Rebuild runbook + state capture + docs sync to current reality (#615)

REBUILD.md maps a full rebuild (PVE qm spec incl. nested-virt flag,
guest OS/accounts/dotfiles bootstrap, script order, package baseline,
verification checklist). 14-capture-state.sh regenerates docs/state
snapshots (guest apt/units/sysctl/fstab/docker + PVE 5111 config).
Docs sync: stale multiqueue-owed text removed from NEXT/REPORT/RUNBOOK;
README script list + open-work list current.

Details: https://projects.knownelement.com/issues/615

14-capture-state.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+# 14-capture-state.sh — snapshot guest + PVE state for rebuild docs (#615)
+# Read-only; regenerates docs/state/* (stable names, diff-friendly).
+# Runs as reachableceo on the workstation; uses the two root ssh paths.
+set -euo pipefail
+cd "$(dirname "$0")"
+OUT=docs/state
+GUEST_SSH="timeout 60 ssh root@100.101.187.119"   # this VM, privileged
+PVE_SSH="timeout 60 ssh root@100.87.135.12"       # pfv-tsys5
+mkdir -p "$OUT"
+
+echo "== guest: packages"
+apt-mark showmanual | sort > "$OUT/guest-apt-manual.txt"
+dpkg -l | tail -n +6 | wc -l > "$OUT/guest-dpkg-count.txt"
+timeout 30 ssh root@100.101.187.119 'apt-cache policy docker-ce docker.io 2>/dev/null | grep -E "^[a-z]|Installed|Candidate" | head -8' > "$OUT/guest-docker-pkg.txt" 2>&1 || true
+
+echo "== guest: users/groups"
+timeout 30 ssh root@100.101.187.119 'getent passwd | awk -F: "\$3>=1000 && \$3<65534"; echo ---; for u in reachableceo reachableceo-offstage; do id $u; done' > "$OUT/guest-users.txt"
+
+echo "== guest: units + sysctl + fstab"
+timeout 60 ssh root@100.101.187.119 '
+systemctl list-unit-files --state=enabled | sort;
+echo ===CUSTOM-UNITS;
+find /etc/systemd/system -maxdepth 2 \( -type f -o -type l \) | sort;
+echo ===SYSCONTROL;
+for f in /etc/sysctl.d/*.conf; do echo "-- $f"; cat "$f"; done;
+echo ===FSTAB;
+cat /etc/fstab;
+echo ===SUDOERS;
+ls -la /etc/sudoers.d/;
+echo ===XRDP-DROPIN;
+cat /etc/systemd/system/xrdp.service.d/*.conf 2>/dev/null' > "$OUT/guest-system.txt"
+
+echo "== guest: disks + docker"
+lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINT > "$OUT/guest-disks.txt"
+df -h | grep -vE "tmpfs|udev|overlay|squashfs" >> "$OUT/guest-disks.txt"
+{ docker images --format "{{.Repository}}:{{.Tag}}  {{.Size}}"; echo ---; docker ps -a --format "{{.Names}}  {{.Image}}  {{.Status}}"; } > "$OUT/guest-docker.txt" 2>/dev/null || echo "docker unavailable" > "$OUT/guest-docker.txt"
+
+echo "== PVE: VM 5111 + host"
+timeout 60 ssh -o ConnectTimeout=10 root@100.87.135.12 '
+echo "=== qm config 5111 (live)"; qm config 5111 --current 2>/dev/null || qm config 5111;
+echo "=== qm list"; qm list;
+echo "=== storage.cfg"; cat /etc/pve/storage.cfg;
+echo "=== pool usage"; df -h /mnt/nvme /mnt/ssd2 /mnt/pfv-tsys5/ssd 2>/dev/null;
+echo "=== host"; grep -m1 "model name" /proc/cpuinfo; free -g | head -2; uname -r;
+echo "=== nested"; cat /sys/module/kvm_intel/parameters/nested' > "$OUT/pve-5111.txt" || echo "PVE host unreachable — rerun later" > "$OUT/pve-5111.txt"
+
+echo "== done: $(ls "$OUT" | wc -l) files in $OUT/"
+ls -la "$OUT"

NEXT.md

@@ -20,12 +20,11 @@
 - All guest tuning live and verified (see 16:04-16:15 pass below).
 - Host flags live: ssd=1/discard (ROTA=0), iothread, onboot=1, startup
   order=10, cpuunits 9000/50, ide2 gone.
-- Net multiqueue: queues=4/2 now IN live qm config (staged 16:40 by crush
+- Net multiqueue: DONE + verified 2026-09-01 (bounce 22:51->22:53; ens18
-  via ssh); activates at the next VM start — ONE reboot still owed, human-
+  4/4, ens19 2/2). 5-activate-multiqueue.sh is historical record.
-  timed: run ~/projects/ultix/5-activate-multiqueue.sh (kills crush
+- 2026-09-01: microvm tooling LIVE (#615: microvm CLI, qemu-microvm
-  sessions, ~4 min). HUMAN 2026-08-31 eve: nothing else is running on this
+  engine, per-user tap pools + NAT; firecracker blocked by nested-KVM
-  system — bounce THIS SESSION, right after the remaining session tasks.
+  caps until #601 hardware) + REBUILD.md/docs/state capture landed.
-  Guest oneshot ukrrs-net-multiqueue auto-runs ethtool -L on that boot.
 - Gateway boot-race + live-restore endpoint loss: permanently fixed by
   ukrrs-gateway-ensure unit (enabled, both lanes).
 - Root cause of the 15:59 no-op: the script copy executed then predates the

README.md

@@ -10,7 +10,9 @@ are manual-only by ruling.
   #605 k8s + proxmox token (blocked by #601), #606 GPU passthrough,
   #607 account map/mkacct, #608 compose cgroup_parent wiring (gateway
   starvation fix on 8 vCPU), #609 Fri 09-04 troubleshooting-only outage;
-  pass record: #602.
+  #611 RDP big-monitor fix (live, human UAT pending), #612 dotfiles v2 +
+  Kali addendum (human UAT pending), #615 microvm + rebuild capture,
+  #616 macOS VM (blocked by #601); pass record: #602.
   https://projects.knownelement.com/projects/55
 - Discourse doc: pending (house cross-link rule: create at next doc pass).
 - Docs live in-repo (runbook exception per house rules):
@@ -18,14 +20,19 @@ are manual-only by ruling.
   - NEXT.md — current state / what is owed (usually: nothing)
   - TRACKING.md — rolling HUD table + decisions log
   - GROW-ROOT-RUNBOOK.md — manual root-growth checklist (#603)
+  - REBUILD.md — full-rebuild runbook, guest + PVE sides (#615);
+    docs/state/ holds regenerable state snapshots (14-capture-state.sh)
   - RUNBOOK-TODAY.md, questions-v1.md
 - Scripts (human-run unless noted): 1-guest-prep.sh, 2-host-one-shot.sh,
   3-post-reboot-fixes.sh, 4-host-netcheck.sh (crush may run via ssh),
-  5-activate-multiqueue.sh (the one remaining reboot), 6-remove-agent-stacks.sh
+  5-activate-multiqueue.sh (historical — multiqueue live 2026-09-01),
-  (boot-time screen/crush relauncher teardown; backups in
+  6-remove-agent-stacks.sh (boot-time screen/crush relauncher teardown;
-  removed-agent-stacks/), 7-open-terminal-install.sh + 8-open-terminal-users.sh
+  backups in removed-agent-stacks/), 7-open-terminal-install.sh +
-  (Open Terminal fleet, #610), 9-uat-openwebui.sh (OpenWebUI<->terminal UAT
+  8-open-terminal-users.sh (Open Terminal fleet, #610), 9-uat-openwebui.sh
-  harness; uat/ holds its compose). staged/ holds the gated configs.
+  (OpenWebUI<->terminal UAT harness; uat/ holds its compose),
+  12-fix-rdp-bigres.sh (xrdp EGFX frame budget, #611),
+  13-microvm-setup.sh + microvm/ (microVM tooling, #615),
+  14-capture-state.sh (refresh docs/state). staged/ holds the gated configs.
 - OPEN-TERMINAL.md — ops note for the terminal fleet: ports, keys location,
   production OpenWebUI wiring, UAT record.
 - crush.md = session preferences for agents working in this repo.

