coulomb/railiance-infra
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WP-0005: T12 prep checklist, backup gate 4/7, doc refresh

Browse source 
Update workplan with Jul 9 cron success (4/7 gate, ETA Jul 12), add Gitea
retirement dependency scan and operator checklist, and align deploy-stack,
restore-drill evidence, and migration inventory with post-cutover state.
This commit is contained in:
tegwick 2026-07-09 10:34:44 +02:00
parent 0c3968a108
commit 040ccccc8e
5 changed files with 162 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

50
docs/deploy-stack.md
View file

@ -11,7 +11,8 @@ Before starting, verify you have:
- [ ] SSH access to the target server (COULOMBCORE: 92.205.130.254, user: tegwick, key: `~/.ssh/id_ops`)
- [ ] SOPS age private key available (`~/.config/sops/age/keys.txt` or `SOPS_AGE_KEY` env)
- [ ] ops-bridge running on the workstation (needed for state hub MCP): `make mcp-http` in `~/the-custodian/state-hub/`
- [ ] Gitea accessible (needed for git pull on remote): SSH via `gitea-remote:coulomb/<repo>.git`
- [ ] Forgejo accessible (git pull on remote): SSH via `forgejo-remote:coulomb/<repo>.git`
- [ ] Gitea on coulombcore remains read-only fallback only (`gitea-remote` for emergency rollback)
- [ ] If re-provisioning from scratch: Hetzner/HostEurope API credentials decryptable via SOPS
---
@ -64,26 +65,22 @@ cnpg-system namespace active.
# On CoulombCore (kubectl available after S2)
cd ~/railiance-platform && git pull
# Create Gitea DB credentials secret (one-time; do NOT commit plaintext)
kubectl create secret generic gitea-db-credentials \
--namespace databases \
--from-literal=username=gitea \
--from-literal=password=<GITEA_DB_PASSWORD>
# Deploy Forgejo database cluster (production on railiance01)
# Credentials via SOPS — see railiance-platform docs/forgejo-backup.md
make forgejo-db-deploy
make forgejo-db-status
# Deploy cnpg Gitea database cluster
make db-deploy
# Legacy coulombcore Gitea DB (read-only fallback — retain until T12 retires Gitea)
# make db-deploy && make db-status
# Wait for cluster to be healthy (~60s)
make db-status
# Deploy Valkey cache (standalone, not as Gitea subchart)
# Deploy Valkey cache if required by workloads
# Requires: helm/valkey-values.sops.yaml with encrypted password
make valkey-deploy
make valkey-status
```
**Checkpoint:** `kubectl get cluster -n databases` shows `gitea-db` healthy;
Valkey pod Running in platform namespace.
**Checkpoint:** `kubectl get cluster -n databases` shows `forgejo-db` healthy on
railiance01; Valkey pod Running if deployed.
---
@ -100,22 +97,19 @@ violation, tracked in RAIL-HO-WP-0004). No S4-specific steps required at this ti
# On CoulombCore
cd ~/railiance-apps && git pull
# Deploy Gitea (git hosting)
# Requires: helm/gitea-values.sops.yaml with encrypted values
make gitea-deploy
make gitea-status
# Deploy Forgejo (production source forge on railiance01)
# See railiance-apps/docs/forgejo-on-railiance01.md
make forgejo-deploy
make forgejo-verify
# Deploy state-hub (Custodian cognitive infrastructure)
# See RAIL-HO-WP-0004-T09 for full steps
make state-hub-deploy # (not yet implemented — pending T09)
# Legacy Gitea on coulombcore — read-only fallback; do not use for new repos
# make gitea-deploy && make gitea-status
# Deploy activity-core
# See RAIL-HO-WP-0004-T10 for full steps
make activity-core-deploy # (not yet implemented — pending T10)
# Deploy state-hub, activity-core, and other workloads per railiance-apps Makefile
```
**Checkpoint:** Gitea accessible and all repos cloneable via SSH; state-hub
`/state/health` returns 200.
**Checkpoint:** `https://forgejo.coulomb.social` serves HTTPS; git clone/push via
`forgejo-remote`; state-hub `/state/health` returns 200.
---
@ -135,10 +129,12 @@ Verify: `bridge status` shows all three connected.
## Recovery pointers
- **Forgejo backup/restore:** `railiance-platform/docs/forgejo-backup.md`, `docs/forgejo-restore-drill-evidence.md`
- **Cutover rollback:** `docs/forgejo-cutover-rollback.md`
- **Node overload / SSH unresponsive:** See `the-custodian/ops/runbooks/gitea-coulombcore.md` Issue #3
- **Incident report:** `the-custodian/ops/incidents/2026-03-26-coulombcore-runaway-agent-overload.md`
- **Cluster backup restore:** `railiance-cluster/tools/cmd/railiance-restore-s2`
- **Gitea SSH not working:** Check `gitea-ssh-nodeport` service exists: `kubectl get svc -n default gitea-ssh-nodeport`
- **Forgejo SSH:** NodePort `30022` on railiance01 (`forgejo-ssh-nodeport` in `forgejo` namespace)
---