Route the laboratory through PVE ingress

ClaudiuSchuster commented

2026-10-13 17:38:39 +00:00

Owner

The Laboratory now runs behind the regional load balancer and a separate PVE ingress. Keep TLS on ingress1001 and route HTTP to the private backend on VM1002. The PVE overlay requires five exact image selectors, binds Git SSH to the private guest address, and is always applied last so ordinary service updates retain the accepted runtime and network bindings.

The operating guide records the current deployment, complete Compose command, separate runner on VM1005, backup/rollback boundaries and ingress-owned TLS. Historical bootstrap and downgrade recipes are explicitly marked as historical.

Validation:

Native Caddy/Compose validation and the full isolated scripts/e2e-local.sh suite passed on VM1005 for runtime commit b260a33ff995205d773c23b019c0e3117e988d55; later changes are documentation only.
Required CI passed for exact final head 50fd3391f635eb95d9703c970897bc853af1f8bc in run277. Merging the current main into the branch changed only ancestry; the reviewed tree is unchanged. The preceding run275 was independently bound to the migrated runner8 through its actual task record.
Independent source review and follow-up operating-command review completed; documented corrections received shell-block and diff checks.
The public cutover has verified HTTP/TLS, API, HTTPS/SSH Git, authenticated MQTT/WSS, MCP reads and a complete first PVE offsite backup.

Old application/database writers remain fenced. Rollback after new writes requires reconciliation. The production browser automation client blocked navigation; native production protocol checks and the earlier isolated browser rehearsal are separate evidence. This PR does not claim zero-downtime guest or host upgrades.

The Laboratory now runs behind the regional load balancer and a separate PVE ingress. Keep TLS on ingress1001 and route HTTP to the private backend on VM1002. The PVE overlay requires five exact image selectors, binds Git SSH to the private guest address, and is always applied last so ordinary service updates retain the accepted runtime and network bindings. The operating guide records the current deployment, complete Compose command, separate runner on VM1005, backup/rollback boundaries and ingress-owned TLS. Historical bootstrap and downgrade recipes are explicitly marked as historical. Validation: - Native Caddy/Compose validation and the full isolated `scripts/e2e-local.sh` suite passed on VM1005 for runtime commit `b260a33ff995205d773c23b019c0e3117e988d55`; later changes are documentation only. - Required CI passed for exact final head `50fd3391f635eb95d9703c970897bc853af1f8bc` in run277. Merging the current main into the branch changed only ancestry; the reviewed tree is unchanged. The preceding run275 was independently bound to the migrated runner8 through its actual task record. - Independent source review and follow-up operating-command review completed; documented corrections received shell-block and diff checks. - The public cutover has verified HTTP/TLS, API, HTTPS/SSH Git, authenticated MQTT/WSS, MCP reads and a complete first PVE offsite backup. Old application/database writers remain fenced. Rollback after new writes requires reconciliation. The production browser automation client blocked navigation; native production protocol checks and the earlier isolated browser rehearsal are separate evidence. This PR does not claim zero-downtime guest or host upgrades.

ClaudiuSchuster added 5 commits

2026-10-13 17:38:39 +00:00

docs: record safe evacuation of historical backup archives

ci / ci (pull_request) Successful in 1m5s

Details Explain this check

edb7cd4681

Support a trusted private Caddy backend for PVE ingress a961b247b7

Pin PVE service images and restrict Forgejo SSH binding b260a33ff9

Require approved image selectors for every PVE service and apply the PVE overlay last. Keep Forgejo SSH private on backend1002 with advertised port 2222.

Validated exact source with native Compose 2.26.1-4, Caddy 2.11.4 and the full isolated VM1005 e2e gate, including verified teardown.

Document access validation and client integration requirements 68259ec00c

Record current coverage gaps and the owner-requested source, synthetic release and real-route access checks. Plan ZCode against the existing plugin gateway and identity contract while preserving contribution intake and manual migration proofs.

Retain the separate later Ethereum/PulseChain request with scope open. Documentation-only validation: source review, local Markdown links, unchanged received PR table and staged whitespace check.

Document the live PVE cutover and operating boundaries

ci / ci (pull_request) Successful in 25s

Details Explain this check

63edf1f1ea

ClaudiuSchuster added 1 commit

2026-10-13 18:02:31 +00:00

Correct PVE operating commands and mark legacy bootstrap

ci / ci (pull_request) Successful in 23s

Details Explain this check

eed7ba3a4c

ClaudiuSchuster changed title from ~~WIP: Route the laboratory through PVE ingress~~ to Route the laboratory through PVE ingress

2026-10-13 18:14:36 +00:00