REBUILD.md

@@ -0,0 +1,133 @@
+# REBUILD.md — ultix-streaming (VM 5111) full-rebuild runbook (#615)
+
+How to rebuild this workstation from bare metal up. The mechanism is
+this repo's numbered idempotent scripts, run in order; this file is the
+map + the parts scripts don't cover. Fleet-wide ansible will consume
+this later (human goal, 2026-09-01); until then: shell-first.
+
+- Live state snapshots: `docs/state/` — regenerate any time with
+  `./14-capture-state.sh` (read-only; guest + PVE).
+- Secrets live ONLY in `~/.creds` (human restores from backup); never
+  in this repo, images, or compose files.
+- Docker/registry content is repo-owned (repos rebuild their own
+  containers) — out of scope here.
+- PVE-side DR path for total loss: existing vzdump/backup policy, not
+  this runbook (this runbook is for a clean, deliberate rebuild).
+
+## 0. PVE side (host pfv-tsys5)
+
+Prereqs on the host: nested KVM enabled
+(`/sys/module/kvm_intel/parameters/nested` = Y), dir storages `NVME`,
+`ssd2`, `SSD`, bridges `vmbr0` (LAN) + `datanet`.
+
+VM definition (live copy: `docs/state/pve-5111.txt`):
+
+    qm create 5111 --name ultix-streaming --ostype l26 \
+      --cores 4 --sockets 2 --cpu host,flags=+nested-virt \
+      --memory 50000 --balloon 0 \
+      --scsihw virtio-scsi-single \
+      --net0 virtio,bridge=vmbr0,queues=4 \
+      --net1 virtio,bridge=datanet,queues=2 \
+      --agent 1 --onboot 1 --startup order=10,up=180 --cpuunits 9000
+    # disks (each with discard=on,iothread=1,ssd=1):
+    #   scsi0 NVME:438G (OS)   scsi1 ssd2:400G (/data2)   scsi2 SSD:200G (/data1)
+
+Flags why: `cpu host`+nested-virt = microvm/Firecracker inside;
+virtio-scsi-single + iothread = per-disk IO threads; queues 4/2 match
+guest multiqueue (activated in live qm config 2026-09-01); cpuunits
+9000 keeps the workstation above the fleet; onboot+order=10 = first VM
+up after host boot (gateway auto-recovers).
+
+## 1. Guest OS
+
+- Debian 13 trixie amd64 netinst, KDE desktop, standard guided
+  partitioning on the NVME (ext4 + swap; ends up / 279G + swap 8.8G).
+- Mount the data disks per `docs/state/guest-system.txt` FSTAB section:
+  `/data1` (SSD 200G) and `/data2` (ssd2 400G), ext4 `noatime`.
+- Hostname `ultix-streaming`; ssh enabled.
+- KDE policy (2026-08-31 ruling): autologin into an UNLOCKED
+  always-alive session (sddm Relogin=true, autolock OFF) — applied by
+  `fix-kde.sh` in this repo.
+
+## 2. Accounts + secrets + tools
+
+- Accounts: `reachableceo` (uid 1001), `reachableceo-offstage`;
+  shells `/usr/bin/zsh`; groups: sudo, kvm, docker, libvirt (see
+  `docs/state/guest-users.txt`).
+- `~/.creds/*` restored by the human (redmine, discourse, gateway,
+  open-terminal env files...). Nothing secret is in this repo.
+- ssh keys: human restores (bitwarden ssh-agent pattern).
+- `/usr/local/bin/chezmoi` v2.72.1 (single binary), `/usr/local/bin/
+  firecracker` + `jailer` v1.16.1 (installed by 13-microvm-setup.sh).
+
+## 3. Repo scripts, in order
+
+| script | what / when |
+|---|---|
+| `1-guest-prep.sh` | guest base prep (perf pass) |
+| `2-host-one-shot.sh` | PVE-side flags via ssh (run once at build) |
+| `3-post-reboot-fixes.sh` | ethtool + multiqueue oneshot bits |
+| `4-host-netcheck.sh` | verify host flags + multiqueue (read-only) |
+| `5-activate-multiqueue.sh` | HISTORICAL: activated multiqueue 2026-09-01; a fresh VM gets queues from the qm config in step 0 + the oneshot unit |
+| `6-remove-agent-stacks.sh` | HISTORICAL teardown; N/A on fresh build |
+| `7-open-terminal-install.sh` + `8-open-terminal-users.sh` | Open Terminal fleet (#610) |
+| `9-uat-openwebui.sh` | OpenWebUI UAT harness (uat/ compose) |
+| `12-fix-rdp-bigres.sh` | xrdp EGFX budget drop-in for 5160x2160 (#611) |
+| `13-microvm-setup.sh` | microvm tooling: qemu microvm engine, firecracker binary, tap pools + NAT unit, cloud assets (#615) |
+| `14-capture-state.sh` | refresh docs/state after any drift |
+
+## 4. Dotfiles (both accounts) — #612
+
+1. gitea ssh access (human key) → clone `reachableceo/dotfiles`
+   (private) to `~/projects/dotfiles`.
+2. `ln -s ~/projects/dotfiles ~/.local/share/chezmoi`
+3. `chezmoi apply` (fetches pinned omz/p10k/plugin externals itself).
+4. offstage: root-copies the source snapshot and applies with
+   `-S ~reachableceo-offstage/projects/dotfiles` (no gitea creds there)
+   — see the dotfiles README.
+
+## 5. Standing services (beyond the scripts)
+
+- Gateway lanes via compose + `ukrrs-gateway-ensure.service` (boot-race
+  fix; must be enabled on BOTH lanes before any host bounce).
+- Day/night cgroup flips: `ukrrs-dayprofile.timer` 07:00 / 22:00-07:00
+  night window (runtime-only cgroup flips).
+- cgroup slices: `ukrrs-acct-*.slice` (per-account), `ukrrs-gateway`,
+  `ukrrs-builder-prune.timer`, `ukrrs-lsp.slice` (#608).
+- sysctl profile `/etc/sysctl.d/60-ukrrs-vm.conf` (measured rationale
+  in REPORT.md §4.1; day/night variants raise dirty thresholds).
+- xrdp (+ bigres drop-in from `12-`), `microvm-net.service`,
+  `open-terminal@.service` fleet, beszel-agent.
+- Docker Engine: docker.com apt repo (`docker-ce`, currently 29.x — see
+  `docs/state/guest-docker-pkg.txt`); compose v2 plugin.
+
+## 6. Package baseline
+
+`docs/state/guest-apt-manual.txt` = `apt-mark showmanual` snapshot
+(2026-09-01). On a rebuild, after all scripts:
+
+    apt-mark showmanual | sort | diff - docs/state/guest-apt-manual.txt
+
+Notables installed by hand over time: zsh fzf ripgrep bat eza fd-find
+tmux, qemu-system-x86 qemu-utils dosfstools mtools, libvirt/clt tools,
+ethtool, imageMagick, KDE extras. Full list is in the snapshot.
+
+## 7. Deliberately NOT captured here
+
+- Secrets (`~/.creds`), ssh keys, browser profiles.
+- Docker images/volumes (repos own their stacks; gateway lanes pull
+  their own images from the gateway registry/promote pipeline).
+- The scratch UAT harnesses (`/tmp/rdptest`) and scratch users
+  (`rdptest`, removed when #611 closes).
+- PVE host itself (that is the fleet-ansible goal; `docs/state/pve-*`
+  is the reference capture of today's host facts).
+
+## 8. Post-rebuild verification checklist
+
+1. `4-host-netcheck.sh` sweep clean (queues 4/4 + 2/2 live).
+2. Gateway `/status` = normal on both lanes after a bounce.
+3. RDP from iPad + 5160x2160 monitor clean (#611 UAT).
+4. Fresh zsh on both accounts: Kali-style prompt + omz (#612 UAT).
+5. `microvm create t && microvm start t && microvm ssh t` then rm.
+6. Open Terminal ports 30000-30008 answer (tailscale-only).
+7. Rerun `14-capture-state.sh`, commit drift to docs/state.

