WP-0005 T12: Option A — keep Gitea fallback, 30-day window
Operator decision: retain coulombcore Gitea Helm as read-only fallback with a 30-day rollback window (2026-07-08 → 2026-08-07). Mark T12 done; update rollback runbook and retirement checklist.
This commit is contained in:
parent
040ccccc8e
commit
1404e56c0e
3 changed files with 75 additions and 85 deletions
|
|
@ -1,8 +1,9 @@
|
|||
# Forgejo Cutover Rollback Runbook
|
||||
|
||||
Date: 2026-07-08
|
||||
Workplan: `RAIL-HO-WP-0005-T11`
|
||||
Canon: `the-custodian/docs/forgejo-tier3-remote-url-sweep-playbook.md`
|
||||
Date: 2026-07-09
|
||||
Workplan: `RAIL-HO-WP-0005-T11` / `T12`
|
||||
Canon: `the-custodian/docs/forgejo-tier3-remote-url-sweep-playbook.md`,
|
||||
`the-custodian/docs/forgejo-production-decisions.md` § T12
|
||||
|
||||
## Current production state (post-T11)
|
||||
|
||||
|
|
@ -13,8 +14,10 @@ Canon: `the-custodian/docs/forgejo-tier3-remote-url-sweep-playbook.md`
|
|||
| Workstation `origin` | `forgejo-remote:coulomb/<slug>.git` | `gitea` legacy remote retained |
|
||||
| ArgoCD (coulombcore) | `https://forgejo.coulomb.social/coulomb/*.git` | Gitea URLs in AppProject allow-list for emergency |
|
||||
|
||||
Gitea safety contract: **no repo deletes** for ≥90 days after promotion. Archived
|
||||
repos remain cloneable; pushes are rejected.
|
||||
Gitea safety contract (T12 Option A, 2026-07-09): **no repo deletes** for **30 days**
|
||||
after cutover (2026-07-08 → rollback window ends **2026-08-07**). coulombcore
|
||||
Gitea Helm retained as read-only fallback. Archived repos remain cloneable; pushes
|
||||
are rejected. Revisit Helm retirement after **2026-08-07**.
|
||||
|
||||
## Per-repo git rollback
|
||||
|
||||
|
|
|
|||
|
|
@ -1,22 +1,32 @@
|
|||
# Gitea Retirement Checklist (T12 prep)
|
||||
# Gitea Retirement Checklist (T12)
|
||||
|
||||
Date: 2026-07-09
|
||||
Workplan: `RAIL-HO-WP-0005-T12`
|
||||
Status: **prep only** — no Gitea retirement executed
|
||||
Status: **Option A decided** — Gitea retained as read-only fallback
|
||||
|
||||
## Prerequisites (not yet met)
|
||||
## Operator decision (2026-07-09)
|
||||
|
||||
| Gate | Status | ETA |
|
||||
| --- | --- | --- |
|
||||
| T04/T09 7-day backup gate | **4/7** (`make forgejo-backup-status`) | **2026-07-12** if daily 02:15 UTC cron keeps succeeding |
|
||||
| `state-hub` stabilization window | Ends **2026-07-09** | Met |
|
||||
| Operator approval (`needs_human`) | Pending | Required before any Helm teardown |
