Update

5 files changed, 89 insertions, 41 deletions

diff --git a/fish/conf.d/supersync.fish.lock b/fish/conf.d/supersync.fish.lock
deleted file mode 100644
index 062abab..0000000
--- a/fish/conf.d/supersync.fish.lock
+++ /dev/null
@@ -1 +0,0 @@
-2044631
diff --git a/prompts/skills/f3s/SKILL.md b/prompts/skills/f3s/SKILL.md
index bb7f688..cbc3af1 100644
--- a/prompts/skills/f3s/SKILL.md
+++ b/prompts/skills/f3s/SKILL.md
@@ -1,11 +1,11 @@
 ---
 name: f3s
-description: Reference skill for the f3s homelab—four Beelink S12 Pro hosts (f0/f1/f2/f3) running FreeBSD with Rocky Linux Bhyve VMs and a k3s Kubernetes cluster. f0/f1/f2 run r0/r1/r2 k3s nodes; f3 is standalone bhyve only (not part of k3s). Four Raspberry Pi 3 nodes (pi0–pi3) on Rocky Linux 9; pi2/pi3 run Pi-hole (Docker) and LAN wildcard DNS for *.f3s.lan.buetow.org. Covers DTail/dserver on Pis (arm64) and k3s VMs (amd64). Use when troubleshooting or making configuration decisions for the f3s setup.
+description: Reference skill for the f3s homelab—four Beelink S12 Pro hosts (f0/f1/f2/f3) running FreeBSD with Rocky Linux Bhyve VMs and a k3s Kubernetes cluster. f0/f1/f2 run r0/r1/r2 k3s nodes; f3 is standalone bhyve only (not part of k3s) and hosts the plain Rocky Linux VM named rocky. Four Raspberry Pi 3 nodes (pi0–pi3) on Rocky Linux 9; pi2/pi3 run Pi-hole (Docker) and LAN wildcard DNS for *.f3s.lan.buetow.org. Covers DTail/dserver on Pis (arm64) and k3s VMs (amd64). Use when troubleshooting or making configuration decisions for the f3s setup.
 ---
 
 # f3s Homelab Reference
 
-**f3s** = **f**reeBSD + **k3s**. Four physical Beelink S12 Pro mini-PCs (Intel N100) running FreeBSD as the base OS. f0/f1/f2 each host a Rocky Linux 9 bhyve VM forming a 3-node HA k3s Kubernetes cluster. f3 is a standalone host for bhyve VMs only — not part of the k3s cluster.
+**f3s** = **f**reeBSD + **k3s**. Four physical Beelink S12 Pro mini-PCs (Intel N100) running FreeBSD as the base OS. f0/f1/f2 each host a Rocky Linux 9 bhyve VM forming a 3-node HA k3s Kubernetes cluster. f3 is a standalone host for bhyve VMs only — not part of the k3s cluster — and runs a plain Rocky Linux 9 VM named `rocky`.
