# Warden Bootstrap Troubleshooting

Use this file when control-plane provisioning fails.

## Common failure signatures

### Bastille creates a thinjail

Likely cause:
- control-plane create path did not force `-T`

Response:
- destroy the bad jail
- recreate using the canonical thick create path

### Hostname remains `controlplane`

Likely cause:
- hostname was written but jail was not restarted

Response:
- apply `bastille config ... host.hostname ...`
- restart the jail

### `BRIDGE_EXISTS: false`

Likely cause:
- host bridge not created or not persisted

Response:
- use `bastille-network`

### `jexec: jail "controlplane" not found`

Likely cause:
- control-plane jail not created
- control-plane jail not started

### `pfctl: Table does not exist.`

Likely cause:
- Bastille tried to clean up firewall state
- the canonical `pf` table is not loaded on the host yet

Response:
- treat this as a host firewall configuration gap
- use `warden-pf` to define the Warden NAT and table state
- do not misclassify it as a jail creation or destroy failure

### Bastille destroy asks for confirmation

Likely cause:
- normal Bastille safety prompt

Response:
- use `bastille destroy -y controlplane` in deterministic operator or agent flows
- remember that destroy archives console logs under `/var/log/bastille/`

### Archived Bastille console log shows `add net default: gateway 51.83.197.1 ... Invalid argument`

Likely cause:
- VNET jail was created without the explicit Warden gateway
- Bastille inferred the host uplink gateway instead

Response:
- fix the create path to include:
  - `-g 192.168.100.1`
- recreate the jail instead of layering manual route fixes over bad provisioning
