菜单
Windows 11 VM provisioning on Proxmox with iGPU passthrough, QEMU Guest Agent, autounattend.xml, and PowerShell configuration. Use when creating Windows VMs, managing iGPU PCI passthrough, or configuring Sunshine/Moonlight streaming.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Project architecture and design principles for vm_builds Ansible project. Includes bake vs configure patterns, two-role service model, and deployment lifecycle.
Python code conventions. Functions return errors, .env parsing strips quotes, type hints required.
Proactive validation patterns to catch issues early, prevent debugging blind, and establish testing habits before problems escalate.
Update skills and rules when encountering new issues to prevent recurrence. Includes hard-fail patterns, code custodianship, and mandatory testing requirements.
LXC container provisioning and configuration patterns. Use when creating LXC services, managing container networking, or handling LXC template operations.
Molecule test performance optimization patterns. Template caching, NTP sync, pct_remote overhead, apt cache, selective rebuilds.
| name | windows-vm-patterns |
| description | Windows 11 VM provisioning on Proxmox with iGPU passthrough, QEMU Guest Agent, autounattend.xml, and PowerShell configuration. Use when creating Windows VMs, managing iGPU PCI passthrough, or configuring Sunshine/Moonlight streaming. |
Bind iGPU to vfio-pci via runtime sysfs manipulation (echo to /sys/bus/pci/drivers/). Do NOT write modprobe config files (blacklist-igpu.conf, vfio-pci-igpu.conf). Sysfs-only binding is reversible without initramfs updates.
NEVER bind the sole GPU on an AMD host to vfio-pci. The amdgpu driver removal triggers a kernel panic when it is the only framebuffer. Hard-fail if lspci | grep -c 'VGA compatible controller' < 2 and vendor is AMD. Intel single-GPU hosts survive (SSH stays up).
Cleanup MUST modprobe -r the GPU driver BEFORE modprobe to re-probe devices. Simply running modprobe i915 after vfio-pci unbind is a no-op if the module is already loaded. Sequence: unbind → modprobe -r → PCI rescan → modprobe → wait for DRI.
Previous bug: cleanup removed /etc/modprobe.d/blacklist-igpu.conf — a file the role never created. Cleanup MUST only remove artifacts the deploy creates.
When multiple hosts share a Proxmox node (common in test environments), compute VMID as base + groups['flavor_group'].index(inventory_hostname). Apply the same computation in provision, verify, AND cleanup.
The default cleanup list must include the full range of possible per-host VMIDs (base, base+1, base+2, ...) to cover all group sizes.
Proxmox /tmp is often tmpfs (~7.8 GB). Windows qcow2 images are 8-18 GB. ALWAYS use /var/tmp/ (real disk) for image uploads and qemu-img convert output.
Previous bug: qemu-img convert to /tmp/ failed with "No space left on device" on a host with 8 GB tmpfs.
Use qm guest cmd <vmid> ping to detect GA readiness. Use qm guest exec <vmid> --timeout N -- cmd /c "..." for in-VM commands. These bypass the network entirely — no SSH, no sshpass, no ProxyJump needed.
IP discovery: qm guest cmd <vmid> network-get-interfaces returns JSON. Parse with Python, skip Loopback interfaces AND 169.254.x.x (APIPA/link-local) addresses, extract first routable IPv4 address. Retry until a DHCP lease is obtained.
Previous bug: Guest Agent responded to ping before Windows DHCP client obtained a lease. The first IP returned was 169.254.143.117 (APIPA). SSH to this link-local address timed out. Fix: filter 169.254. prefix in the Python parser and increase retries.
qm guest cmd ping is a simple command — use ansible.builtin.command, not ansible.builtin.shell. Only use shell when there's an actual pipeline.
Disable Windows Defender and Windows Update in the specialize pass via RunSynchronous + reg add to Group Policy keys. Do NOT use FirstLogonCommands — Tamper Protection blocks Defender changes from user-context commands.
Re-enable Defender and set Windows Update to Manual at the end of post-install.ps1. This prevents AV interference during setup but leaves the system in a safe state.
Post-install completion: write a marker file (C:\post-install-done.txt) at the end of post-install.ps1. Poll with qm guest exec checking for the marker. Hard-fail if marker not found within timeout — proceeding with an incomplete image violates the one-path principle.
NEVER wrap ansible.builtin.raw commands in powershell -Command "..." when the SSH shell is already PowerShell. The outer shell expands $variables in double-quoted strings before passing to the inner PowerShell instance.
Previous bug: $svc = Get-Service ... in powershell -Command "... $svc ..." — the outer PowerShell expanded $svc to empty, causing syntax errors.
format=raw. The qcow2 format is unsupported for EFI disks on LVM-thin and causes "unsupported format" errors.ProxyJump via PRIMARY_HOST when the host is in lan_hosts.