[Gerrrt]

What changed

• docs/runbooks/build-the-playground.md §4 has a new subsection, Services on gandalf: only what the range uses. It lists every service on gandalf that listens or patches, and why each one stays or goes. It also gives the commands that disable and mask rpcbind, nfs-blkmap and nfs-client.target, and the ss read-back to expect.
• §7 now checks Proxmox's own packages at power-on (apt list --upgradable, then apt full-upgrade before the session starts). unattended-upgrades covers Debian's packages only.
• docs/changelog.md has a 2026-11-13 entry.

Why

Finding 6 of the read-only audit of gandalf:

• rpcbind listens on *:111 (tcp and udp), and nfs-blkmap runs, but storage.cfg has no NFS storage. The range is the range ZFS pool.
• spiceproxy (*:3128), postfix (loopback) and unattended-upgrades also run, and the repository named none of them.
• ADR-0017 says the host is "patched like any other host", but nothing said how. unattended-upgrades only uses the Debian and Debian-Security origins, so Proxmox packages were patched only when someone ran apt by hand.

Blast radius

This PR changes docs only, and nothing has been run on gandalf yet:

• Disabling NFS: nothing uses NFS on that node. Masking rpcbind means a future NFS storage would fail to mount until it is unmasked, and the runbook says so.
• Kept services: spiceproxy and postfix are part of Proxmox and stay. The firewall already drops 3128 from everywhere.

This PR and #1498 both add a subsection just before §5, so whichever merges second needs a small merge.

Verification

• make validate: all checks passed, with 46 skipped because there is no Docker here.
• ./scripts/lint.sh: passed, with 14 skipped (shellcheck, markdownlint and editorconfig, which CI runs).
• Read-only on gandalf before writing:
  • systemctl is-enabled / is-active for each service named above.
  • ss -Hltun gave the port list in the table.
  • storage.cfg and pvesm status show no NFS storage.
  • apt-cache policy and 50unattended-upgrades show Proxmox is not among the unattended origins.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The runbook can leave kernel security updates inactive without a required reboot and repeat network checks, and its listener inventory omits owners and keep/remove rationale for two expected ports.

2 open issues

• Reboot into updated kernel before starting the session · New
• Include owners for all expected loopback listeners · New

What changed in this PR

This docs-only PR documents service hardening and patching for gandalf, the Proxmox host supporting the range. The procedures have not yet been applied to the host.

Changes:

• Adds a service inventory, commands to disable unused NFS plumbing and mask rpcbind, and expected listener checks.
• Adds a power-on check and manual upgrade step for Proxmox packages outside unattended updates.
• Records the audit findings and new procedures in the changelog.

File	Description
docs/​runbooks/​build-the-playground.md	Documents service decisions, NFS shutdown commands, and pre-session updates.
docs/​changelog.md	Adds a dated record of the audit findings and runbook changes.

_{Review effort: Balanced}