for vendor-version soak (~1wk, then promote), with per-domain chats consulted? Or per-stack? +Hmmm. Not sure. I think this lane we map it out and test . And develop the proxsss and run the promotions / soak per stack . Analyze and report / retort please. + **OQ7 (GLPI changes during converge loops).** Until GLPI change-control is ruled (#705/#741): sectestbed playbook iterations stay Redmine-ticket-only, exception requests noted in the ticket. OK, or start logging GLPI Changes now? +Start now + **OQ8 (pfv-bms → KNELBMS rename).** Deferred per your golden rule (HA chat active). Confirm the rename lands with the HA chat once you bless it — this lane will not touch it. @@ -57,18 +71,28 @@ lane will not touch it. **PQ5 (native PMG cluster?).** Recommended: yes — config + quarantine replication between .1.11/.1.10, managed strictly serial. OK? +Yes. + **PQ6 (TLS from fleet CA #697?).** Recommended: yes for the two admin UIs; SMTP stays opportunistic. +Yes + **PQ7 (notify address).** Confirm `coo@turnsys.com` for PMG alerts + held-mail notices? +Yes . For all root and postmaster etc mail + **PQ8 (VIP specifics).** Confirm VIP 192.168.3.249 + `smtp.knel.net` + dhcpd host-decl pin (VRRP MAC 00:00:5e:00:01:0a)? +Yea + **PQ9 (outbound cutover staging).** Serial staged: PVE hosts + PBS first (verify a week), then VM postfix. OK? +Yes + **PQ11 (Cloudron relay user — founder side).** Create `pfv-relay@turnsys.com` for PMG submission, or point me at who does? Fallback: PMG delivers direct to recipient MXs. @@ -76,10 +100,14 @@ to recipient MXs. **PQ12 (k8s submission port).** :25 unauthenticated from trusted LAN as default; :587+auth later if wanted. OK? +Yes + **PQ10 (side findings — ticket placement).** (a) tsys-ucs-02 root alias blackhole; (b) Wazuh alerting never configured (#335). Ride-alongs in #696 or separate sub-tickets? +As you wish. I don’t have an option either way. Get outbound mail working everywhere. + ## Carried from v6 — still open **Q4. Second human approver in gitea?** Blocks access-roster merges by