diff --git a/AGENTS.md b/AGENTS.md index 07b9576..c481d35 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -169,10 +169,10 @@ get wrong. Work items originate as files in this repo — not in the hub. The hub is a read/cache/index layer that rebuilds from files. -**File location:** `workplans/RAILIANCE-WP-NNNN-.md` +**File location:** `workplans/RAIL-BS-WP-NNNN-.md` **Archived location:** finished workplans may move to -`workplans/archived/YYMMDD-RAILIANCE-WP-NNNN-.md`. The `YYMMDD` prefix is +`workplans/archived/YYMMDD-RAIL-BS-WP-NNNN-.md`. The `YYMMDD` prefix is the completion/archive date; the frontmatter `id` does not change. **Ad Hoc Tasks:** small opportunistic fixes discovered during a session use @@ -184,7 +184,7 @@ anything needing analysis, design, approval, dependencies, or multiple phases. ```yaml --- -id: RAILIANCE-WP-NNNN +id: RAIL-BS-WP-NNNN type: workplan title: "..." domain: financials @@ -208,7 +208,7 @@ derived health labels, not frontmatter statuses. ## Task Title ` ` `task -id: RAILIANCE-WP-NNNN-T01 +id: RAIL-BS-WP-NNNN-T01 status: wait | todo | progress | done | cancel priority: high | medium | low state_hub_task_id: "" # written by fix-consistency — do not edit diff --git a/SCOPE.md b/SCOPE.md index f18c10c..f66250e 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -74,7 +74,7 @@ future `rail-kubernetes` repo and must not be treated as long-term S2 scope. - Status: active / stable - Implementation: k3s baseline, age-encrypted backup, kubeconfig delivery, and cluster operator/addon management are established; generic workload lifecycle docs/tooling remain here as transition debt pending `rail-kubernetes` extraction -- Open work: RAIL-BS-WP-0007 ThreePhoenix HA cluster (active, 0/7); RAIL-BS-WP-0008 activity-core WP-0016 deploy (ready); RAIL-BS-WP-0009 admin-sync smoke (ready); RAIL-BS-WP-0012 rail-kubernetes extraction (active) +- Open work: RAIL-BS-WP-0007 ThreePhoenix HA cluster (backlog); RAIL-BS-WP-0014 cluster capacity evidence (ready) - Usage: core Kubernetes runtime for all Railiance deployments. **Two clusters are managed**: `railiance01` (92.205.62.239) is the current primary and runs the live workloads; `CoulombCore` (92.205.130.254) is the older cluster and is diff --git a/workplans/RAIL-BS-WP-0007-threephoenix-ha-cluster.md b/workplans/RAIL-BS-WP-0007-threephoenix-ha-cluster.md index 5f93e55..2c6c3a8 100644 --- a/workplans/RAIL-BS-WP-0007-threephoenix-ha-cluster.md +++ b/workplans/RAIL-BS-WP-0007-threephoenix-ha-cluster.md @@ -5,12 +5,18 @@ title: "ThreePhoenix - HA Cluster Implementation" domain: financials repo: railiance-cluster status: backlog -owner: railiance +owner: codex topic_slug: railiance repo_goal_id: "6ea441f7-7fe3-4598-922b-38baf20c0580" state_hub_workstream_id: "9e208376-23f1-40c7-9813-fac1f7d6ad3b" created: "2026-02-25" -updated: "2026-08-08" +updated: "2026-08-15" +related: + - REEF-RAILIANCE-WP-0003 + - RAIL-BS-WP-0014 + - RMASTER-WP-0023 + - ADR-0006 + - ADR-0008 --- # ThreePhoenix - HA Cluster Implementation @@ -23,17 +29,24 @@ cluster substrate for Railiance production systems. The cluster target includes: - k3s HA with embedded etcd. -- Distributed storage. -- High-availability database patterns. -- Ingress and certificate automation. +- Cluster-level storage operator hooks (not the database clusters). +- Ingress and certificate controllers (live path is Traefik, not nginx). - Node rotation and recovery drills. -- Monitoring and acceptance audits. +- A machine-readable one-server-loss S2 evidence pack. -This is also the S2 substrate work that can clear the open failure-domain gate +This is the S2 substrate