 
 ## When to Use
 
@@ -21,6 +21,8 @@ Detailed reference documentation is in the `references/` subfolder:
 - [FreeBSD Setup](references/freebsd-setup.md) — Base OS install, packages, ZFS snapshots, configuration
 - [UPS & Power](references/ups-power.md) — APC BX750MI, apcupsd config on f0/f1/f2
 - [Rocky Linux VMs](references/rocky-linux-vms.md) — Bhyve, vm-bhyve, VM config, NVMe disk fix; FreeBSD VM on f3 (migrated from f0)
+- [f3 Rocky VM](references/f3-rocky-vm.md) — Plain Rocky Linux 9 VM on f3 (`rocky`, `192.168.1.123`), autostart policy, root SSH
+- [Bootstrap Rocky bhyve VM](references/bootstrap-rocky-bhyve.md) — Runbook for creating a new plain Rocky Linux bhyve guest with unattended kickstart
 - [WireGuard Mesh](references/wireguard.md) — Mesh topology, IP assignments, peer configs
 - [Storage](references/storage.md) — ZFS (zdata), CARP, NFS over stunnel, zrepl replication
 - [k3s Setup](references/k3s-setup.md) — HA k3s cluster, etcd, node IPs, kubeconfig, ArgoCD
@@ -45,6 +47,7 @@ Package repository details were split into the sibling `pkgrepo` skill. Use `pkg
 | r0 | Rocky Linux VM on f0 | 192.168.1.120 | 192.168.2.120 |
 | r1 | Rocky Linux VM on f1 | 192.168.1.121 | 192.168.2.121 |
 | r2 | Rocky Linux VM on f2 | 192.168.1.122 | 192.168.2.122 |
+| rocky | Plain Rocky Linux VM on f3 | 192.168.1.123 | — |
 | blowfish | OpenBSD internet GW | — | 192.168.2.110 |
 | fishfinger | OpenBSD internet GW | — | 192.168.2.111 |
 | earth | Fedora laptop (roaming) | — | 192.168.2.200 |
diff --git a/prompts/skills/f3s/references/rocky-linux-vms.md b/prompts/skills/f3s/references/rocky-linux-vms.md
index 97ed573..7b60059 100644
--- a/prompts/skills/f3s/references/rocky-linux-vms.md
+++ b/prompts/skills/f3s/references/rocky-linux-vms.md
@@ -191,7 +191,7 @@ network0_mac="<unique>"
 ```
 
 - Accessible as `freebsd.lan` (hostname inside the VM)
-- Auto-starts on f3 boot: `vm_list="freebsd"` in `/etc/rc.conf`
+- Does not auto-start on f3 by default anymore. f3's current default autostart VM is the plain Rocky VM `rocky`; see [f3-rocky-vm.md](f3-rocky-vm.md).
 - `zroot/bhyve/freebsd` encrypted with `f3.lan.buetow.org:bhyve.key`
 - Replicated to f2 via zrepl (`f3_to_f2_freebsd` job, every 10 min → `zroot/sink/f3/zroot/bhyve/freebsd`)
 
diff --git a/scripts/pihole-dns-toggle b/scripts/pihole-dns-toggle
index 1e3cc4d..74770b1 100755
--- a/scripts/pihole-dns-toggle
+++ b/scripts/pihole-dns-toggle
@@ -4,7 +4,7 @@
 set -e
 
 # Pi-hole DNS servers on the Raspberry Pi pair, with the router as last-resort fallback.
-PIHOLE_DNS="192.168.1.127 192.168.1.128 192.168.1.1"
+PIHOLE_DNS="192.168.1.127 192.168.1.128 192.168.1.101 192.168.1.1"
 
 # Colors for output
 GREEN='\033[0;32m'
@@ -12,44 +12,77 @@ YELLOW='\033[1;33m'
 RED='\033[0;31m'
 NC='\033[0m' # No Color
 
-# Get active connection name (excluding loopback)
-get_active_connection() {
-    nmcli -t -f NAME,DEVICE connection show --active | grep -v ':lo$' | head -1 | cut -d: -f1
+# Get active Ethernet/Wi-Fi connection names.