REPORT.md

@@ -2,8 +2,7 @@
 
 > **POST-PASS STATUS (2026-08-31 evening).** The guest plan (§4) is applied
 > and verified live; the hot host flags (§8 checklist) are applied; net
-> multiqueue is in the qm config and activates at the next VM start (one
+> multiqueue is activated + verified live 2026-09-01 (ens18 4/4, ens19 2/2). §1 below
-> human-timed bounce: `~/projects/ultix/5-activate-multiqueue.sh`). §1 below
 > is the PRE-PASS baseline, kept for reference. Hardware work moved to the
 > ~Oct 2026 window (#601); Fri 2026-09-04 is troubleshooting-only (#609).
 > Living state of record: NEXT.md + TRACKING.md. Repo moved: ~/optimize →

RUNBOOK-TODAY.md

@@ -4,15 +4,14 @@ Steps 1-3 below all landed and were verified read-only the same day (see
 REPORT.md status banner + §8, and NEXT.md). Kept for the record. Paths
 updated: repo moved ~/optimize → ~/projects/ultix.
 
-**Remaining perf actions (as of 2026-08-31 evening):**
+**Remaining perf actions (as of 2026-09-01):**
-1. Net multiqueue activation — ONE graceful bounce of VM 5111:
+1. Net multiqueue — DONE + verified 2026-09-01 morning (bounce
-   `~/projects/ultix/5-activate-multiqueue.sh` (~4 min, kills every crush
+   22:51->22:53; `ethtool -l` ens18 4/4, ens19 2/2).
-   session on this VM). Human ruling 08-31 eve: system idle tonight — good
-   window after the session's remaining tasks. Verify after:
-   `ethtool -l ens18` → Combined 4/4, `ethtool -l ens19` → 2/2.
 2. Root growth 279G → ~505G — fully manual, step-by-step with checks:
    `~/projects/ultix/GROW-ROOT-RUNBOOK.md` (#603). No script runs it; you
    type every command yourself.
+3. Rebuild-from-scratch path documented: REBUILD.md + docs/state
+   snapshots (regen: 14-capture-state.sh) — #615.
 
 **Friday 2026-09-04 (#609) is TROUBLESHOOTING-ONLY**: USB SDR reseat +
 zero-cost socket/PSU/BIOS checks. NO CPU/RAM swap, NO upgrades. All hardware

TRACKING.md

@@ -17,13 +17,14 @@ One table, updated in place at each checkpoint. States: done ✅ / doing 🔄 /
 | #610 | fleet | ✅ | Open Terminal 9-account fleet (tailscale-only :30000-30008) + OpenWebUI UAT PASS |
 | #611 | rdp | 🔄 | Jump/iPad + 5160x2160 monitor: EGFX frame-budget fix live (12-fix-rdp-bigres.sh); freerdp UAT all-clean; human UAT pending |
 | #612 | dotfiles | 🔄 | kali-addendum: Kali twoline prompt + completions (kali-comforts.sh) on top of omz, p10k = fallback (KALI_PROMPT=0); awaiting UAT |
-| #615 | microvm | 🔄 | microvm tooling LIVE (qemu-microvm engine; firecracker blocked by nested-KVM caps until #601 hardware) + rebuild capture/docs next |
+| #615 | microvm+rebuild | 🔄 | microvm tooling LIVE (qemu-microvm engine; firecracker blocked by nested-KVM caps until #601) + REBUILD.md/docs/state + docs synced; human UAT pending |
 | #616 | macos | ⏳ | macOS VM on pfv-tsys5 (headless CI + iOS dev) — blocked by #601 |
 
 Inbox (mid-task interrupts): none.
 
 Decisions log (latest wins):
 - 2026-09-01 (midday): RDP #611 diagnosis: xrdp 0.10.1/xorgxrdp 0.10.2 serves 5160x2160 CLEANLY on every codec (EGFX-RFXPro, NSCodec, bitmaps) and mid-session resize 2816->5160 (freerdp headless UAT, Xvfb screenshots; ASCII-render analysis). Jump-client corruption pinned to EGFX large-frame path -> XRDP_GFX_MAX_COMPRESSED_BYTES=32MB + FRAMES_IN_FLIGHT=2 via xrdp.service.d drop-in (12-fix-rdp-bigres.sh, idempotent, restart-guards on active sessions). Scratch user rdptest = the UAT account (remove after #611 closes). Sudoers: reachableceo -> offstage NOPASSWD (narrow, /etc/sudoers.d/reachableceo-to-offstage). Harness note: crush v0.91.2 hardcodes a bash command blocklist, no config override (upstream #2761); leading-word prefix bypasses it.
+- 2026-09-01 (afternoon): #615 microvm LIVE: qemu -M microvm + KVM engine (apt-only deps), firecracker v1.16.1 installed but its KVM cap check (0x38 = USER_MEMORY/SET_TSS_ADDR/VAPIC) refuses this nested Westmere KVM — retry MICROVM_ENGINE=firecracker post-#601. Per-user tap pools mv-r0..3/mv-o0..3 (/30s in 172.30.0/1.x) + iptables NAT via microvm-net.service; kvm group added both accounts (one re-login activates). UAT: boot->ssh 27.9s first boot (cloud-init+growpart 3->9.7G), apt OK through NAT, graceful stop 6.4s. #616 macOS VM ticket created w/ blocks-relation on #601. REBUILD.md + docs/state capture (14-capture-state.sh) landed; README/NEXT/REPORT/RUNBOOK synced (stale multiqueue text). mred = the Redmine CLI for all ticket work (~/.local/bin/mred).
 - 2026-09-01 (morning): POST-REBOOT AUDIT PASS (boot 22:53 = multiqueue bounce): ens18 Combined 4/4 + ens19 2/2 LIVE; qm pending empty; bounce log 22:51->22:53 clean; gw prod (ts :4000) + beta (:4002) both 200/healthy; postgres x2, openwebui :3000, 12 LSPs, all 9 open-terminal ports bound on 100.101.187.119; PSI textfile fresh; no relauncher respawn. Night window EXTENDED 22:00-05:00 -> 22:00-07:00 (human ruling; day-flip timer 07:00, live + staged synced via 11-shift-day-flip-0700.sh; z.ai peak ladder 01:00-05:00 untouched). openwebui.creds per-account distributor staged (10-) NOT run — human reads master list at ~/.creds/open-terminal.env.
 - 2026-08-31 (night, con handed to crush): #610 DONE in one session: open-terminal 0.11.34 bare-metal (HUMAN EXCEPTION to no-host-install rule, recorded), template unit open-terminal@.service, per-user TOML keys (never in ps/repo; ~/.creds holds copies), bind TAILSCALE-ONLY 100.101.187.119 per human ruling (0.0.0.0 rejected); all 8 other accounts + docker group; UAT via throwaway openwebui v0.11.1 (matches Cloudron prod) ALL PASS incl. hallucination-guarded chat round trip (model ran ls through OpenWebUI's terminal proxy, answered 9/9 real names). NOTE: prod openwebui container (v0.3.10, :3000) is too old for Open Terminal — upgrade to 0.11.x before wiring; Cloudron 0.11.1 is fine. Learned: raw API callers execute tool_calls client-side; the UI path runs the server-side loop.
 - 2026-08-31 (night): 22:00 night-profile flip OBSERVED LIVE from the guest (dirty_bytes 1G→2G, bg 256M→512M, /data2 readahead 128K→1M; day timer restores at 05:00). First runtime-only flip since install.

