docs: record lars as operator + the NM no-lease-after-replug trap

Applied to the device and idempotency-verified (run 1 changed=1, run 2
changed=0). Also notes the NetworkManager behaviour that looked like a
mis-plugged cable: after a re-plug the wired profile stays active with no
IPv4 until the connection is cycled.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EyYJWABgSEHzbjsZGrkxVE

CLAUDE.md

@@ -57,6 +57,9 @@ ssh-keygen -R '[127.0.0.1]:2222'                                # if the tunnel
   (DHCP). Moving the cable flaps the link and NM re-selects a profile — pin the intended
   one sticky (`autoconnect yes` + higher priority) and the other off, or it reverts.
   Either profile works now that the mgmt VLAN serves DHCP (`.253` from the pool).
+  After a re-plug the link often comes up with **no IPv4 at all** (profile active, DHCP
+  never retried). `nmcli connection down/up "Wired connection 1"` fixes it — check for an
+  address before concluding the cable is in the wrong port.
 - The `.venv` was built under `/home/sjat/…`; on a checkout at another path its console
   scripts fail with exit 126 (stale shebang). Fix the shebangs or rebuild the venv —
   the system `ansible` is not a substitute (no paramiko, newer `community.general`).
@@ -98,8 +101,9 @@ Live on the device (2026-06-09): flat L2 switch on `10.2.30.0/24` — **DATA VLA
 (mgmt `192.168.88.1/24`, no gateway/NTP/DNS), `vlan-filtering` on. The mgmt port also
 serves DHCP (`192.168.88.10-.254`) + the web UI as a makerspace experiment (flags
 `switch_web_enabled`, `switch_mgmt_dhcp_enabled`). Default `admin` disabled. Operators
-(2026-09-01): `sjat` (keys: mamba seat + `claude@ubongo` automation seat) and `claus`
-(`claus@stjerno.dk`), both group `full`, both managed by `switch_operators` in `host_vars`.
+(2026-09-01): `sjat` (keys: mamba seat + `claude@ubongo` automation seat), `claus`
+(`claus@stjerno.dk`) and `lars` (`lars@hrossen.dk`, the same key he uses on the MakerFLOSS
+forgejo and VPS), all group `full`, all managed by `switch_operators` in `host_vars`.
 All task files + `play_bootstrap`/`play_backup` are idempotency-verified. Design + cutover runbook:
 `docs/superpowers/specs/2026-06-09-crs310-flat-mgmtvlan-design.md`.
 

files/operators/lars-hrossen.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/6+Qf+kGA+a+yE9LPEM17oAExCNL7dHgX/dA3RM6b2qLGKx0H7FaJcAPIBYqIQYBI1yNJs1uxInbEyc/e714a/5VFuISzTRqN0aCIrgyLDE/NkKs/Xner7vkG8YUloP8bCy6+KDxPk/SEj99VNzFM+OiT6/KMvlnmG5Y6HrSfjt9hMPQF32N1x5Mk+bAlwhKPt4f9McrCv0hgdr1XS462oNLpPgOEeFMPVRcfUrKnfKa+R9Dy0mbCsHv9wHa51LBevFFOgikgh2EK3Lsz0tltOfEcwtXA+0/nT8tXaSfLosI/gVWGV/EoyTAZardIZJrJZMgVSFWD8rTIauCzfVEM+unzjsENjW1Xn7bZeXcD/8pUGSKa45n+sPjAh/lsyqre6N4+RmdP93VLrhtklJ6eT+YHjtju/49mh+jxDCtzYZCbxqcvJgS65bXasYACW0NIc2yHZjXyFkBg3pZB/MLrnMyETWBUDJRhOI9d+Qu1/OLeZoH6sTpSp7G5XjNyJfPLySy9/q6y3zlyX6aHRug6WhwcCcwDMRPEUTimTl1qPmO7l7mJ1qLORFvJw5avmgzomoxf7oUVYGj8F64w6IvUr4rZGBTGJbPkTp3vhIKmyuio8FDjqcojCQ1jvmLRf3uPQhQ6JPyAQAWLyaha7mMIRBbgWn5H0iaD7p7jRABiIQ== lars@hrossen.dk