+get_active_connections() {
+    nmcli -t -f NAME,DEVICE,TYPE connection show --active | \
+        awk -F: '$2 != "lo" && ($3 == "802-3-ethernet" || $3 == "802-11-wireless") { print $1 }'
 }
 
 # Check if Pi-hole DNS is currently enabled
 is_pihole_enabled() {
     local connection="$1"
-    local ignore_auto_dns=$(nmcli -t -f ipv4.ignore-auto-dns connection show "$connection" | cut -d: -f2)
-    [[ "$ignore_auto_dns" == "yes" ]]
+    local ignore_auto_dns
+    local configured_dns
+
+    ignore_auto_dns=$(nmcli -g ipv4.ignore-auto-dns connection show "$connection")
+    configured_dns=$(nmcli -g ipv4.dns connection show "$connection" | tr ',' ' ')
+
+    [[ "$ignore_auto_dns" == "yes" && "$configured_dns" == "$PIHOLE_DNS" ]]
 }
 
 # Enable Pi-hole DNS
 enable_pihole() {
-    local connection="$1"
-    echo -e "${YELLOW}Enabling Pi-hole DNS for connection: $connection${NC}"
-    nmcli con mod "$connection" ipv4.dns "$PIHOLE_DNS"
-    nmcli con mod "$connection" ipv4.ignore-auto-dns yes
-    nmcli con up "$connection" > /dev/null 2>&1
+    local connection
+
+    for connection in "$@"; do
+        echo -e "${YELLOW}Enabling Pi-hole DNS for connection: $connection${NC}"
+        nmcli con mod "$connection" ipv4.dns "$PIHOLE_DNS"
+        nmcli con mod "$connection" ipv4.ignore-auto-dns yes
+        nmcli con up "$connection" > /dev/null 2>&1
+    done
+
     echo -e "${GREEN}✓ Pi-hole DNS enabled${NC}"
     echo "DNS servers: $PIHOLE_DNS"
 }
 
 # Disable Pi-hole DNS (use DHCP-provided DNS)
 disable_pihole() {
-    local connection="$1"
-    echo -e "${YELLOW}Disabling Pi-hole DNS for connection: $connection${NC}"
-    nmcli con mod "$connection" ipv4.dns ""
-    nmcli con mod "$connection" ipv4.ignore-auto-dns no
-    nmcli con up "$connection" > /dev/null 2>&1
+    local connection
+
+    for connection in "$@"; do
+        echo -e "${YELLOW}Disabling Pi-hole DNS for connection: $connection${NC}"
+        nmcli con mod "$connection" ipv4.dns ""
+        nmcli con mod "$connection" ipv4.ignore-auto-dns no
+        nmcli con up "$connection" > /dev/null 2>&1
+    done
+
     echo -e "${GREEN}✓ Pi-hole DNS disabled (using DHCP DNS)${NC}"
 }
 
+all_connections_pihole_enabled() {
+    local connection
+
+    for connection in "$@"; do
+        if ! is_pihole_enabled "$connection"; then
+            return 1
+        fi
+    done
+
+    return 0
+}
+
 # Show current DNS status
 show_status() {
-    local connection="$1"
     echo -e "\n${YELLOW}Current DNS configuration:${NC}"
-    nmcli dev show | grep "IP4.DNS" | head -4
+    nmcli dev show | awk -F: '
+        function trim(value) {
+            sub(/^[[:space:]]+/, "", value)
+            sub(/[[:space:]]+$/, "", value)
+            return value
+        }
+        /^GENERAL.DEVICE:/ { device=trim($2) }
+        /^IP4.DNS/ { print device ": " trim($2) }
+    '
 }
 
 # Check if running on Fedora
@@ -75,41 +108,41 @@ main() {
         exit 1
     fi
 
-    # Get active connection
-    CONNECTION=$(get_active_connection)
+    # Get active connections
+    mapfile -t CONNECTIONS < <(get_active_connections)
     
-    if [[ -z "$CONNECTION" ]]; then
+    if [[ "${#CONNECTIONS[@]}" -eq 0 ]]; then
         echo -e "${RED}Error: No active network connection found${NC}"
         exit 1
     fi
 
-    echo "Active connection: $CONNECTION"
+    echo "Active connections: ${CONNECTIONS[*]}"
 
     # Handle command-line arguments
     case "${1:-toggle}" in
         on|enable)
