docs: record the proxmox vm settings

vga: virtio-gl, serial0 and ovmf are load-bearing and live only on the
hypervisor, so a rebuilt vm would regress silently.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

hosts/yolo/PROXMOX.md

@@ -0,0 +1,51 @@
+# yolo — Proxmox VM settings
+
+Hypervisor-side configuration for VM 132. Nix cannot express any of it, and
+three of these are load-bearing in ways that fail silently if changed.
+
+```
+qm create 132 --name yolo \
+  --cores 8 --sockets 1 --cpu host \
+  --memory 16384 \
+  --machine q35 \
+  --bios ovmf \
+  --ostype l26 \
+  --scsihw virtio-scsi-single \
+  --scsi0 data:400,discard=on,iothread=1,ssd=1 \
+  --efidisk0 data:1,efitype=4m,pre-enrolled-keys=0 \
+  --net0 virtio,bridge=vmbr0,tag=7,firewall=1 \
+  --vga virtio-gl \
+  --serial0 socket \
+  --agent 1 \
+  --onboot 1
+```
+
+After creating the disk, drop its ZFS reservation — the `data` pool has no
+`sparse` flag, so a 400G zvol otherwise reserves all 400G up front:
+
+```
+zfs set refreservation=none data/vm-132-disk-1
+```
+
+## The three that matter
+
+**`--vga virtio-gl`.** Not for speed — the host's virglrenderer falls back to
+llvmpipe either way. It is what lets mesa allocate GBM buffers. With plain
+`virtio` every capture fails with `Failed to create GBM buffer`, and sunshine
+streams a black picture while reporting no error at all.
+
+**`--serial0 socket`.** `virtio-gl` renders through a GL context with no QEMU
+console surface, so the Proxmox noVNC console and `qm screendump` both go dark.
+This plus `boot.kernelParams = [ "console=ttyS0,115200" ]` keeps
+`qm terminal 132` working as the only out-of-band way in.
+
+**`--bios ovmf`.** `hosts/common/features/user.nix` uses systemd-boot, which
+needs UEFI. SeaBIOS gives an unbootable disk.
+
+## Network
+
+`tag=7` puts the guest on the VLAN behind `10.7.10.1`. That VLAN is the
+UNTRUSTED zone: internet and DNS are allowed, private networks are denied by
+default. Reaching `10.6.10.0/24` or the wireguard clients on `10.10.0.0/24`
+needs an OPNsense pass rule on the UNTRUSTED interface, above
+"Allow access to the Internet but block access to private networks".

hosts/yolo/default.nix

@@ -19,6 +19,9 @@
     ../common/features/home
   ];
 
+  # Hypervisor-side settings this host depends on are in ./PROXMOX.md —
+  # `vga: virtio-gl` in particular, without which sunshine captures a black
+  # screen and reports no error.
   networking.hostName = "yolo";
 
   # Lets the Proxmox host drive clean shutdowns/reboots and report the guest's