group_vars/mikrotik.vault.yml

@@ -1,25 +1,26 @@
 $ANSIBLE_VAULT;1.2;AES256;makerfloss
-32653033396232323333353737313334656237356163386433626333646461376534396131636134
-6632363938393232613364383937643631303934383464380a316537663466383735363633316238
-33363930316631643666383266613936393031616261316263363234306631343736643265393663
-6430363337326230640a303164306430376666626432303838316134663363656631386330613831
-32623635333964613033353733653066623863616536633861643763613532373661376331653065
-33313630313561343561643262613962343366346631353865633462366532643739396330346466
-35636537396137373432353036356536333931396537356536353863653435323431633639343932
-65356531373032373764643664643866623236333162323335353431623165666537653234393564
-35313235623362636337373138616433626130313535613831363431316366626439306666643734
-65623861323966356435656637333632306463393934303065636337373163373639326364343466
-38336230313634353330353162313064646338623436366263386364303239366636373064663662
-66636161343539656331633064373965626434623066333036383030383161363263633261376562
-38326661393161643132666337366231633338633634633165643130343461623130383163363865
-35613837353263666536316337363965396138656461386265623132333236616635306137333765
-66633334356231303565616535353335366232623631323733623531633564303633313030656239
-64323165396634353834643236303334303234633739616561336635373133343935303135313636
-34613932336338636163663531383665356662633465333762383063393138383035653235663838
-38643166333433346632396666336137656166656130333237303237333433356263323638363664
-37363566353762626238343866336239633461613536333834623433356532333739663665336262
-31626536336464613666353732343434616464663135633535313864653032383537386662653834
-30663832336366333035663163646334356533356339323262383538386338353961323235363165
-33616338303231323463376165633437653362393664393033353236333635346430373761613862
-37383338366238616335333632666134306663663236366331613261396363373866636665313161
-35646239323236353036
+38653036333839306130346636356131333366396362666166373064646233323432363862363130
+3238343563383363636132323335346364313037306364380a393332393430616439363163313937
+32333164666461393764653631303836333736626562653366393565383765336662353734366331
+3966353265383738640a636163336339346464616130356666633866633263303439303338643030
+65323265323562353332643839303932383365353065316636646534386132316431373532636339
+39633937663335366537623461616136383932313231653061316437363633633261393438383435
+64373932616263626334393231623435356139623433353934636538316434353937303732386539
+31366237383463306436383966613635633539333433646264386466623436616132613238656664
+31373539373830343134616637643637333830393433386335316236653931636333653533316366
+61613937363235626538643338656465376433313236326261663633386438376161323762663761
+34356239626232383162356535663234393338623235303864636162343961363638316335353164
+37386135366364376339316561366339313238303133666438383831366563353265313761306339
+61333039353537303737333132353266353165663366353337323934306665303636323235353238
+36616136613161343636636561356461323762623831643162303430643231383730336236306563
+32636666376565336338623664363163323336363666663539653936633066636431613238303466
+65313935663036363363363532306139646364613861656465616533663531333965663366613738
+37626563626633323262336536656461643939366130353631666638666565643765616537653562
+30633532366536303437313136336663616536366130613562396139336338383031303839613539
+33353463666239313465623564633864653631383238613561663164333937656464613561643530
+33666635373238616365376362306434363462346435633563343533613835323334386265643562
+34306164366233306162656663366631376338346233666133613065656534386139646132383661
+35363033383635333338393462323735303364623932363333653264343035323961383565646634
+32363661303464386331393864323937616430393239633061373630313865356438366239663837
+62363337353461626335646362376234663334613864316131643265343066633730366334656133
+30383830396139373263346133643531623438656435323265363061313731633331

host_vars/crs310-maker.yml

@@ -57,6 +57,10 @@ switch_operators:
     group: "full"
     pubkey_files:
       - "files/operators/claus-stjerno.pub"
+  - name: "lars"                                   # added 2026-09-01
+    group: "full"
+    pubkey_files:
+      - "files/operators/lars-hrossen.pub"
 
 # ----- VLANs + per-port map (all untagged access; no trunks) -----
 # DATA = flat 10.2.30.0/24 (uplink + device ports); MGMT = isolated admin VLAN.