vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(albok-service): 0.1.24 (unit 6 encrypted-wing deferral) + personal/sealed wing in albok.yaml

Browse Source
This commit is contained in:
vh
2026-10-16 09:18:28 -07:00
parent 76e7a76ad9
commit 507d62d62a
4 changed files with 18 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stacks/albok-service/README.md
+11 -4
View File
@@ -8,7 +8,14 @@ The FastAPI process that owns Albok's buildings-and-wings store (`vh/albok`,
(`servers/nh3-albok/README.md` says why and what must never be added there). Before that: nh3-docker, 2026-10-02 to 2026-10-04.
- **URL:** `http://albok.nh3.internal:8392` (= `http://10.100.50.44:8392`). Container port 8390.
Host port **8392** is kept from nh3-docker, where 8390 was the althing post office, so no client changed.
- **Image:** `gitea.phasefinal.com/pfi/albok-service:0.1.14` @ `sha256:01b46f64…` since 2026-10-07 1804 (healthy 1804:35,
- **Image (current):** `gitea.phasefinal.com/pfi/albok-service:0.1.24` @ `sha256:75be71c1…` since 2026-10-16 0917
(healthy 0918:04, `/health` 8 wings ready). infra-ops deployed it at albok-dev's ask (althing thread `01M52KF3VM9S3K22A7TWV4DC4A`),
built from a clean archive of vh/albok `67eabb7` (albok-service 0.1.24, albok 0.1.12). This is unit 6: a locked encrypted wing's
journal entries are deferred rather than driven into the unmounted mountpoint; accept-head replays them. It shipped with the
`personal/sealed` stanza in `albok.yaml`. **Rollback:** `compose.yaml.pre-0.1.24` (0.1.23) on the same store, but put back
`/srv/albok/etc/albok.yaml.pre-0.1.24` (no sealed stanza) FIRST: 0.1.23 drives a locked wing's journal entry into the
immutable mountpoint and fails to start. Releases 0.1.15 to 0.1.23 are not recorded in this README; see git log.
- **Earlier image:** `gitea.phasefinal.com/pfi/albok-service:0.1.14` @ `sha256:01b46f64…` since 2026-10-07 1804 (healthy 1804:35,
after the 1803 walk). infra-ops deployed it at albok-dev's ask (althing 8524), from a clean archive of vh/albok `7ae0d2a6`
(tag albok-service/v0.1.14). This is unit 4.3, with three additions:
- `GET .../sidecars`, a batch sidecar listing. Over 5,000 rows or 8 MiB it answers 413.
@@ -188,9 +195,9 @@ may mount the store read-write.
## Sealed (encrypted) wings: unit 6 (2026-10-16)
The first is `personal/sealed`: restricted, default-deny, gid **1513 `albok-sealed`**. It is empty, has no Nemi source,
and what goes in it is Prime's call. albok-dev provisioned it on Prime's goal "land all of u6". **It is not yet in
`albok.yaml`**: albok-dev sends that stanza with the release that carries the encrypted-wing replay fix. Until then the
service ignores the mount.
and what goes in it is Prime's call. albok-dev provisioned it on Prime's goal "land all of u6". **It is in
`albok.yaml` since 0.1.24 (2026-10-16 0917)**; the first start with it configured and mounted created `store/` and
`private/` under the mount.
| | |
|---|---|