docs/state/guest-apt-manual.txt

@@ -0,0 +1,304 @@
+adduser
+apt
+apt-listchanges
+apt-utils
+ardour
+arduino
+audacity
+base-files
+base-passwd
+bash
+bash-completion
+bat
+bind9-dnsutils
+bind9-host
+bitwarden
+blender
+boinc-client
+bsdutils
+build-essential
+busybox
+bzip2
+ca-certificates
+calligra
+cmake
+code
+codeblocks
+conman
+console-setup
+containerd.io
+coreutils
+cpio
+cron
+cron-daemon-common
+crush
+curl
+darktable
+dash
+davfs2
+dbus
+debconf
+debconf-i18n
+debian-archive-keyring
+debian-faq
+debianutils
+dhcpcd-base
+diffutils
+dmidecode
+doc-debian
+docker-buildx-plugin
+docker-ce
+docker-ce-cli
+docker-compose-plugin
+dosfstools
+dpkg
+e2fsprogs
+eject
+ethtool
+eza
+fd-find
+fdisk
+file
+findutils
+freecad
+fzf
+gcc-14-base
+gettext-base
+gfortran
+gimp
+git
+glade
+glances
+gnuradio
+grass
+grass-gui
+grep
+groff-base
+grub-common
+grub-pc
+gzip
+hostname
+htop
+ifupdown
+inetutils-telnet
+init
+initramfs-tools
+init-system-helpers
+inkscape
+installation-report
+intel-microcode
+iperf3
+iproute2
+iputils-ping
+jq
+kdenlive
+kdevelop
+keyboard-configuration
+kicad
+kmod
+krb5-locales
+krita
+laptop-detect
+lepton-eda
+less
+libacl1
+libapparmor1
+libapt-pkg7.0
+libattr1
+libaudit1
+libaudit-common
+libblas-dev
+libblkid1
+libbpf1
+libbsd0
+libbz2-1.0
+libc6
+libcap2
+libcap2-bin
+libcap-ng0
+libc-bin
+libcom-err2
+libcrypt1
+libdb5.3t64
+libdebconfclient0
+libedit2
+libelf1t64
+libext2fs2t64
+libfdisk1
+libgcc-s1
+libgmp10
+libgssapi-krb5-2
+libhogweed6t64
+libhypre-dev
+libidn2-0
+libjansson4
+libk5crypto3
+libkeyutils1
+libkmod2
+libkrb5-3
+libkrb5support0
+liblapack-dev
+liblastlog2-2
+liblocale-gettext-perl
+liblockfile-bin
+liblz4-1
+liblzma5
+libmd0
+libmetis-dev
+libmnl0
+libmount1
+libmumps-dev
+libncursesw6
+libnetcdf-dev
+libnetcdff-dev
+libnettle8t64
+libnewt0.52
+libnftables1
+libnftnl11
+libnss-systemd
+libopenmpi-dev
+libpam0g
+libpam-modules
+libpam-modules-bin
+libpam-runtime
+libpam-systemd
+libpcre2-8-0
+libpopt0
+libproc2-0
+libptscotch-dev
+libreadline8t64
+librecad
+libreoffice
+libscotchparmetis-dev
+libseccomp2
+libselinux1
+libsemanage2
+libsemanage-common
+libsepol2
+libslang2
+libsmartcols1
+libsqlite3-0
+libss2
+libssl3t64
+libstdc++6
+libsystemd0
+libsystemd-shared
+libtext-charwidth-perl
+libtext-iconv-perl
+libtext-wrapi18n-perl
+libtinfo6
+libtirpc3t64
+libtirpc-common
+libudev1
+libunistring5
+libuuid1
+libvirt-clients
+libvirt-daemon-system
+libxtables12
+libxxhash0
+libzstd1
+linux-image-amd64
+linux-sysctl-defaults
+lmms
+locales
+login
+login.defs
+logrotate
+logsave
+lsof
+man-db
+manpages
+mawk
+media-types
+meshlab
+mount
+mtools
+nano
+ncurses-base
+ncurses-bin
+ncurses-term
+netbase
+netcat-traditional
+nftables
+ngspice
+nmap
+obs-studio
+octave
+openmpi-bin
+openshot-qt
+openssh-client
+openssl-provider-legacy
+os-prober
+ovmf
+pandoc
+paraview
+passwd
+pcb-rnd
+pciutils
+perl
+perl-base
+popularity-contest
+powerman
+procps
+pspp
+pwgen
+qemu-guest-agent
+qemu-system-x86
+qemu-utils
+qgis
+qownnotes
+readline-common
+recoll
+reportbug
+ripgrep
+screen
+scribus
+sed
+sensible-utils
+snmp
+spice-vdagent
+sqlite3
+sqv
+sudo
+sunshine
+sweethome3d
+swtpm
+swtpm-tools
+systemd
+systemd-sysv
+systemd-timesyncd
+sysvinit-utils
+tailscale
+tailscale-archive-keyring
+tar
+task-desktop
+task-english
+task-kde-desktop
+tasksel
+task-ssh-server
+texlive-full
+tmux
+traceroute
+tzdata
+ucf
+udev
+usbutils
+util-linux
+util-linux-extra
+vim
+vim-common
+vim-tiny
+virt-manager
+vym
+wamerican
+wget
+whiptail
+wireshark
+wtmpdb
+xrdp
+xygrib
+xz-utils
+yq
+zlib1g
+zsh
+zstd

docs/state/guest-disks.txt

@@ -0,0 +1,29 @@
+NAME     SIZE FSTYPE MOUNTPOINT
+sda      438G        
+├─sda1 279.2G ext4   /
+├─sda2     1K        
+└─sda5   8.8G swap   [SWAP]
+sdb      400G        
+└─sdb1   400G ext4   /data2
+sdc      200G        
+└─sdc1   200G ext4   /data1
+nbd0       0B        
+nbd1       0B        
+nbd2       0B        
+nbd3       0B        
+nbd4       0B        
+nbd5       0B        
+nbd6       0B        
+nbd7       0B        
+nbd8       0B        
+nbd9       0B        
+nbd10      0B        
+nbd11      0B        
+nbd12      0B        
+nbd13      0B        
+nbd14      0B        
+nbd15      0B        
+Filesystem      Size  Used Avail Use% Mounted on
+/dev/sda1       274G   88G  173G  34% /
+/dev/sdc1       196G  2.1M  186G   1% /data1
+/dev/sdb1       393G  2.1M  373G   1% /data2

