Adding a PCIe card can renumber the buses behind it, so a hostpci entry
that names a PCI address can pass through the wrong device. These start
the VM only after finding each device by vendor/device/subsystem ID or
by its MAC-pinned interface, repoint its resource mapping if it moved,
and refuse to start on anything ambiguous. Its dependents then wait for
a port on it to answer before starting, so they find their shares up.
Manual fan mode pins the fans at a fixed duty and never ramps, so a sustained
load had no cooling response until the BMC's own critical-temperature
override stepped in. docker-idrac.sh solved that, but needs Docker, which is
not installed on the host.
ipmi-fancontrol-daemon polls the CPU sensors and switches between the fixed
duty and the BMC's automatic curve around a threshold, which is what that
container did. Measured on the host: 1440 RPM pinned versus roughly 4200 RPM
on the automatic curve at the same 60C.
- Hysteresis, default 5C, stops the fans oscillating at the boundary.
- An unreadable temperature fails safe to automatic rather than staying
pinned.
- SIGTERM restores the automatic curve, with ExecStopPost as the backstop for
an outright kill.
Default to the local "open" interface. It needs no credentials and no
network, which matters for the shutdown path, where lanplus to the iDRAC
could fail once networking is down. ipmi-fancontrol-auto and -manual honour
the same setting and stay available for ad-hoc use.
Enable the third-party PCIe cooling response suppression that docker-idrac.sh
was configured with, so the automatic curve is not held to a raised floor by
the aftermarket NICs.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Checked against the live host. None of these are in service:
- sriov-enp4s0.service and set-ixgbe-vfmacs-enp4s0.sh target enp4s0f1np1,
which no longer exists; sriov_numvfs is 0 on every port and the unit was
never installed.
- nic-performance-tweaks.service was never installed either, though its
interfaces do still exist, so it would work if reinstated.
- vm-watchdog.sh watches VMID 2801 "pfsense", which no longer exists.
- lxc-watchdog.sh still carries the upstream example targets: CT 100 and
CT 101 on 192.168.31.0/24, a subnet that is not in use.
Neither watchdog is scheduled; there is no root crontab.
The watchdog config moves to unused/conf/ alongside them, so the scripts
resolve it unchanged from their new location.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Both watchdogs hardcoded the notification address. Read it from
conf/watchdog.conf instead, matching the pattern used for the other
credentials, so the repo carries no real contact details.
If the config is absent the watchdogs still run and log; sendAlert notes the
missing address and skips the mail rather than invoking mail(1) with an empty
recipient.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
stop-pa-vm.service calls the PAN-OS XML API on host shutdown so the firewall
VM goes down cleanly rather than being killed.
The API key is read from conf/pa-vm.conf, resolved relative to the script.
See conf/pa-vm.conf.example.
Pass the request through curl --config on stdin with the key in an X-PAN-KEY
header, instead of embedding it in the URL. A key in the query string is
visible in ps and would be recorded in any proxy or webserver log along the
path.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ipmi-fancontrol.service pins the fans to a fixed speed on start and hands
control back to the BMC's automatic curve on stop, to quiet the chassis.
BMC credentials are read from conf/ipmi-fancontrol.conf, resolved relative
to the scripts themselves so the tree stays self-contained whether it is run
from a checkout or from /opt/ergosteur. See conf/ipmi-fancontrol.conf.example.
Use ipmitool -E rather than -P so the password is passed via the environment
instead of argv, where any local user could read it out of ps.
docker-idrac.sh is the alternative temperature-aware controller.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ergosteur
