Initial Site Bootstrap

Everything that happens before the phased cutover work in Build Phases: racked hardware on the temp LAN → Proxmox on every node → edge VMs provisioned and configured → repo secrets running bao-first. End state is "Phase 0 complete, Phase 1 ready," with the whole edge stack rebuildable from the repo. Captured 2026-07-01 from the Site A bring-up; this is the repeatable template for Site B.

The flat addresses below describe a lifecycle, not a permanent fan-out. XG6 p4 serves one host or BMC at a time; after the other systems are built, p4 remains on sa-edge-01 nic0 so its edge VMs stay reachable. OPNsense continues to receive WAN service from the UCG, but every downstream system moves to final 10.10.x networks before the A8 ONT handoff.

Temp-LAN Plan (Phase-0 Addressing)

Flat network behind the existing UniFi router, with no VLANs yet. At Site A this is the observed bootstrap state, not the approved final topology.

Step 0: Workstation Prerequisites (Tier 0)

Clone the repo, cp .env.local.example .env.local, fill the tier-0 values (PULUMI_CONFIG_PASSPHRASE, Proxmox credential, ANSIBLE_VAULT_PASSWORD), leave the BAO_* knobs empty: every tool runs in pure fallback mode until step 4. ssh-add the operator key (the Proxmox provider authenticates via the agent), then make install.

Step 1: Hardware Install

Install NICs, boot M.2 (512 GB: never a 1.92 TB enterprise SSD), RDIMMs, and data SSDs per the combined port wiring and faceplate guide. Use XG6 p4 as the one-at-a-time bootstrap service lead; do not pre-cable a host to an XG10. Keep XG6 p5/p6 disconnected; no XG10 ever connects to UCG Max or XG6.

Step 2: Proxmox on Bare Metal

Install PVE on every node via IPMI virtual media using the temporary IPs above. Service and baseline one host at a time through XG6 p4. Attach sa-edge-01 nic0 to p4 last and leave it there through A4 so the edge VMs stay available. Add the Pulumi API credential (Datacenter → Permissions → API Tokens, privilege separation OFF) to .env.local. Apply the host baseline and hardening one node at a time (make baseline-check LIMIT=<node> → baseline-apply). Run the edge node last because it will carry the firewall VM.

Step 3: Edge VMs via Pulumi (Order Matters)

All on *-edge-01, all make targets against STACK=site-a|site-b; preview before every up; export and commit config after each milestone.

1. OPNsense: provision (opnsense-provision-set/preview/up: FreeBSD image + cloud-init opnsense-bootstrap conversion, API-ready on the seed IP), then app config (opnsense-config-check/apply: Phase-1 outbound NAT + baseline firewall).
2. UOS controller (Site A only): unifi-provision-*, then unifi-config-setup (first-run owner/console via the UOS API).
3. OpenBao: openbao-provision-* (VM boots sealed and uninitialized by design), then the manual init runbook: bao operator init → Shamir keys + root token → password manager. Pulumi owns the E200 startup policy: OPNsense 1/90/180, bao 2/60/180, and Site A UOS 3/0/180 (order/up/down, seconds).

Step 4: Secrets Go bao-first

Run the tier-1 migration for the site (Site A completed it on 2026-07-01). Set BAO_ADDR and the temporary BAO_ADMIN_TOKEN, then run make openbao-config-setup. This creates the KV v2 homelab mount, per-scope policies, and AppRoles. Paste each printed role_id and one-time secret_id pair into .env.local, then run make openbao-config-seed. Remove BAO_ADMIN_TOKEN afterward; the password manager retains it.

Verification Gates

Related Pages

• Current Build State: where the build actually stands today
• Build Phases: the phased cutover that follows this runbook
• Secrets: OpenBao: the full secrets architecture