feat(albok-service): 0.1.24 (unit 6 encrypted-wing deferral) + personal/sealed wing in albok.yaml

2026-10-16 09:18:28 -07:00
parent 76e7a76ad9
commit 507d62d62a
4 changed files with 18 additions and 7 deletions
@@ -8,7 +8,14 @@ The FastAPI process that owns Albok's buildings-and-wings store (`vh/albok`,
  (`servers/nh3-albok/README.md` says why and what must never be added there). Before that: nh3-docker, 2026-10-02 to 2026-10-04.
 - **URL:** `http://albok.nh3.internal:8392` (= `http://10.100.50.44:8392`). Container port 8390.
  Host port **8392** is kept from nh3-docker, where 8390 was the althing post office, so no client changed.
- **Image:** `gitea.phasefinal.com/pfi/albok-service:0.1.14` @ `sha256:01b46f64…` since 2026-10-07 1804 (healthy 1804:35,
+- **Image (current):** `gitea.phasefinal.com/pfi/albok-service:0.1.24` @ `sha256:75be71c1…` since 2026-10-16 0917
+  (healthy 0918:04, `/health` 8 wings ready). infra-ops deployed it at albok-dev's ask (althing thread `01M52KF3VM9S3K22A7TWV4DC4A`),
+  built from a clean archive of vh/albok `67eabb7` (albok-service 0.1.24, albok 0.1.12). This is unit 6: a locked encrypted wing's
+  journal entries are deferred rather than driven into the unmounted mountpoint; accept-head replays them. It shipped with the
+  `personal/sealed` stanza in `albok.yaml`. **Rollback:** `compose.yaml.pre-0.1.24` (0.1.23) on the same store, but put back
+  `/srv/albok/etc/albok.yaml.pre-0.1.24` (no sealed stanza) FIRST: 0.1.23 drives a locked wing's journal entry into the
+  immutable mountpoint and fails to start. Releases 0.1.15 to 0.1.23 are not recorded in this README; see git log.
+- **Earlier image:** `gitea.phasefinal.com/pfi/albok-service:0.1.14` @ `sha256:01b46f64…` since 2026-10-07 1804 (healthy 1804:35,
  after the 1803 walk). infra-ops deployed it at albok-dev's ask (althing 8524), from a clean archive of vh/albok `7ae0d2a6`
  (tag albok-service/v0.1.14). This is unit 4.3, with three additions:
  - `GET .../sidecars`, a batch sidecar listing. Over 5,000 rows or 8 MiB it answers 413.
@@ -188,9 +195,9 @@ may mount the store read-write.
 ## Sealed (encrypted) wings: unit 6 (2026-10-16)

 The first is `personal/sealed`: restricted, default-deny, gid **1513 `albok-sealed`**. It is empty, has no Nemi source,
-and what goes in it is Prime's call. albok-dev provisioned it on Prime's goal "land all of u6". **It is not yet in
-`albok.yaml`**: albok-dev sends that stanza with the release that carries the encrypted-wing replay fix. Until then the
-service ignores the mount.
+and what goes in it is Prime's call. albok-dev provisioned it on Prime's goal "land all of u6". **It is in
+`albok.yaml` since 0.1.24 (2026-10-16 0917)**; the first start with it configured and mounted created `store/` and
+`private/` under the mount.

 | | |
 |---|---|
@@ -16,7 +16,7 @@
 #   1513 albok-sealed (encrypted wing personal/sealed, unit 6) likewise; its plaintext exists only while unlocked.
 services:
  albok-service:
-    image: gitea.phasefinal.com/pfi/albok-service:0.1.23@sha256:026de87f3ca3907e9eb0a2a2489a7507f69f9f0eca50e8e8be3fcfcb36a03de3
+    image: gitea.phasefinal.com/pfi/albok-service:0.1.24@sha256:75be71c1b939dbb050495e6f604a10950bc7dbda0811a5a9e8c6aedc40c48efb
    container_name: albok-service
    restart: unless-stopped
    ports:
@@ -35,7 +35,7 @@ listen:
  port: 8390                          # container port; published on the host as 8392 (8390 is the post office)

 # First instance, per albok-dev's ask (2026-10-02): fleet/{memory,stash}, personal/notes.
-# 2026-10-03: + personal/agent-feedback (restricted, gid 1512). The vault wing comes later (gid 1513+).
+# 2026-10-03: + personal/agent-feedback (restricted, gid 1512). 2026-10-16: + personal/sealed (unit 6, encrypted, gid 1513; albok-service 0.1.24+).
 buildings:
  - id: fleet
    default_group: albok-read         # host gid 1510
@@ -53,6 +53,10 @@ buildings:
      - id: agent-feedback            # auto-memory (Nemi's third source); restricted, default-deny (2026-10-03)
        restricted: true
        group: albok-feedback         # host gid 1512
+      - id: sealed                    # unit 6: the first encrypted wing (LUKS2 /srv/albok/luks/personal.sealed.img; key vault albok/wing-key-personal-sealed)
+        restricted: true
+        group: albok-sealed           # host gid 1513
+        encrypted_mount: /srv/albok/sealed/personal.sealed
  - id: library                       # unit 4.5 (Nemi books), albok-dev ask 2026-10-09: epubs from nh3-dev ~/library
    default_group: albok-read         # host gid 1510, readable like fleet; neither wing restricted, no encrypted mount
    wings: