docs: record the proxmox vm settings

vga: virtio-gl, serial0 and ovmf are load-bearing and live only on the hypervisor, so a rebuilt vm would regress silently. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 12:47:02 +00:00
parent 738f4cd03f
commit c4a20f6152
2 changed files with 54 additions and 0 deletions
@@ -0,0 +1,51 @@
+# yolo — Proxmox VM settings
+
+Hypervisor-side configuration for VM 132. Nix cannot express any of it, and
+three of these are load-bearing in ways that fail silently if changed.
+
+```
+qm create 132 --name yolo \
+  --cores 8 --sockets 1 --cpu host \
+  --memory 16384 \
+  --machine q35 \
+  --bios ovmf \
+  --ostype l26 \
+  --scsihw virtio-scsi-single \
+  --scsi0 data:400,discard=on,iothread=1,ssd=1 \
+  --efidisk0 data:1,efitype=4m,pre-enrolled-keys=0 \
+  --net0 virtio,bridge=vmbr0,tag=7,firewall=1 \
+  --vga virtio-gl \
+  --serial0 socket \
+  --agent 1 \
+  --onboot 1
+```
+
+After creating the disk, drop its ZFS reservation — the `data` pool has no
+`sparse` flag, so a 400G zvol otherwise reserves all 400G up front:
+
+```
+zfs set refreservation=none data/vm-132-disk-1
+```
+
+## The three that matter
+
+**`--vga virtio-gl`.** Not for speed — the host's virglrenderer falls back to
+llvmpipe either way. It is what lets mesa allocate GBM buffers. With plain
+`virtio` every capture fails with `Failed to create GBM buffer`, and sunshine
+streams a black picture while reporting no error at all.
+
+**`--serial0 socket`.** `virtio-gl` renders through a GL context with no QEMU
+console surface, so the Proxmox noVNC console and `qm screendump` both go dark.
+This plus `boot.kernelParams = [ "console=ttyS0,115200" ]` keeps
+`qm terminal 132` working as the only out-of-band way in.
+
+**`--bios ovmf`.** `hosts/common/features/user.nix` uses systemd-boot, which
+needs UEFI. SeaBIOS gives an unbootable disk.
+
+## Network
+
+`tag=7` puts the guest on the VLAN behind `10.7.10.1`. That VLAN is the
+UNTRUSTED zone: internet and DNS are allowed, private networks are denied by
+default. Reaching `10.6.10.0/24` or the wireguard clients on `10.10.0.0/24`
+needs an OPNsense pass rule on the UNTRUSTED interface, above
+"Allow access to the Internet but block access to private networks".