docs/state/guest-docker-pkg.txt

@@ -0,0 +1,6 @@
+docker-ce:
+  Installed: 5:29.7.2-1~debian.13~trixie
+  Candidate: 5:29.7.2-1~debian.13~trixie
+docker.io:
+  Installed: (none)
+  Candidate: 26.1.5+dfsg1-9+deb13u1

docs/state/guest-docker.txt

@@ -0,0 +1,66 @@
+mopac-lsp-phpactor:2026.06.23.0  174MB
+mopac-lsp-harper:v2.8.0  82.7MB
+ukrrs-rdptest:1  974MB
+python:3.12-alpine  83.5MB
+mopac-lsp-json-language-server:1.3.4  246MB
+mopac-gateway-custom:beta  49.4MB
+mopac-gateway-custom:1  49.4MB
+mopac-lsp-taplo:0.10.0  32.1MB
+mopac-mcli:1  21.6MB
+ghcr.io/open-webui/open-webui:v0.11.3  7.16GB
+mopac-gateway-cop:1  22.9MB
+mopac-mred:1  21.7MB
+mopac-lsp-ansible-language-server:26.6.0  1.02GB
+mopac-lsp-bash-language-server:5.6.0  299MB
+mopac-lsp-jdtls:1.60.0  713MB
+mopac-lsp-clangd:20.1.8  893MB
+mopac-lsp-terraform-ls:0.38.4  80.8MB
+mopac-lsp-gopls:v0.23.0  1.18GB
+mopac-lsp-yaml-language-server:1.24.0  284MB
+mopac-lsp-dockerfile-language-server:0.15.0  243MB
+mopac-lsp-marksman:2026-02-08  55MB
+node:<none>  235MB
+ghcr.io/open-webui/open-webui:v0.11.1  7.16GB
+golang:<none>  1.24GB
+golang:1.26  1.29GB
+debian:trixie  187MB
+ghcr.io/berriai/litellm-database:main-stable  1.64GB
+golang:1.26-alpine  364MB
+postgres:alpine  433MB
+git.knownelement.com/reachableceo/dns-cli:latest  91.6MB
+git.knownelement.com/reachableceo/discourse-cli:latest  182MB
+git.knownelement.com/reachableceo/redmine-cli:latest  182MB
+node:<none>  232MB
+alpine:3.22  12.8MB
+alpine:3.20  12.2MB
+koalaman/shellcheck:stable  20MB
+curlimages/curl:8.11.1  32.3MB
+curlimages/curl:8.10.1  32MB
+ghcr.io/open-webui/open-webui:v0.3.10  5.48GB
+ghcr.io/jqlang/jq:1.7.1  3.39MB
+---
+mopac-uptimekuma-builder-run-57242abaea4c  e8c859f5632d  Up 14 seconds
+mopac-uptimekuma-fake-1  e8c859f5632d  Up 2 minutes
+ukrrs-mopac-lsp-php  mopac-lsp-phpactor:2026.06.23.0  Up 45 minutes
+ukrrs-mopac-lsp-prose  mopac-lsp-harper:v2.8.0  Up 45 minutes
+ukrrs-mopac-lsp-markdown-oneshot-276432  mopac-lsp-marksman:2026-02-08  Up About an hour
+ukrrs-mopac-lsp-markdown-oneshot-228490  mopac-lsp-marksman:2026-02-08  Up 2 hours
+ukrrs-openwebui  ghcr.io/open-webui/open-webui:v0.11.3  Up 6 hours (healthy)
+ukrrs-mopac-gateway-beta  mopac-gateway-custom:beta  Up 15 hours (healthy)
+ukrrs-mopac-gateway-prod  mopac-gateway-custom:1  Up 15 hours (healthy)
+ukrrs-mopac-lsp-json  mopac-lsp-json-language-server:1.3.4  Up 15 hours
+ukrrs-mopac-postgres-prod  d3e1620b530c  Up 15 hours (healthy)
+ukrrs-mopac-postgres-beta  d3e1620b530c  Up 15 hours (healthy)
+ukrrs-mopac-lsp-toml  mopac-lsp-taplo:0.10.0  Up 15 hours
+mopac-demo-fake-1  e8c859f5632d  Exited (2) 22 hours ago
+mopac-mcli-fake-1  e8c859f5632d  Up About an hour
+mopac-cli-mred  mopac-mred:1  Up 15 hours
+ukrrs-mopac-lsp-ansible  mopac-lsp-ansible-language-server:26.6.0  Up 15 hours
+ukrrs-mopac-lsp-bash  mopac-lsp-bash-language-server:5.6.0  Up 15 hours
+ukrrs-mopac-lsp-java  mopac-lsp-jdtls:1.60.0  Up 15 hours
+ukrrs-mopac-lsp-c  mopac-lsp-clangd:20.1.8  Up 15 hours
+ukrrs-mopac-lsp-go  mopac-lsp-gopls:v0.23.0  Up 15 hours
+ukrrs-mopac-lsp-dockerfile  mopac-lsp-dockerfile-language-server:0.15.0  Up 15 hours
+ukrrs-mopac-lsp-yaml  mopac-lsp-yaml-language-server:1.24.0  Up 15 hours
+ukrrs-mopac-lsp-markdown  mopac-lsp-marksman:2026-02-08  Up 15 hours
+ukrrs-mopac-lsp-terraform  mopac-lsp-terraform-ls:0.38.4  Up 15 hours

