diff --git a/configs/fv-ml1-sol/fv-ml1-sol-logger.service b/configs/fv-ml1-sol/fv-ml1-sol-logger.service new file mode 100644 index 0000000..f38cfa3 --- /dev/null +++ b/configs/fv-ml1-sol/fv-ml1-sol-logger.service @@ -0,0 +1,22 @@ +# eshpfi configs/fv-ml1-sol/ (infra-ops, 2026-10-11, Prime: "stage the evidence capture"): a USER unit of lkraven on +# nh3-dev that holds fv-ml1's BMC Serial-over-LAN session and writes everything to the journal +# (`journalctl --user -u fv-ml1-sol-logger`). fv-ml1's kernel prints to ttyS1 = the SOL port (marker-tested) from its +# next boot (ZFSBootMenu `org.zfsbootmenu:commandline` on zroot/ROOT: `console=ttyS1,115200n8 console=tty0`), so a +# hang's last kernel lines land here. SOL is live-only (the BMC keeps no history), which is why something must hold it. +# A human who needs SOL wins: `ipmitool ... sol deactivate` kicks this session, and it retries every 60 s without +# deactivating anyone (no ExecStartPre deactivate on purpose). Password: ~/.config/fv-ml1-sol/bmc.env (0600, +# IPMI_PASSWORD, vault ana-ml2/bmc-infra-ops), never on a command line. +[Unit] +Description=fv-ml1 serial console logger (BMC SOL -> journal) +After=network-online.target +[Service] +Type=simple +EnvironmentFile=%h/.config/fv-ml1-sol/bmc.env +ExecStart=/bin/sh -c 'sleep infinity | exec /usr/bin/ipmitool -I lanplus -H 10.251.250.50 -U infra-ops -E sol activate usesolkeepalive' +StandardOutput=journal +StandardError=journal +SyslogIdentifier=fv-ml1-sol +Restart=always +RestartSec=60 +[Install] +WantedBy=default.target diff --git a/configs/svos-apps/nh3-dev/svos-agent.service b/configs/svos-apps/nh3-dev/svos-agent.service new file mode 100644 index 0000000..8f373dd --- /dev/null +++ b/configs/svos-apps/nh3-dev/svos-agent.service @@ -0,0 +1,22 @@ +# eshpfi configs/svos-apps/nh3-dev/ (infra-ops, U13 2026-10-11): Miranda's agent connector (persona miranda), loopback +# only; the gateway's svos plugin calls it at connector_url http://127.0.0.1:8407 with the shared Bifrost key. +# FIRST start only: /etc/svos/env/agent-enroll.env carries SVOS_AGENT_ENROLL_SECRET; the connector enrolls, writes +# /etc/svos/miranda/agent.credential (0600) and refuses to start while both exist, so delete the enroll file after. +[Unit] +Description=SVOS agent connector for Miranda (svos-agent) +[Service] +Type=simple +UMask=0077 +Restart=on-failure +RestartSec=3 +TimeoutStopSec=20 +WorkingDirectory=/etc/svos/miranda +EnvironmentFile=-/etc/svos/env/agent-enroll.env +Environment=SVOS_AGENT_CONFIG=/etc/svos/miranda/agent.toml +Environment=SVOS_AGENT_LISTEN=127.0.0.1:8407 +Environment=SVOS_KERNEL_URL=https://svos-kernel.phasefinal.com +Environment=SVOS_BIFROST_KEY_FILE=/etc/svos/miranda/bifrost.key +Environment=SVOS_AGENT_CREDENTIAL_FILE=/etc/svos/miranda/agent.credential +ExecStart=/opt/svos/current/apps-env/bin/svos-agent +[Install] +WantedBy=default.target diff --git a/configs/svos-apps/nh3-dev/svos-miranda.service b/configs/svos-apps/nh3-dev/svos-miranda.service new file mode 100644 index 0000000..5933fa4 --- /dev/null +++ b/configs/svos-apps/nh3-dev/svos-miranda.service @@ -0,0 +1,21 @@ +# eshpfi configs/svos-apps/nh3-dev/ (infra-ops, U13 2026-10-11): app-miranda beside the Hermes gateway it calls on +# loopback (:8765). Reached by the kernel through https://svos-miranda.nh3.phasefinal.com (fleet Caddy -> :8408). +# Credential /etc/svos/env/miranda.env (vault nh3-svos/svos-miranda-credential, from enrolling app-miranda). +[Unit] +Description=SVOS Miranda (app-miranda, U9a/U11) +ConditionPathExists=/etc/svos/env/miranda.env +[Service] +Type=simple +UMask=0077 +Restart=on-failure +RestartSec=3 +TimeoutStopSec=20 +WorkingDirectory=/var/lib/svos/apps/miranda +EnvironmentFile=/etc/svos/env/miranda.env +Environment=SVOS_MIRANDA_CONFIG=/etc/svos/miranda/miranda.toml +Environment=SVOS_DATA_ROOT=/var/lib/svos/apps/miranda +Environment=SVOS_APP_LISTEN=127.0.0.1:8408 +Environment=SVOS_KERNEL_URL=https://svos-kernel.phasefinal.com +ExecStart=/opt/svos/current/apps-env/bin/svos-miranda +[Install] +WantedBy=default.target diff --git a/configs/svos-apps/nh3-dev/svos-postoffice.service b/configs/svos-apps/nh3-dev/svos-postoffice.service new file mode 100644 index 0000000..798047e --- /dev/null +++ b/configs/svos-apps/nh3-dev/svos-postoffice.service @@ -0,0 +1,21 @@ +# eshpfi configs/svos-apps/nh3-dev/ (infra-ops, U13 2026-10-11): the althing bridge (app-postoffice) as lkraven, the +# herald's user, because it owns the miranda handle's box-local push route. The kernel calls it over plain LAN HTTP. +# Config /var/lib/svos/config/apps/postoffice.toml; credential /etc/svos/env/postoffice.env (vault nh3-svos/svos-postoffice-credential). +[Unit] +Description=SVOS Post office bridge (app-postoffice, U9a) +ConditionPathExists=/etc/svos/env/postoffice.env +[Service] +Type=simple +UMask=0077 +Restart=on-failure +RestartSec=3 +TimeoutStopSec=20 +WorkingDirectory=/var/lib/svos +EnvironmentFile=/etc/svos/env/postoffice.env +Environment=SVOS_KERNEL_URL=https://svos-kernel.phasefinal.com +Environment=SVOS_DATA_ROOT=/var/lib/svos +Environment=SVOS_APP_LISTEN=10.100.10.50:8406 +Environment=ALTHING_POST_OFFICE=http://10.100.50.40:8390 +ExecStart=/opt/svos/current/apps-env/bin/svos-postoffice +[Install] +WantedBy=default.target diff --git a/configs/svos-apps/nh3-dev/svos-terminal.service b/configs/svos-apps/nh3-dev/svos-terminal.service new file mode 100644 index 0000000..3affa5c --- /dev/null +++ b/configs/svos-apps/nh3-dev/svos-terminal.service @@ -0,0 +1,21 @@ +# eshpfi configs/svos-apps/nh3-dev/ (infra-ops, U13 2026-10-11): app-terminal as a USER unit of lkraven on nh3-dev. +# It must be a user unit: its seat launcher runs `systemctl --user start zellij-fleet@Claude` and never parents the +# zellij server. The kernel reaches it through https://svos-seathost.nh3.phasefinal.com (fleet Caddy -> :8404). +# Config /var/lib/svos/config/apps/terminal.toml; credential /etc/svos/env/terminal.env (vault nh3-svos/svos-terminal-credential). +[Unit] +Description=SVOS Terminal connector + seat host (app-terminal, U8/U5b) +ConditionPathExists=/etc/svos/env/terminal.env +[Service] +Type=simple +UMask=0077 +Restart=on-failure +RestartSec=3 +TimeoutStopSec=20 +WorkingDirectory=/var/lib/svos +EnvironmentFile=/etc/svos/env/terminal.env +Environment=SVOS_KERNEL_URL=https://svos-kernel.phasefinal.com +Environment=SVOS_DATA_ROOT=/var/lib/svos +Environment=SVOS_APP_LISTEN=127.0.0.1:8404 +ExecStart=/opt/svos/current/apps-env/bin/svos-terminal +[Install] +WantedBy=default.target diff --git a/configs/svos-front/Caddyfile b/configs/svos-front/Caddyfile index 064f50e..dd19a26 100644 --- a/configs/svos-front/Caddyfile +++ b/configs/svos-front/Caddyfile @@ -138,8 +138,12 @@ https://svos.phasefinal.com:443 { # it passes through unmodified. /terminal/stream is a long-lived ndjson stream: no buffering (flush_interval -1) # and no write/idle deadline (none is set anywhere in this file). Same 1 MiB body cap. # - Mesh-only like the main site: headscale MagicDNS extra record -> 100.64.0.9; nh3-svos resolves it via /etc/hosts. +# U13 (2026-10-11): app-terminal now runs on nh3-dev, loopback-only. This origin reaches it through nh3-dev's seat-host +# origin (fleet Caddy, allowlisted to this box's 10.100.50.43); Host must be the upstream's name or the fleet Caddy's +# host matcher misses it. The old upstream was 127.0.0.1:8404 here. (svos_terminal_upstream) { - reverse_proxy 127.0.0.1:8404 { + reverse_proxy https://svos-seathost.nh3.phasefinal.com { + header_up Host {upstream_hostport} flush_interval -1 } }