|
||||
**Option A:** Keep coulombcore `gitea` Helm running as documented read-only fallback.
|
||||
|
||||
Monitor:
|
||||
| Parameter | Value |
|
||||
| --- | --- |
|
||||
| Rollback window | **30 days** from cutover (2026-07-08 → **2026-08-07**) |
|
||||
| Gitea repo deletes | Forbidden until **2026-08-07** |
|
||||
| Helm retirement revisit | After **2026-08-07** (Option B reassessment) |
|
||||
| Canon | `the-custodian/docs/forgejo-production-decisions.md` § T12 |
|
||||
|
||||
## Prerequisites
|
||||
|
||||
| Gate | Status |
|
||||
| --- | --- |
|
||||
| T04/T09 7-day backup gate | **4/7** (ETA **2026-07-12**) — does not block T12 Option A |
|
||||
| `state-hub` stabilization window | Met (closed 2026-07-09) |
|
||||
| Operator approval (`needs_human`) | **Met** — Option A, 30-day window |
|
||||
|
||||
Monitor backup gate:
|
||||
|
||||
```bash
|
||||
cd ~/railiance-platform && make forgejo-backup-status
|
||||
tail -5 ~/.cache/railiance/backups/forgejo/cron.log
|
||||
```
|
||||
|
||||
## Dependency scan (2026-07-09)
|
||||
|
|
@ -29,76 +39,44 @@ tail -5 ~/.cache/railiance/backups/forgejo/cron.log
|
|||
| Workstation `origin` using `gitea-remote` | **0** (legacy `gitea` remotes retained for rollback only) |
|
||||
| Forgejo Actions workflows referencing `gitea-remote` | **0** |
|
||||
|
||||
### Gitea still running (intentional fallback)
|
||||
### Gitea retained intentionally
|
||||
|
||||
| Host | Release | Namespace | Notes |
|
||||
| --- | --- | --- | --- |
|
||||
| coulombcore (`~/.kube/config`) | `gitea` Helm 12.5.0 | `default` | Archived read-only repos; package push disabled |
|
||||
| coulombcore (`~/.kube/config`) | `gitea` Helm 12.5.0 | `default` | Read-only fallback through **2026-08-07** |
|
||||
| railiance01 (`config-hosteurope`) | `forgejo` Helm 12.5.0 | `forgejo` | Production canonical |
|
||||
|
||||
Rollback runbook: `docs/forgejo-cutover-rollback.md` (90-day no-delete contract).
|
||||
Rollback runbook: `docs/forgejo-cutover-rollback.md` (30-day no-delete contract).
|
||||
|
||||
### Stale references — docs/config, not live git remotes
|
||||
|
||||
These do **not** block Forgejo operation but should be cleaned before or during
|
||||
Gitea retirement:
|
||||
### Follow-up backlog (non-blocking for T12 Option A)
|
||||
|
||||
| Area | Examples | Owner repo |
|
||||
| --- | --- | --- |
|
||||
| OCI image repos in Helm values | `gitea.coulomb.social/coulomb/inter-hub`, `reuse-surface`, `vergabe-teilnahme` | `railiance-apps` |
|
||||
| OCI image repos in Helm values | `gitea.coulomb.social/coulomb/inter-hub`, etc. | `railiance-apps` |
|
||||
| npm registry URLs | `gitea.coulomb.social/api/packages/coulomb/npm/` | `secrets-engine`, `activity-core` |
|
||||
| Ops inventory endpoint | `activity-core/k8s/railiance/20-runtime.yaml` | `activity-core` |
|
||||
| Deploy runbook | `docs/deploy-stack.md` (this repo) | `railiance-infra` — updated 2026-07-09 |
|
||||
| State Hub alias | `railiance-bootstrap` vs `railiance-cluster` (same fingerprint) | operator / State Hub |
|
||||
|
||||
### State Hub alias: `railiance-bootstrap`
|
||||
## T12 checklist
|
||||
|
||||
| Field | `railiance-bootstrap` | `railiance-cluster` |
|
||||
| --- | --- | --- |
|
||||
| `local_path` | `/home/worsch/railiance-bootstrap` | `/home/worsch/railiance-cluster` |
|
||||
| `remote_url` | `forgejo-remote:coulomb/railiance-bootstrap.git` | `forgejo-remote:coulomb/railiance-cluster.git` |
|
||||
| `git_fingerprint` | `6b930728…` (same) | `6b930728…` (same) |
|
||||
- [x] Operator chooses **Option A** (30-day rollback window)
|
||||
- [x] No active remotes/webhooks/dashboards on Gitea (re-verified 2026-07-09)
|
||||
- [x] Runbooks point to Forgejo (`deploy-stack.md` updated 2026-07-09)
|
||||
- [x] Gitea intentionally retained — coulombcore Helm stays running
|
||||
- [ ] T04/T09 7-day gate **7/7** (workplan close gate; ETA 2026-07-12)
|
||||
- [ ] Final Gitea volume snapshot catalogued (recommended before 2026-08-07)
|
||||
- [ ] `railiance-bootstrap` hub alias resolved (follow-up)
|
||||
- [ ] Stale OCI/npm references migrated to `forgejo.coulomb.social` (follow-up)
|
||||
- [ ] After **2026-08-07**: reassess Option B (Helm retirement)
|
||||
|
||||
Working assumption confirmed: stale logical alias. T12 action: operator decides
|
||||
whether to archive the hub entry or repoint `local_path` to `railiance-cluster`
|
||||
after confirming no checkout depends on `/home/worsch/railiance-bootstrap`.