-            enable_pihole "$CONNECTION"
-            show_status "$CONNECTION"
+            enable_pihole "${CONNECTIONS[@]}"
+            show_status
             ;;
         off|disable)
-            disable_pihole "$CONNECTION"
-            show_status "$CONNECTION"
+            disable_pihole "${CONNECTIONS[@]}"
+            show_status
             ;;
         status)
-            if is_pihole_enabled "$CONNECTION"; then
+            if all_connections_pihole_enabled "${CONNECTIONS[@]}"; then
                 echo -e "${GREEN}Pi-hole DNS is currently ENABLED${NC}"
             else
                 echo -e "${YELLOW}Pi-hole DNS is currently DISABLED${NC}"
             fi
-            show_status "$CONNECTION"
+            show_status
             ;;
         toggle|*)
-            if is_pihole_enabled "$CONNECTION"; then
-                disable_pihole "$CONNECTION"
+            if all_connections_pihole_enabled "${CONNECTIONS[@]}"; then
+                disable_pihole "${CONNECTIONS[@]}"
             else
-                enable_pihole "$CONNECTION"
+                enable_pihole "${CONNECTIONS[@]}"
             fi
-            show_status "$CONNECTION"
+            show_status
             ;;
     esac
 }
diff --git a/scripts/wol-f3s b/scripts/wol-f3s
index 849cb73..c9563aa 100755
--- a/scripts/wol-f3s
+++ b/scripts/wol-f3s
@@ -1,25 +1,29 @@
 #!/bin/bash
-# Wake-on-LAN and shutdown script for f3s cluster (f0, f1, f2)
+# Wake-on-LAN and shutdown script for f3s hosts (f0, f1, f2, f3)
 # and optional shutdown for Raspberry Pi nodes (pi0–pi3)
 #
 # Usage:
-#   wol-f3s              # Wake all three Beelinks
+#   wol-f3s              # Wake f0, f1, and f2
 #   wol-f3s f0           # Wake only f0
 #   wol-f3s f1           # Wake only f1
 #   wol-f3s f2           # Wake only f2
-#   wol-f3s shutdown     # Shutdown all three Beelinks
+#   wol-f3s f3           # Wake only f3
+#   wol-f3s shutdown     # Shutdown f0, f1, and f2
+#   wol-f3s shutdown-f3  # Shutdown only f3
 #   wol-f3s shutdown-pis # Shutdown all four Raspberry Pis
-#   wol-f3s shutdown-all # Shutdown Beelinks and Pis
+#   wol-f3s shutdown-all # Shutdown f0, f1, f2, and Pis
 
 # MAC addresses
 F0_MAC="e8:ff:1e:d7:1c:ac"  # f0 (192.168.1.130)
 F1_MAC="e8:ff:1e:d7:1e:44"  # f1 (192.168.1.131)
 F2_MAC="e8:ff:1e:d7:1c:a0"  # f2 (192.168.1.132)
+F3_MAC="e8:ff:1e:d7:f3:d7"  # f3 (192.168.1.133)
 
 # IP addresses
 F0_IP="192.168.1.130"
 F1_IP="192.168.1.131"
 F2_IP="192.168.1.132"
+F3_IP="192.168.1.133"
 
 # Raspberry Pi IP addresses (no WoL support, shutdown only)
 PI0_IP="192.168.1.125"
@@ -68,6 +72,9 @@ case "$ACTION" in
     f2)
         wake "f2" "$F2_MAC"
         ;;
+    f3)
+        wake "f3" "$F3_MAC"
+        ;;
     all|"")
         wake "f0" "$F0_MAC"
         wake "f1" "$F1_MAC"
@@ -84,6 +91,12 @@ case "$ACTION" in
         echo "✓ Shutdown commands sent to all Beelinks."
         exit 0
         ;;
+    shutdown-f3|poweroff-f3|down-f3)
+        shutdown_host "f3" "$F3_IP"
+        echo ""
+        echo "✓ Shutdown command sent to f3."
+        exit 0
+        ;;
     shutdown-pis)
         shutdown_host "pi0" "$PI0_IP"
         shutdown_host "pi1" "$PI1_IP"
@@ -108,7 +121,7 @@ case "$ACTION" in
         exit 0
         ;;
     *)
-        echo "Usage: $0 [f0|f1|f2|all|shutdown|shutdown-pis|shutdown-all]"
+        echo "Usage: $0 [f0|f1|f2|f3|all|shutdown|shutdown-f3|shutdown-pis|shutdown-all]"
         exit 1
         ;;
 esac