# Warden Control-Plane Provisioning

Use this file for the canonical Bastille create path.

## Create control-plane

```sh
sudo npx tsx setup/index.ts --step jail --create-control-plane
```

The underlying canonical shape is:

```sh
bastille create -T -B -g 192.168.100.1 controlplane 15.0-RELEASE 192.168.100.100/24 warden0
bastille config controlplane set host.hostname ai.clawdie.si
bastille restart controlplane
```

## Recreate a bad control-plane jail

If a control-plane jail was created with the wrong profile or wrong hostname
behavior, destroy it cleanly before recreating it.

```sh
sudo bastille stop controlplane
sudo bastille destroy -y controlplane
sudo npx tsx setup/index.ts --step jail --create-control-plane
```

Notes:

- `-y|--yes` bypasses the interactive confirmation prompt
- Bastille archives console logs on destroy under `/var/log/bastille/`
- a `pfctl: Table does not exist.` warning during stop or destroy means host
  firewall state is incomplete, not that the destroy operation itself failed

## Validate running state

```sh
jls
jexec controlplane /bin/sh -c 'hostname && ifconfig'
```

Expected:
- jail exists
- hostname is `ai.clawdie.si`
- jail IP is `192.168.100.100`

## Parallel pattern for persistent service jails

The same Bastille shape is now proven for the database jail:

```sh
sudo bastille create -T -B -g 192.168.100.1 db 15.0-RELEASE 192.168.100.2/24 warden0
```

Expected Bastille signals:

- `Creating a thickjail. This may take a while...`
- `e0a_db`
- `e0b_db`
- `Applying template: default/vnet...`
- `Applying template: default/thick...`
- `Applying template: default/base...`

## Repeated VNET route failure

Failure signature:

- VNET jail comes up with the correct IP
- `netstat -rn` has no `default` route

Interpretation:

- Bastille create path is missing the explicit Warden gateway

Fix:

```sh
bastille create -T -B -g 192.168.100.1 ...
```