|
||||
## Option B (deferred)
|
||||
|
||||
## Operator decision
|
||||
|
||||
Choose one before executing T12:
|
||||
|
||||
### Option A — Keep Gitea as documented fallback (recommended until 2026-10-08)
|
||||
|
||||
- Leave coulombcore `gitea` Helm release running.
|
||||
- Document in runbooks: read-only archive, no new pushes.
|
||||
- Revisit retirement after 90-day rollback window.
|
||||
- **T12 done when:** Forgejo is sole *active* forge; Gitea retained intentionally.
|
||||
|
||||
### Option B — Retire Gitea Helm release
|
||||
|
||||
Only after prerequisites + explicit approval:
|
||||
|
||||
1. Re-run dependency scan (State Hub remotes, ArgoCD `repoURL`, CI workflows).
|
||||
2. Take final Gitea backup (`forgejo dump` equivalent via Gitea admin or volume snapshot).
|
||||
3. Export archived repo list for audit.
|
||||
4. Scale down or uninstall `gitea` Helm on coulombcore.
|
||||
5. Update `docs/forgejo-cutover-rollback.md` — rollback becomes volume-restore only.
|
||||
6. Prune DNS/ingress if no longer needed.
|
||||
|
||||
## T12 task checklist
|
||||
|
||||
- [ ] T04/T09 7-day gate **7/7**
|
||||
- [ ] Operator chooses Option A or B
|
||||
- [ ] Final Gitea backup captured and catalogued
|
||||
- [ ] No active remotes/webhooks/dashboards on Gitea (re-verify)
|
||||
- [ ] Runbooks point to Forgejo (`deploy-stack.md`, layer repo docs)
|
||||
- [ ] `railiance-bootstrap` hub alias resolved
|
||||
- [ ] Stale OCI/npm references migrated to `forgejo.coulomb.social` (follow-up workplans in `railiance-apps`, `activity-core`)
|
||||
- [ ] If Option B: Gitea Helm retired; evidence logged to State Hub
|
||||
Helm retirement deferred until after the 30-day rollback window. See prior
|
||||
version of this checklist for Option B steps if reassessment proceeds.
|
||||
|
||||
## References
|
||||
|
||||
- `workplans/RAIL-HO-WP-0005-forgejo-production-migration.md`
|
||||
- `docs/forgejo-cutover-rollback.md`
|
||||
- `docs/forgejo-migration-inventory.md`
|
||||
- `railiance-platform/docs/forgejo-backup.md`
|
||||
- `the-custodian/tools/gitea-set-readonly.sh`
|
||||
- `the-custodian/docs/forgejo-production-decisions.md`
|
||||
|
|
@ -77,6 +77,11 @@ change is made there.
|
|||
6. ~~Cutover mode~~ **DECIDED 2026-07-09 (Option A):** staged per-repo promotion
|
||||
(no org-wide freeze). Freeze-all documented as emergency fallback only. Record:
|
||||
`the-custodian/docs/forgejo-production-decisions.md` § Cutover.
|
||||
7. ~~Gitea retirement (T12)~~ **DECIDED 2026-07-09 (Option A):** keep coulombcore
|
||||
Gitea Helm as read-only fallback; **30-day** rollback window (cutover 2026-07-08
|
||||
→ ends **2026-08-07**). Revisit Helm retirement after window. Record:
|
||||
`the-custodian/docs/forgejo-production-decisions.md` § T12,
|
||||
`docs/forgejo-gitea-retirement-checklist.md`.
