spektr
89787b0e23
Betreiberentscheidung 31.10.2026 (GNAI-002 Abschnitt 6): Der KI-Host wird kohärent IPv4-only betrieben. host_baseline verwaltet /etc/sysctl.d/99-ghostnet-disable-ipv6.conf (all+default), wendet es bei Änderung an und verifiziert den Laufzeitwert. Anlass: hängender get_url- Download durch AAAA-Antworten ohne nutzbare IPv6-Route (Messungen im Dokument; Pi-hole filtert AAAA nicht, der Host nutzt Pi-hole nicht). model_store nach Live-Befunden: Swift-Repin auf Repository-Revision 98a6100 (alte Revision entfernt, Datei laut Herausgeber-SHA256SUMS unverändert; GNAI-010 v0.5) und Download über wget -4 mit expliziter SHA-256-Verifikation vor dem atomaren Move. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
Shared host baseline
The host_baseline role manages state shared by the Production and Testing
environments on ghostnet-ki.
Its first version deliberately has a narrow scope:
- refuse changes when hostname, Debian major version or primary IPv4 address do not match the declared target;
- require at least 100 GiB free on the root filesystem; and
- create root-owned parent directories and the future shared-data root.
Since 31.10.2026 the role also disables IPv6 on the host
(host_baseline_disable_ipv6, default true) via
/etc/sysctl.d/99-ghostnet-disable-ipv6.conf, applies it with
sysctl --system when changed and verifies the runtime value. Rationale:
the LAN has no usable global IPv6 path while all resolvers return AAAA
records, which made dual-stack-preferring applications hang on outbound
connections (operator decision, GNAI-002 section 6).
Environment-specific directory ownership is managed by workload_accounts so
the shared baseline and workload identities do not compete over permissions.
It does not install packages, drivers, Podman or applications and does not start or stop services. Ownership below the directory roots will be assigned to dedicated service accounts when the corresponding application roles are implemented.