memory: wgtunnel Phase-0 DNS landed + infra-ops now holds fleet Cloudflare DNS-edit token
boring.phasefinal.com CNAME -> ana-srv1 (DNS-only) published + verified; unblocks the wstunnel ACME cert. Operator handed over an all-zones Zone:DNS:Edit token, now vaulted at nh3-dev/.config/cloudflare/infra-ops-dns-token — fleet DNS is self-serve.
This commit is contained in:
@@ -111,7 +111,7 @@ no longer deployed sidecars here. See Recent decisions.)
|
||||
|
||||
_As of 2026-08-12 — the secrets-broker + stonehenge-park work LANDED (detail in Recent decisions). **wgtunnel** moved OUT to its own repo (pre-seeded, verification done)._
|
||||
|
||||
- **⟳ wgtunnel — OWN REPO STOOD UP (`vh/wgtunnel`, private, pushed 2026-08-12); design not started.** A WireGuard tunnel that comes up on a plane's captive-portal wifi (blocks UDP, only TCP/443 after portal → needs WG-over-TCP/443 obfuscation + captive-portal handling). Endpoint infra **verified live** this session: WG server = `ana-wg` **UDP/31337** (subnet 10.30.10.0/24, MTU 1420, public UDP DNAT already works); public TLS edge = **traefik on ana-docker** (terminates TLS :443, ACME `anaprod`, docker+file providers, CrowdSec bouncer); edge IP `38.120.12.44` (direct A). Working architecture = **wstunnel WSS/443 behind traefik → ana-wg:31337** (starting hypothesis). Ground truth in `~/development/wgtunnel/docs/verified-infrastructure.md`. **NEXT: `/vor-plan` (multi-unit) or `/vor` — operator's call, interactive.** Do wgtunnel work in that repo, not here.
|
||||
- **⟳ wgtunnel — OWN REPO (`vh/wgtunnel`, private); `/vor-plan` DONE, build underway by `tunnel-dev`.** WireGuard-over-wstunnel WSS/443 tunnel for captive-portal/DPI networks (plane, hotel, DPI firewall); design bundle in the repo's `docs/design/`. Host = **`boring.phasefinal.com`** (innocuous SNI, operator's call). Endpoint verified: `ana-wg` UDP/31337, traefik on ana-docker terminates TLS :443, edge `38.120.12.44`. **Phase-0 DNS DONE 2026-08-12** — `boring` CNAME → `ana-srv1` (DNS-only) published + verified (resolves 38.120.12.44 both authoritative NS + 1.1.1.1); wstunnel ACME can proceed once Unit 1 deploys. infra-ops role = infra + DNS; the build lives in `~/development/wgtunnel` (tunnel-dev's session), not here.
|
||||
|
||||
- **SECRETS-BROKER — LIVE.** Per-box credential store over Vaultwarden; the `secret` CLI (`put/get/list/rm/backfill`) on PATH at `~/.local/bin/secret`, 25 nh3-dev secrets backfilled + verified. Standing directive now global: **vault is the credential source of truth — store in it AND `secret get` creds FROM it.** Detail → Recent decisions `[2026-08-10→12]`.
|
||||
|
||||
@@ -138,6 +138,8 @@ _As of 2026-08-12 — the secrets-broker + stonehenge-park work LANDED (detail i
|
||||
|
||||
## Recent decisions
|
||||
|
||||
- `[2026-08-12]` **infra-ops now holds an all-zones Cloudflare DNS-edit token (vaulted) + wgtunnel Phase-0 DNS landed.** Operator handed over a `Zone·DNS·Edit` (all zones) CF token → `secret put nh3-dev/.config/cloudflare/infra-ops-dns-token` (round-trip verified; /tmp drop shredded). Fleet DNS is now self-serve for infra-ops (⚠ HIGH blast radius — all zones). First use: created `boring.phasefinal.com` CNAME → `ana-srv1.phasefinal.com`, **DNS-only** (proxied:false), verified resolving to 38.120.12.44 on both authoritative NS (louis/wren) + 1.1.1.1 — NOT Cloudflare-proxied. Unblocks wgtunnel's wstunnel ACME cert. phasefinal.com zone id `f812ba74ed9a75cf21bbe7ce9188db50`. auto-memory `reference_infra_ops_cloudflare_dns_token`. (Earlier gap: the only prior vaulted CF token, jackdaw's, had `zone:read`+`worker:edit` but no `dns_records:edit`.)
|
||||
|
||||
- `[2026-08-12]` **wgtunnel stood up as its own repo (`vh/wgtunnel`, private) after a live endpoint-verification pass.** Operator directed own-repo (mirrors stonehenge-park/tts-stack). Verified off the fleet before seeding: `ana-wg` WG server = **UDP/31337** (not 51820), subnet 10.30.10.0/24, MTU 1420, active roaming peer proves the public UDP DNAT works; traefik on ana-docker **terminates TLS :443** (ACME `anaprod` http-challenge, docker+file providers, CrowdSec bouncer) → confirms the clean design (wstunnel container on `traefik-net`, Host-routed, WS→UDP to `ana-wg:31337`); edge `38.120.12.44` direct-A, `tunnel.phasefinal.com` free (⚠ must be **direct**, NOT Cloudflare-proxied like vaultwarden). Repo pre-seeded (README/CLAUDE/persistent-memory/ROADMAP + `docs/verified-infrastructure.md` = ground truth) + pushed; commit `9584d38`, Vuong-attributed. vh gitea token pulled from the vault (`secret get`), not persisted to `.git/config`. **NEXT = `/vor-plan` or `/vor` (operator's call, interactive).** Deps to line up in the plan: DNS A-record, FortiGate :443 host-routing, a new ana-wg peer for the laptop, client tooling.
|
||||
|
||||
- `[2026-08-10→12]` **secrets-broker: per-box Vaultwarden credential store SHIPPED + consumer-confirmed.** `secret` CLI (`put/get/list/rm/backfill`, bw-backed) on `~/.local/bin`; 25 nh3-dev secrets backfilled + round-trip-verified; `rm` + new-namespace warning added post-launch; standing "vault is the credential source of truth" directive now global. → `persistent-memory.d/2026-08-12-secrets-broker.md`
|
||||
|
||||
Reference in New Issue
Block a user