|
||||
|
||||
## Safety Contract
|
||||
|
||||
|
|
@ -577,31 +582,35 @@ read-only fallback, and rollback instructions are documented. **Met.**
|
|||
|
||||
```task
|
||||
id: RAIL-HO-WP-0005-T12
|
||||
status: todo
|
||||
status: done
|
||||
priority: medium
|
||||
needs_human: true
|
||||
needs_human: false
|
||||
state_hub_task_id: "a63147b0-31d5-4705-89ea-40c10faf779f"
|
||||
```
|
||||
|
||||
Retire legacy Gitea only after a stabilization period and explicit approval.
|
||||
|
||||
**Prep (2026-07-09):** dependency scan complete — State Hub **0 Gitea remotes**,
|
||||
workstation **0 `gitea-remote` origins**; coulombcore `gitea` Helm still running
|
||||
as read-only fallback. Checklist: `docs/forgejo-gitea-retirement-checklist.md`.
|
||||
Operator must choose: **Option A** keep fallback (recommended until 90-day
|
||||
rollback window) or **Option B** retire Helm release.
|
||||
**Done (2026-07-09):** Operator chose **Option A** — keep coulombcore `gitea`
|
||||
Helm as read-only fallback (no Helm teardown). **30-day** rollback window from
|
||||
cutover (2026-07-08 → **2026-08-07**); no Gitea repo deletes before window end.
|
||||
Revisit Option B (Helm retirement) after **2026-08-07**.
|
||||
|
||||
Minimum scope:
|
||||
Evidence:
|
||||
|
||||
- Confirm no active remotes, webhooks, packages, or dashboards depend on Gitea.
|
||||
- Preserve final Gitea backup.
|
||||
- Update runbooks and dashboards from Gitea to Forgejo.
|
||||
- Remove or archive Gitea Helm release according to the rollback decision.
|
||||
- Close stale State Hub references to `railiance-bootstrap` if confirmed as
|
||||
an alias rather than a real repo.
|
||||
- Dependency scan: State Hub **0 Gitea remotes**; workstation **0 `gitea-remote`
|
||||
origins** (2026-07-09).
|
||||
- Gitea org **79/79 archived**; package push disabled (T11).
|
||||
- Runbooks updated: `docs/deploy-stack.md`, `docs/forgejo-cutover-rollback.md`.
|
||||
- Checklist: `docs/forgejo-gitea-retirement-checklist.md`.
|
||||
- Canon: `the-custodian/docs/forgejo-production-decisions.md` § T12.
|
||||
|
||||
Follow-up (non-blocking): final Gitea volume snapshot before 2026-08-07;
|
||||
`railiance-bootstrap` hub alias; stale OCI/npm refs in `railiance-apps` /
|
||||
`activity-core`.
|
||||
|
||||
**Done when:** Forgejo is the only active source forge and package base, with
|
||||
legacy Gitea either archived or intentionally retained as documented fallback.
|
||||
**Met** — Gitea retained intentionally per Option A.
|
||||
|
||||
## Phasing and Dependencies
|
||||
|
||||
|
|
@ -623,10 +632,10 @@ T05+T08 ──► T10 migration ladder ──► T11 production cutover ──
|
|||
T03 isolated probe: CANCELLED (superseded by T05 + in-production pilots)
|
||||
```
|
||||
|
||||
**Current focus (2026-07-09):** T01/T05/T06/T07/T08/T10/T11 **done**; T04/T09
|
||||
await 7-day backup gate (**4/7**, ETA **2026-07-12**). T12 prep complete —
|
||||
operator decision pending (retire vs keep fallback). `state-hub` stabilization
|
||||
window closed 2026-07-09.
|
||||
**Current focus (2026-07-09):** T01/T02/T05–T08/T10–T12 **done**; T04/T09 await
|
||||
7-day backup gate (**4/7**, ETA **2026-07-12**). T12 **Option A** — Gitea kept as
|
||||
read-only fallback; **30-day** rollback window ends **2026-08-07**. Workplan
|
||||
closes when T04/T09 gate passes.
|
||||
|
||||
**Absorbed by `CUST-WP-0054-T04`:** forge + CI on railiance01; workstation
|
||||
build retirement; staged repo promotion before State Hub primary move (T05).
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue