Standard Change Templates¶

Version 1.0 | Classification: CONFIDENTIAL — Internal Use Only

Standard changes are pre-approved. They may be executed without IT Manager approval only if followed exactly. Any deviation reclassifies the change as Normal.

SC-001 — Add a DHCP Static Reservation¶

Risk: Low | Systems: SKY and RAIN

Procedure:

Obtain hostname, MAC address, and desired IP from the requestor. Verify IP is outside the dynamic pool.

Add reservation to /etc/dhcp/dhcpd.conf on SKY and RAIN (both simultaneously):

host <hostname> {
    hardware ethernet <MAC>;
    fixed-address <IP>;
    option host-name "<hostname>";
}

Restart DHCP: sudo systemctl restart dhcpd
Add forward and reverse DNS records to /var/named/wdc.us.gl3.db and the reverse zone file.
Increment zone serial, re-sign DNSSEC, reload BIND: rndc reload
Update wdc-hostregistry.csv.
Run Post-Change Checklist on both SKY and RAIN.

SC-002 — Add a DNS A/PTR Record Pair¶

Risk: Low | Systems: SKY and RAIN

Procedure:

Add the A record to /var/named/wdc.us.gl3.db and PTR to the appropriate reverse zone.
Increment zone serial numbers.
Re-sign DNSSEC and reload: rndc reload
Verify: dig @192.168.120.1 <hostname>.wdc.us.gl3 A +short
Update wdc-hostregistry.csv.
Run Post-Change Checklist on both SKY and RAIN.

SC-003 — Apply OS Security Updates (dnf-automatic)¶

Risk: Low | Systems: Any server

dnf-automatic applies security updates automatically. Manual invocation for an ad-hoc update:

sudo dnf update --security -y

Reboot only if a kernel update was applied:

needs-restarting -r && echo "Reboot required" || echo "No reboot needed"

Run Post-Change Checklist after any package update.

SC-004 — Rotate Grafana Admin Password¶

Risk: Low | Systems: SUN

Log in to Grafana at http://192.168.124.3:3000 as grafana_admin.
Navigate to Profile → Change Password.
Set new password meeting the 14-character policy.
Update the password in the secure vault.
Log the change to /var/log/asset-inventory.log on SUN.

SC-005 — Rebuild and Redeploy MkDocs Portal¶

Risk: Low | Systems: GCP Cloud Run

cd ~/terraform/gpus-infra/mkdocs
gcloud builds submit --config=cloudbuild.yaml .

Verify the portal is live:

gcloud run services describe gpus-mkdocs-portal \
    --region=us-central1 \
    --format="value(status.url)"

No Post-Change Checklist required (GCP only — no on-prem AIDE or DNSSEC impact).

SC-006 — Add a New Server to the Status Site¶

Risk: Low | Systems: GCP Cloud Run (status site backend)

Deploy SSH public key to the new server for the appropriate service user.
Open port 22 from 10.8.0.0/28 in the new server's firewall.
Add the server to SERVERS dict in app.py and SERVER_META in gpus-status-site.html.
Rebuild status-site image and redeploy via Cloud Build.
Verify the new server card appears on https://status.greenpeace.us.

Annual Review¶

Standard change templates are reviewed and re-approved annually by the IT Manager. Last review: 2026-03-13.

Standard Changes · v1.1 · 2026-03-14 · GPUS-IT · Classification: CONFIDENTIAL — Internal Use Only