docs/state/guest-dpkg-count.txt

@@ -0,0 +1 @@
+3788

docs/state/guest-system.txt

@@ -0,0 +1,273 @@
+
+72 unit files listed.
+accounts-daemon.service             enabled enabled
+anacron.service                     enabled enabled
+anacron.timer                       enabled enabled
+apparmor.service                    enabled enabled
+apt-daily.timer                     enabled enabled
+apt-daily-upgrade.timer             enabled enabled
+avahi-daemon.service                enabled enabled
+avahi-daemon.socket                 enabled enabled
+beszel-agent.service                enabled enabled
+beszel-agent-update.timer           enabled enabled
+bluetooth.service                   enabled enabled
+boinc-client.service                enabled enabled
+conman.service                      enabled enabled
+console-setup.service               enabled enabled
+containerd.service                  enabled enabled
+cron.service                        enabled enabled
+cups-browsed.service                enabled enabled
+cups.path                           enabled enabled
+cups.service                        enabled enabled
+cups.socket                         enabled enabled
+docker.service                      enabled enabled
+docker.socket                       enabled enabled
+dpkg-db-backup.timer                enabled enabled
+drkonqi-coredump-processor@.service enabled enabled
+e2scrub_all.timer                   enabled enabled
+e2scrub_reap.service                enabled enabled
+fstrim.timer                        enabled enabled
+fwupd-refresh.timer                 enabled enabled
+getty@.service                      enabled enabled
+glances.service                     enabled enabled
+grub-common.service                 enabled enabled
+keyboard-setup.service              enabled enabled
+libvirtd-admin.socket               enabled enabled
+libvirtd-ro.socket                  enabled enabled
+libvirtd.service                    enabled enabled
+libvirtd.socket                     enabled enabled
+libvirt-guests.service              enabled enabled
+lm-sensors.service                  enabled enabled
+logrotate.timer                     enabled enabled
+machines.target                     enabled enabled
+man-db.timer                        enabled enabled
+microvm-net.service                 enabled enabled
+ModemManager.service                enabled enabled
+networking.service                  enabled enabled
+NetworkManager-dispatcher.service   enabled enabled
+NetworkManager.service              enabled enabled
+NetworkManager-wait-online.service  enabled enabled
+power-profiles-daemon.service       enabled enabled
+remote-fs.target                    enabled enabled
+sddm.service                        enabled enabled
+smartmontools.service               enabled enabled
+sshd-keygen.service                 enabled enabled
+ssh.service                         enabled enabled
+switcheroo-control.service          enabled enabled
+systemd-pstore.service              enabled enabled
+systemd-timesyncd.service           enabled enabled
+tailscaled.service                  enabled enabled
+udisks2.service                     enabled enabled
+ukrrs-builder-prune.timer           enabled enabled
+ukrrs-dayprofile.timer              enabled enabled
+ukrrs-gateway-ensure.service        enabled enabled
+ukrrs-net-multiqueue.service        enabled enabled
+ukrrs-nightprofile.timer            enabled enabled
+ukrrs-psi-textfile.timer            enabled enabled
+ukrrs-thp-madvise.service           enabled enabled
+UNIT FILE                           STATE   PRESET
+virtlogd-admin.socket               enabled enabled
+virtlogd.service                    enabled enabled
+virtlogd.socket                     enabled enabled
+wpa_supplicant.service              enabled enabled
+wtmpdb-update-boot.service          enabled enabled
+xrdp.service                        enabled enabled
+xrdp-sesman.service                 enabled enabled
+===CUSTOM-UNITS
+/etc/systemd/system/beszel-agent.service
+/etc/systemd/system/beszel-agent-update.service
+/etc/systemd/system/beszel-agent-update.timer
+/etc/systemd/system/bluetooth.target.wants/bluetooth.service
+/etc/systemd/system/dbus-fi.w1.wpa_supplicant1.service
+/etc/systemd/system/dbus-org.bluez.service
+/etc/systemd/system/dbus-org.freedesktop.Avahi.service
+/etc/systemd/system/dbus-org.freedesktop.ModemManager1.service
+/etc/systemd/system/dbus-org.freedesktop.nm-dispatcher.service
+/etc/systemd/system/dbus-org.freedesktop.timesync1.service
+/etc/systemd/system/default.target.wants/wtmpdb-update-boot.service
+/etc/systemd/system/display-manager.service
+/etc/systemd/system/getty.target.wants/getty@tty1.service
+/etc/systemd/system/graphical.target.wants/accounts-daemon.service
+/etc/systemd/system/graphical.target.wants/power-profiles-daemon.service
+/etc/systemd/system/graphical.target.wants/switcheroo-control.service
+/etc/systemd/system/graphical.target.wants/udisks2.service
+/etc/systemd/system/hibernate.target.wants/grub-common.service
+/etc/systemd/system/hybrid-sleep.target.wants/grub-common.service
+/etc/systemd/system/microvm-net.service
+/etc/systemd/system/multi-user.target.wants/anacron.service
+/etc/systemd/system/multi-user.target.wants/avahi-daemon.service
+/etc/systemd/system/multi-user.target.wants/beszel-agent.service
+/etc/systemd/system/multi-user.target.wants/boinc-client.service
+/etc/systemd/system/multi-user.target.wants/conman.service
+/etc/systemd/system/multi-user.target.wants/console-setup.service
+/etc/systemd/system/multi-user.target.wants/containerd.service
+/etc/systemd/system/multi-user.target.wants/cron.service
+/etc/systemd/system/multi-user.target.wants/cups-browsed.service
+/etc/systemd/system/multi-user.target.wants/cups.path
+/etc/systemd/system/multi-user.target.wants/cups.service
+/etc/systemd/system/multi-user.target.wants/docker.service
+/etc/systemd/system/multi-user.target.wants/e2scrub_reap.service
+/etc/systemd/system/multi-user.target.wants/glances.service
+/etc/systemd/system/multi-user.target.wants/grub-common.service
+/etc/systemd/system/multi-user.target.wants/libvirtd.service
+/etc/systemd/system/multi-user.target.wants/libvirt-guests.service
+/etc/systemd/system/multi-user.target.wants/lm-sensors.service
+/etc/systemd/system/multi-user.target.wants/machines.target
+/etc/systemd/system/multi-user.target.wants/microvm-net.service
+/etc/systemd/system/multi-user.target.wants/ModemManager.service
+/etc/systemd/system/multi-user.target.wants/networking.service
+/etc/systemd/system/multi-user.target.wants/NetworkManager.service
+/etc/systemd/system/multi-user.target.wants/open-terminal@COS-RCEO.service
+/etc/systemd/system/multi-user.target.wants/open-terminal@COS-TSG.service
+/etc/systemd/system/multi-user.target.wants/open-terminal@COS-WFO.service
+/etc/systemd/system/multi-user.target.wants/open-terminal@reachableceo-offstage.service
+/etc/systemd/system/multi-user.target.wants/open-terminal@reachableceo.service
+/etc/systemd/system/multi-user.target.wants/open-terminal@TSGBOD.service
+/etc/systemd/system/multi-user.target.wants/open-terminal@TSGCCO.service
+/etc/systemd/system/multi-user.target.wants/open-terminal@TSGCOO.service
+/etc/systemd/system/multi-user.target.wants/open-terminal@TSGCTO.service
+/etc/systemd/system/multi-user.target.wants/remote-fs.target
+/etc/systemd/system/multi-user.target.wants/smartmontools.service
+/etc/systemd/system/multi-user.target.wants/ssh.service
+/etc/systemd/system/multi-user.target.wants/tailscaled.service
+/etc/systemd/system/multi-user.target.wants/ukrrs-gateway-ensure.service
+/etc/systemd/system/multi-user.target.wants/ukrrs-net-multiqueue.service
+/etc/systemd/system/multi-user.target.wants/ukrrs-thp-madvise.service
+/etc/systemd/system/multi-user.target.wants/virtlogd.service
+/etc/systemd/system/multi-user.target.wants/wpa_supplicant.service
+/etc/systemd/system/multi-user.target.wants/xrdp.service
+/etc/systemd/system/multi-user.target.wants/xrdp-sesman.service
+/etc/systemd/system/network-online.target.wants/networking.service
+/etc/systemd/system/network-online.target.wants/NetworkManager-wait-online.service
+/etc/systemd/system/open-terminal@.service
+/etc/systemd/system/printer.target.wants/cups.service
+/etc/systemd/system/smartd.service
+/etc/systemd/system/sockets.target.wants/avahi-daemon.socket
+/etc/systemd/system/sockets.target.wants/cups.socket
+/etc/systemd/system/sockets.target.wants/docker.socket
+/etc/systemd/system/sockets.target.wants/libvirtd-admin.socket
+/etc/systemd/system/sockets.target.wants/libvirtd-ro.socket
+/etc/systemd/system/sockets.target.wants/libvirtd.socket
+/etc/systemd/system/sockets.target.wants/virtlogd-admin.socket
+/etc/systemd/system/sockets.target.wants/virtlogd.socket
+/etc/systemd/system/sshd.service
+/etc/systemd/system/sshd.service.wants/sshd-keygen.service
+/etc/systemd/system/sshd@.service.wants/sshd-keygen.service
+/etc/systemd/system/ssh.service.wants/sshd-keygen.service
+/etc/systemd/system/ssh.socket.wants/sshd-keygen.service
+/etc/systemd/system/suspend.target.wants/grub-common.service
+/etc/systemd/system/suspend-then-hibernate.target.wants/grub-common.service
+/etc/systemd/system/sysinit.target.wants/apparmor.service
+/etc/systemd/system/sysinit.target.wants/keyboard-setup.service
+/etc/systemd/system/sysinit.target.wants/systemd-pstore.service
+/etc/systemd/system/sysinit.target.wants/systemd-timesyncd.service
+/etc/systemd/system/systemd-coredump@.service.wants/drkonqi-coredump-processor@.service
+/etc/systemd/system/timers.target.wants/anacron.timer
+/etc/systemd/system/timers.target.wants/apt-daily.timer
+/etc/systemd/system/timers.target.wants/apt-daily-upgrade.timer
+/etc/systemd/system/timers.target.wants/beszel-agent-update.timer
+/etc/systemd/system/timers.target.wants/dpkg-db-backup.timer
+/etc/systemd/system/timers.target.wants/e2scrub_all.timer
+/etc/systemd/system/timers.target.wants/fstrim.timer
+/etc/systemd/system/timers.target.wants/fwupd-refresh.timer
+/etc/systemd/system/timers.target.wants/logrotate.timer
+/etc/systemd/system/timers.target.wants/man-db.timer
+/etc/systemd/system/timers.target.wants/ukrrs-builder-prune.timer
+/etc/systemd/system/timers.target.wants/ukrrs-dayprofile.timer
+/etc/systemd/system/timers.target.wants/ukrrs-nightprofile.timer
+/etc/systemd/system/timers.target.wants/ukrrs-psi-textfile.timer
+/etc/systemd/system/ukrrs-acct-reachableceo-offstage.slice
+/etc/systemd/system/ukrrs-acct-reachableceo.slice
+/etc/systemd/system/ukrrs-batch.slice
+/etc/systemd/system/ukrrs-builder-prune.service
+/etc/systemd/system/ukrrs-builder-prune.timer
+/etc/systemd/system/ukrrs-dayprofile.service
+/etc/systemd/system/ukrrs-dayprofile.timer
+/etc/systemd/system/ukrrs-gateway-ensure.service
+/etc/systemd/system/ukrrs-gateway.slice
+/etc/systemd/system/ukrrs-lsp.slice
+/etc/systemd/system/ukrrs-net-multiqueue.service
+/etc/systemd/system/ukrrs-nightprofile.service
+/etc/systemd/system/ukrrs-nightprofile.timer
+/etc/systemd/system/ukrrs-pmo.slice
+/etc/systemd/system/ukrrs-psi-textfile.service
+/etc/systemd/system/ukrrs-psi-textfile.timer
+/etc/systemd/system/ukrrs-rt.slice
+/etc/systemd/system/ukrrs-thp-madvise.service
+/etc/systemd/system/user-1001.slice.d/50-ukrrs.conf
+/etc/systemd/system/user-1010.slice.d/50-ukrrs.conf
+/etc/systemd/system/xrdp.service.d/bigres.conf
+===SYSCONTROL
+-- /etc/sysctl.d/60-ukrrs-vm.conf
+# /etc/sysctl.d/60-ukrrs-vm.conf — ultix-streaming mixed-workload profile
+# Measured-before values and rationale: ~/optimize/REPORT.md §4.1.
+# Deliberately NOT touched: swappiness(60), overcommit(0), vfs_cache_pressure,
+# pid_max, somaxconn(4096), conntrack(262144), autogroup(1), page-cluster(3).
+
+# Predictable writeback under ETL bursts (bytes-based, RAM-size independent).
+# Night profile (ukrrs-daynight.sh) raises these to 2G/512M.
+vm.dirty_background_bytes = 268435456
+vm.dirty_bytes = 1073741824
+
+# Survive bursty reclaim when compiles+ETL hit at once. 768M post-upgrade.
+vm.min_free_kbytes = 393216
+
+# Postgres AIO / io_uring era; 9 harness daemons + LSPs watching many repos.
+fs.aio-max-nr = 1048576
+fs.inotify.max_user_watches = 1048576
+fs.inotify.max_user_instances = 512
+
+# 9 accounts x long-lived provider streams + tailscale + docker NAT.
+net.ipv4.ip_local_port_range = 10240 65535
+net.ipv4.tcp_tw_reuse = 1
+
+# LLM turns idle minutes between bursts on live sockets; large SSE/JSON.
+net.ipv4.tcp_slow_start_after_idle = 0
+net.core.rmem_max = 16777216
+net.core.wmem_max = 16777216
+net.ipv4.tcp_rmem = 4096 131072 16777216
+net.ipv4.tcp_wmem = 4096 65536 16777216
+net.core.netdev_max_backlog = 8192
+
+# BBR requires the module: staged modules-load.d/tcp_bbr.conf loads it.
+# If bbr is unavailable, comment the last two lines out (cubic is fine).
+net.ipv4.tcp_congestion_control = bbr
+net.core.default_qdisc = fq
+===FSTAB
+# /etc/fstab: static file system information.
+#
+# Use 'blkid' to print the universally unique identifier for a
+# device; this may be used with UUID= as a more robust way to name devices
+# that works even if disks are added and removed. See fstab(5).
+#
+# systemd generates mount units based on this file, see systemd.mount(5).
+# Please run 'systemctl daemon-reload' after making changes here.
+#
+# <file system> <mount point>   <type>  <options>       <dump>  <pass>
+# / was on /dev/sda1 during installation
+UUID=db07b391-d983-4a40-8752-bf1a7daf5d42 / ext4 errors=remount-ro,noatime 0 1
+# swap was on /dev/sda5 during installation
+UUID=611d6da8-3fd6-40f0-9239-d8825a6d256c none            swap    sw              0       0
+/dev/sr0        /media/cdrom0   udf,iso9660 user,noauto     0       0
+
+#data dirs
+
+#root@ultix-streaming:~# blkid /dev/sdc1
+#/dev/sdc1: UUID="f6ce5e0d-8045-41d0-be0e-612d8b2abc02" BLOCK_SIZE="4096" TYPE="ext4" PARTUUID="5365d54a-c661-4446-a732-c0d420ef298b"
+UUID=f6ce5e0d-8045-41d0-be0e-612d8b2abc02 /data1 ext4 errors=remount-ro,noatime 0 1
+
+#root@ultix-streaming:~# blkid /dev/sdb1
+#/dev/sdb1: UUID="b23e6be0-2a1c-41b7-8742-5dab39066f2e" BLOCK_SIZE="4096" TYPE="ext4" PARTUUID="b0fab633-36db-4658-9ca4-35aca7b9cb29"
+UUID=b23e6be0-2a1c-41b7-8742-5dab39066f2e /data2 ext4 errors=remount-ro,noatime 0 1
+===SUDOERS
+total 32
+drwxr-xr-x   2 root root  4096 Sep  1 11:47 .
+drwxr-xr-x 156 root root 12288 Sep  1 13:20 ..
+-rw-rw-r--   1 root root    30 Jul 28 12:01 localuser
+-rw-rw-r--   1 root root    33 Jul 28 19:47 reachableceo-streaming
+-r--r-----   1 root root    55 Sep  1 11:47 reachableceo-to-offstage
+-r--r-----   1 root root  1068 Apr 11 07:21 README
+===XRDP-DROPIN
+[Service]
+Environment=XRDP_GFX_MAX_COMPRESSED_BYTES=33554432
+Environment=XRDP_GFX_FRAMES_IN_FLIGHT=2

