Sources for the gateway pages

You want to check a statement on the gateway pages against the file or record it came from. The list is from the earlier docs page; the entries were not all re-read, and what each file is said to show was not re-checked. Entries about tags and the pxe and onpi inventory groups are left out: the tags are gone (Deploying to a gateway), and so are the groups.

In fpgas.online-infra (main)

  • fpgas.online-infra: the host-groups and roles tables, the deploy and verify command lines, the vault-password note, the QEMU test harness description including the rpi-qemu GENET emulation, the TCG runtime and the CI workflow.

  • CLAUDE.md: the “Deployment Targets” entries and the key-files list.

  • ansible/inventory/hosts: the nbp, uhubctl and pig groups and their exact membership.

  • ansible/site.yml: the role order in the nbp plays (sshd after operators and jump for its lockout guard), the uhubctl play, the web.yml import, the “Update the Pi NFS root” play.

  • ansible/web.yml: the pig play’s roles and the tt_boards condition on ttsite.

  • ansible/verify-server.yml: the three plays, the per-role verify includes, the per-port assertions gated on switches is defined, the NFS-root checks.

  • ansible/verify-pi.yml: the host pattern and the documented ad hoc invocation.

  • ansible/refresh-known-hosts.yml: when to run it, the remove/rescan/pin sequence, the “never -H” rule and the become: false reasoning.

  • ansible/ssh.cfg: the private known_hosts, accept-new, and IdentityAgent none with the hung-agent rationale.

  • ansible/ci-nfsroot.yml and ansible/inventory-ci-nfsroot/hosts: the CI NFS-root build and its community.general.chroot connection.

  • The server-side roles’ tasks/main.yml under ansible/roles/: netif, operators, lldp, firewall (the validated rules write, state: started on Enable nftables service and the reload task), vlan_ports, switch_vlans, nfs, img, fixpi, pxe (dnsmasq, chrony), uhubctl, site, wssh, stream_server, ttsite.

  • The site role: tasks/nginx.yml (nginx-extras, the port-80 ACME vhost), certbot.yml (the certbot history and the deliberate omission of the nginx plugin), fpgas-online-site.yml, pistat.yml, django.yml (gunicorn/uvicorn/daphne and channels-redis installs, redis, local_settings.py created once and never overwritten), handlers/main.yml (the restart django services handler) and tasks/verify/main.yml (the verify loop that names redis-server.service).

  • ansible/roles/stream_server/tasks/base.yml and back.yml: the rtmp and fancyindex modules and the tmpfs HLS directory.

  • ansible/roles/uhubctl/templates/udev/52-uhubctl.rules.j2: the DUB-H7 USB ID and what the rule relaxes.

  • ansible/roles/pxe/templates/dnsmasq-base.conf.j2: bind-dynamic, the pinned lease path, no-resolv, the NTP DHCP option.

  • Runbook: deploying tweed’s web tier (welland.fpgas.online, tweed.welland.mithis.com, tinytapeout.fpgas.online): the upstream edge, the SNI passthrough, the webroot challenge path, the alias list and the tinytapeout.fpgas.online CNAME, the deploy commands, the rollback note that local_settings.py is never overwritten.

  • VLAN-per-port network: hardware prototype runbook: its “firewall reload safety” note describes the reload only, which is now the role’s only way of loading changed rules (Deploying to a gateway).

  • tweed fresh-rebuild log: the option ROM (A1-1), console order and dead UARTs (A1-2, A1-3), the interface pin (A1-4), the vault-location drift (B1-2), the kernel and initramfs mismatch (C1-3), the unreachable slf.sytes.net (P2-9), the known-hosts lifecycle (P2-2) and rebuild #3’s zero-intervention result.

  • QEMU VM Testing for Ansible Playbooks and QEMU VM Testing Implementation Plan: the superseded EDK2 UEFI and grubaa64.efi boot chain for the test guest.