Adding a PCIe card can renumber the buses behind it, so a hostpci entry
that names a PCI address can pass through the wrong device. These start
the VM only after finding each device by vendor/device/subsystem ID or
by its MAC-pinned interface, repoint its resource mapping if it moved,
and refuse to start on anything ambiguous. Its dependents then wait for
a port on it to answer before starting, so they find their shares up.
/opt/ergosteur is now a checkout rather than a directory kept in step by scp,
so deploying is a pull.
Records why the remote is HTTPS rather than SSH: the repository is public, so
the host needs no credentials and no deploy key, and in exchange it cannot
push, which is the right shape for a deploy target.
Also notes that git carries the executable bit, since a script committed
without it now reaches the host non-executable and breaks any unit using it as
ExecStart. That failure mode did not exist while deploying by scp, which
carries the mode from the working copy regardless of what git records.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The usage line listed --docker but nothing said what it did, so the only way to
find out was to read the runcmd generation.
Two things are worth stating beyond "installs Docker". The install runs on
first boot of each clone rather than during the build, because the snippet is a
runcmd and the template is never booted, so every clone fetches Docker itself
and nothing is baked into the image. And the non-Alpine, non-Arch path uses the
convenience script from get.docker.com, so those guests get Docker CE from
Docker's repo rather than the distro package.
Also records that the cloud-init user lands in the docker group, which is
root-equivalent on that guest, and that the flag is positional.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The repository had no entry point, and the cloud image pinning in particular
needed explaining: which distributions track "latest" upstream and which bake
an exact version into the filename is the thing that determines whether a pin
rots silently, and it was not evident from reading the script.
Documents the template builder and update-image-pins.sh in full, including the
two properties worth preserving in the updater, deriving URLs from the builder
rather than duplicating them and verifying qcow2 magic rather than a 200, since
both look like needless complexity to anyone simplifying it later.
Indexes the rest of the tooling one line each, and records the deployment step,
because /opt/ergosteur is not a checkout and nothing here is live until copied
across.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ergosteur