work that can clear the open failure-domain gate for critical workloads on `reef-railiance`, beginning with -`REEF-RAILIANCE-WP-0003`. Cluster readiness alone does not promote a workload: -each consumer retains its own identity, network, dependency, rollback, and -application-level failover gates. +`REEF-RAILIANCE-WP-0003`. Cluster readiness is ADR-0006 **reef evidence** +for `verified`. It must not write `production-approved` on a binding. +Current reality is one Ready node (`railiance01`), local storage, Traefik. +Do not report ThreePhoenix targets as live capacity (`RAIL-BS-WP-0014`). + +Any listener this plan adds is ADR-0008 `private` unless a named grant +exists. `6443` is not grantable as `public`. An Ingress object is not a +grant. + +The bootstrap copy of this file is retired. Do not re-open +`RAIL-BS-WP-0007` in `railiance-bootstrap`. ## Why This Belongs Before Forgejo @@ -64,7 +77,13 @@ Out of scope: - OS provisioning and host hardening: `railiance-infra`. - Reef membership and grouped substrate identity: `reef-railiance`. - Workload-specific production approval: the owning `rapp-*` repo and - `reef-railiance` binding. + `reef-railiance` binding (ADR-0006). +- PostgreSQL clusters and credentials: `railiance-platform` (CNPG + operator may already be installed here; clusters are not). +- Forgejo/Gitea HA as a product: `rapp-forgejo` / `railiance-apps` / + `railiance-forge`. +- Monitoring stack: `railiance-telemetry` (signal contract) and a + future `rapp-*` (deployable). This file keeps only the S2 drill. ## Failure-domain contract @@ -139,19 +158,14 @@ ThreePhoenix acceptance criteria. ```task id: RAIL-BS-WP-0007-T03 -status: todo +status: cancel priority: high state_hub_task_id: "11283b4c-7e4d-490d-91b3-0d06a593bdf0" ``` -Define the PostgreSQL HA runtime pattern and handoff to S3. - -The original State Hub task names repmgr and Pgpool-II. Before implementation, -reconcile that with the current Railiance production baseline using -CloudNative PG. - -**Done when:** the chosen HA database pattern is documented, tested, and -owned by the correct layer without conflicting with `railiance-platform`. +Cancelled 2026-08-15. Database clusters are `railiance-platform` (CNPG). +S2 already has the operator installed on `railiance01`. Do not define +repmgr/Pgpool or a cluster here. --- @@ -159,29 +173,18 @@ owned by the correct layer without conflicting with `railiance-platform`. ```task id: RAIL-BS-WP-0007-T04 -status: todo +status: cancel priority: high state_hub_task_id: "4a20e593-a89d-43da-abcc-5a39a4c8b3c0" ``` -Validate a representative stateful source-forge workload on the HA cluster. - -The historical task names Gitea. In the current roadmap this should become -Forgejo unless a temporary Gitea reference drill is still useful. - -Minimum checks: - -- Repository storage survives pod reschedule and node disruption. -- Database failover behavior is understood. -- Package registry storage is included in backup/restore thinking. -- Application-level rollback is compatible with the staged promotion lifecycle. - -**Done when:** Railiance has a proven stateful source-forge deployment pattern -that can be reused for the Forgejo migration. +Cancelled 2026-08-15. A source-forge HA product belongs to +`railiance-forge` / `rapp-forgejo`, not S2. T01/T02/T06 already cover +PVC and node disruption at the cluster layer. --- -### T05 - Nginx ingress and cert-manager SSL +### T05 - Traefik ingress and cert-manager SSL ```task id: RAIL-BS-WP-0007-T05 @@ -190,17 +193,21 @@ priority: medium state_hub_task_id: "68315a40-dd5b-4032-a9e7-1152e38f9807" ``` -Implement and validate the