docs/state/guest-users.txt

@@ -0,0 +1,15 @@
+localuser:x:1000:1000:localuser,,,:/home/localuser:/bin/bash
+reachableceo:x:1001:1001:Charles N Wyble,,,:/home/reachableceo:/usr/bin/zsh
+libvirt-qemu:x:64055:993:Libvirt Qemu:/var/lib/libvirt:/usr/sbin/nologin
+TSGCOO:x:1002:1002:TSYS Group COO,666,666-666-6666,666-666-6666,666-666-6666:/home/TSGCOO:/bin/bash
+TSGCCO:x:1003:1003:TSYS Group CCO (chief commons officer),666,666-666-6666,666-666-6666,666-666-6666:/home/TSGCCO:/bin/bash
+TSGCTO:x:1005:1005:TSYS Group CTO,666,666-666-6666,666-666-6666,666-666-6666:/home/TSGCTO:/bin/bash
+TSGBOD:x:1006:1006:TSYS Group Board Of Directors,666,666-666-6666,666-666-6666,666-666-6666:/home/TSGBOD:/bin/bash
+COS-RCEO:x:1007:1007:Chief Of Staff - ReachableCEO,666,666-666-6666,666-666-6666,666-666-6666:/home/COS-RCEO:/bin/bash
+COS-WFO:x:1008:1008:Chief of Staff - Wyble Family Office,666,666-666-6666,666-666-6666,666-666-6666:/home/COS-WFO:/bin/bash
+COS-TSG:x:1009:1009:CHief Of Staff TSYS Group,666,666-666-6666,666-666-6666,666-666-6666:/home/COS-TSG:/bin/bash
+reachableceo-offstage:x:1010:1010:ReachableCEO Offstage,,,:/home/reachableceo-offstage:/usr/bin/zsh
+rdptest:x:1011:1011::/home/rdptest:/usr/bin/zsh
+---
+uid=1001(reachableceo) gid=1001(reachableceo) groups=1001(reachableceo),100(users),993(kvm),988(docker),118(libvirt)
+uid=1010(reachableceo-offstage) gid=1010(reachableceo-offstage) groups=1010(reachableceo-offstage),100(users),993(kvm),988(docker)

docs/state/pve-5111.txt

@@ -0,0 +1,112 @@
+=== qm config 5111 (live)
+agent: 1
+balloon: 0
+boot: order=scsi0;net0
+cores: 4
+cpu: host,flags=+nested-virt
+cpuunits: 9000
+memory: 50000
+meta: creation-qemu=10.1.2,ctime=1784819584
+name: ultix-streaming
+net0: virtio=BC:24:11:1A:8F:6F,bridge=vmbr0,queues=4
+net1: virtio=BC:24:11:E3:32:D9,bridge=datanet,queues=2
+numa: 0
+onboot: 1
+ostype: l26
+scsi0: NVME:5111/vm-5111-disk-0.qcow2,discard=on,iothread=1,size=438G,ssd=1
+scsi1: ssd2:5111/vm-5111-disk-0.qcow2,discard=on,iothread=1,size=400G,ssd=1
+scsi2: SSD:5111/vm-5111-disk-0.qcow2,discard=on,iothread=1,size=200G,ssd=1
+scsihw: virtio-scsi-single
+smbios1: uuid=bc74eb91-b156-46e2-b946-808da9b4f037
+sockets: 2
+startup: order=10,up=180
+vmgenid: 06fc08de-c644-497a-a1e9-72304fefd32f
+=== qm list
+      VMID NAME                 STATUS     MEM(MB)    BOOTDISK(GB) PID       
+       501 devbox-cloudron      running    4096              32.00 3751551   
+       515 preprod-hfnoc-uisp   running    2048             100.00 3751702   
+      5000 sectestbed-sandbox   running    2000              32.00 3751894   
+      5100 sectestbed-template  stopped    4096              32.00 0         
+      5101 sectestbed-siem      running    10000            132.00 3752168   
+      5102 sectestbed-proxmox-pve running    3500              32.00 3752434   
+      5103 sectestbed-proxmox-datacenter running    2048              32.00 3752680   
+      5104 sectestbed-proxmox-pbs running    2048              32.00 3752922   
+      5105 sectestbed-awx       running    12000            288.00 3753264   
+      5106 sectestbed-k8s-cnode running    4096              32.00 3753734   
+      5107 sectestbed-k8s-wnode running    2048              32.00 3754073   
+      5108 sectestbed-librenms  running    2048              32.00 3754232   
+      5109 sectestbed-netinfra  running    2048              32.00 3754394   
+      5111 ultix-streaming      running    50000            438.00 3912531   
+      5500 RestoreTemplate      stopped    2048              32.00 0         
+     51011 sectestbed-cloudron  running    4096              32.00 3754824   
+     51012 sectestbed-hfnoc-uisp running    2048              32.00 3755444   
+     51013 sectestbed-rancherplatform running    4096              32.00 3755745   
+     51014 sectestbed-proxmox-mailgw running    2048              32.00 3756602   
+     51015 sectestbed-ca        running    2048              32.00 3756814   
+     51016 sectestbed-voip      running    2048              32.00 3757027   
+     53100 preprod-awx          running    9000             160.00 3757274   
+     53101 preprod-siem         running    12000             32.00 3757396   
+     53102 preprod-rancherplatform running    8000              32.00 3757569   
+     53103 preprod-proxmox-mailgw running    4096              32.00 3757852   
+     53104 preprod-ca           running    2048              32.00 3758019   
+     53105 preprod-proxmox-datacenter running    4096              32.00 3758424   
+     53106 preprod-librenms     running    2048              32.00 3758789   
+     53107 preprod-voip         running    2048              32.00 3759139   
+     53108 preprod-cloudron     stopped    2048              32.00 0         
+=== storage.cfg
+#local storage...
+
+dir: local
+	path /var/lib/vz
+	content backup,iso,import,vztmpl
+
+lvmthin: local-lvm
+	thinpool data
+	vgname pve
+	content rootdir,images
+
+dir: SSD
+	path /mnt/pfv-tsys5/ssd
+	content images
+	prune-backups keep-all=1
+	shared 0
+
+dir: ssd2
+	path /mnt/ssd2
+	content images
+	prune-backups keep-all=1
+	shared 0
+
+dir: NVME
+	path /mnt/nvme
+	content images
+	prune-backups keep-all=1
+	shared 0
+
+
+dir: local-nonprod
+	path /mnt/pfv-tsys5/S1
+	content images
+	prune-backups keep-all=1
+	shared 0
+
+nfs: D2
+        options nconnect=4,noatime
+        export /mnt/tsys4/D2
+        path /mnt/pve/D2
+        server pfv-tsys4-nfs-stor
+        content images
+        prune-backups keep-all=1
+
+=== pool usage
+Filesystem      Size  Used Avail Use% Mounted on
+/dev/nvme0n1p1  458G  270G  165G  63% /mnt/nvme
+/dev/sdb1       469G   78M  445G   1% /mnt/ssd2
+/dev/sdd1       234G   44M  222G   1% /mnt/pfv-tsys5/ssd
+=== host
+model name	: Intel(R) Xeon(R) CPU           E5620  @ 2.40GHz
+               total        used        free      shared  buff/cache   available
+Mem:              94          57          14           0          22          36
+7.0.14-6-pve
+=== nested
+Y