production ingress and certificate path. +Validate the production ingress and certificate path on the HA topology. +Live `railiance01` already uses Traefik (k3s default) and cert-manager. +Do not introduce nginx. Minimum scope: -- Ingress controller topology. -- TLS certificate issuance and renewal. -- Private/public exposure rules. +- Ingress controller topology on the three-node target. +- TLS issuance and renewal. +- ADR-0008: no public Ingress class unless a grant exists; ClusterIP is + the paved Service; `6443` stays operator-only. Packet policy for + rapps is `RAIL-K8S-WP-0003` / `RMASTER-WP-0023`. - Health checks for ingress and certificate validity. -**Done when:** representative services can be exposed through the intended -ingress path with valid certificates. +**Done when:** a *granted* representative hostname can be served with +valid certificates, and an ungranted Service stays ClusterIP. --- @@ -241,20 +248,18 @@ Add the monitoring stack and final acceptance audit checklist. Minimum scope: -- Cluster health signals. +- Cluster health signals (what S2 can see). Do not stand up the + telemetry stack here (`railiance-telemetry`). - Storage health. -- Database/operator health handoff. - Ingress and certificate health. -- Backup/restore freshness. -- Promotion lifecycle readiness. -- A machine-readable one-server-loss drill, including pre-failure state, - failure injection, quorum and service observations, recovery time, rejoin, - and post-recovery state. -- A downstream handoff that lets `reef-railiance` and individual workload - owners cite the S2 evidence without treating it as workload approval. +- A machine-readable one-server-loss drill: pre-failure state, failure + injection, quorum and service observations, recovery time, rejoin, + post-recovery state. +- A handoff that lets `reef-railiance` cite this as ADR-0006 reef + evidence without treating it as `production-approved`. -**Done when:** ThreePhoenix can be declared ready for critical workloads only -after the checklist and one-server-loss drill pass. +**Done when:** the checklist and one-server-loss drill pass. Bindings +stay at their last proven ADR-0006 state. ## Dependencies diff --git a/workplans/RAIL-BS-WP-0014-capacity-utilization-and-allocation-evidence.md b/workplans/RAIL-BS-WP-0014-capacity-utilization-and-allocation-evidence.md index 348e313..2a84b0f 100644 --- a/workplans/RAIL-BS-WP-0014-capacity-utilization-and-allocation-evidence.md +++ b/workplans/RAIL-BS-WP-0014-capacity-utilization-and-allocation-evidence.md @@ -8,10 +8,12 @@ status: ready owner: codex topic_slug: railiance created: "2026-08-11" -updated: "2026-08-11" +updated: "2026-08-15" related: - RAIL-BS-WP-0007 - RESOURCE-WP-0003 + - ADR-0006 + - ADR-0008 state_hub_workstream_id: "ea6ec98a-0d65-4afa-b6c5-6e7ed34011ac" --- @@ -24,6 +26,18 @@ Publish reproducible non-secret evidence for utilization, persistent-storage exposure, failure domains, and allocation drivers. Origin: `RESOURCE-WP-0003-T04` delegated evidence gap. +This is ADR-0006 reef evidence (capacity headroom, failure-domain +assumptions). It does not promote a binding to `production-approved`. +It does not publish a public metrics listener (ADR-0008). Collect +in-cluster or via the operator tunnel. + +Current reality: one Ready node (`railiance01`), local storage, Traefik. +Do not invent a three-domain map or report Longhorn as live capacity. +`RAIL-BS-WP-0007` is the HA *target*. + +S2 publishes facts. `reef-railiance` cites them. `resource-control` / +fin-hub allocate. No booked EUR in this repo. + ## T01 — Produce periodic cluster capacity observations ```task