ops(u13,fv-ml1): E2 in progress — nh3-dev app units, terminal origin via seat-host; fv-ml1 serial console + SOL logger staged
- configs/svos-apps/nh3-dev/: user units for svos-terminal (running), svos-postoffice, svos-miranda, svos-agent (installed, not yet started). - configs/svos-front/Caddyfile: svos-terminal.phasefinal.com upstreams to https://svos-seathost.nh3.phasefinal.com now that app-terminal runs on nh3-dev. - configs/fv-ml1-sol/: an nh3-dev user unit holding fv-ml1's BMC SOL session into the journal; fv-ml1's kernel console goes to ttyS1 (the SOL port, marker-tested) from its next boot (ZFSBootMenu commandline on zroot/ROOT).
This commit is contained in:
@@ -0,0 +1,22 @@
|
||||
# eshpfi configs/fv-ml1-sol/ (infra-ops, 2026-10-11, Prime: "stage the evidence capture"): a USER unit of lkraven on
|
||||
# nh3-dev that holds fv-ml1's BMC Serial-over-LAN session and writes everything to the journal
|
||||
# (`journalctl --user -u fv-ml1-sol-logger`). fv-ml1's kernel prints to ttyS1 = the SOL port (marker-tested) from its
|
||||
# next boot (ZFSBootMenu `org.zfsbootmenu:commandline` on zroot/ROOT: `console=ttyS1,115200n8 console=tty0`), so a
|
||||
# hang's last kernel lines land here. SOL is live-only (the BMC keeps no history), which is why something must hold it.
|
||||
# A human who needs SOL wins: `ipmitool ... sol deactivate` kicks this session, and it retries every 60 s without
|
||||
# deactivating anyone (no ExecStartPre deactivate on purpose). Password: ~/.config/fv-ml1-sol/bmc.env (0600,
|
||||
# IPMI_PASSWORD, vault ana-ml2/bmc-infra-ops), never on a command line.
|
||||
[Unit]
|
||||
Description=fv-ml1 serial console logger (BMC SOL -> journal)
|
||||
After=network-online.target
|
||||
[Service]
|
||||
Type=simple
|
||||
EnvironmentFile=%h/.config/fv-ml1-sol/bmc.env
|
||||
ExecStart=/bin/sh -c 'sleep infinity | exec /usr/bin/ipmitool -I lanplus -H 10.251.250.50 -U infra-ops -E sol activate usesolkeepalive'
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
SyslogIdentifier=fv-ml1-sol
|
||||
Restart=always
|
||||
RestartSec=60
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
@@ -0,0 +1,22 @@
|
||||
# eshpfi configs/svos-apps/nh3-dev/ (infra-ops, U13 2026-10-11): Miranda's agent connector (persona miranda), loopback
|
||||
# only; the gateway's svos plugin calls it at connector_url http://127.0.0.1:8407 with the shared Bifrost key.
|
||||
# FIRST start only: /etc/svos/env/agent-enroll.env carries SVOS_AGENT_ENROLL_SECRET; the connector enrolls, writes
|
||||
# /etc/svos/miranda/agent.credential (0600) and refuses to start while both exist, so delete the enroll file after.
|
||||
[Unit]
|
||||
Description=SVOS agent connector for Miranda (svos-agent)
|
||||
[Service]
|
||||
Type=simple
|
||||
UMask=0077
|
||||
Restart=on-failure
|
||||
RestartSec=3
|
||||
TimeoutStopSec=20
|
||||
WorkingDirectory=/etc/svos/miranda
|
||||
EnvironmentFile=-/etc/svos/env/agent-enroll.env
|
||||
Environment=SVOS_AGENT_CONFIG=/etc/svos/miranda/agent.toml
|
||||
Environment=SVOS_AGENT_LISTEN=127.0.0.1:8407
|
||||
Environment=SVOS_KERNEL_URL=https://svos-kernel.phasefinal.com
|
||||
Environment=SVOS_BIFROST_KEY_FILE=/etc/svos/miranda/bifrost.key
|
||||
Environment=SVOS_AGENT_CREDENTIAL_FILE=/etc/svos/miranda/agent.credential
|
||||
ExecStart=/opt/svos/current/apps-env/bin/svos-agent
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
@@ -0,0 +1,21 @@
|
||||
# eshpfi configs/svos-apps/nh3-dev/ (infra-ops, U13 2026-10-11): app-miranda beside the Hermes gateway it calls on
|
||||
# loopback (:8765). Reached by the kernel through https://svos-miranda.nh3.phasefinal.com (fleet Caddy -> :8408).
|
||||
# Credential /etc/svos/env/miranda.env (vault nh3-svos/svos-miranda-credential, from enrolling app-miranda).
|
||||
[Unit]
|
||||
Description=SVOS Miranda (app-miranda, U9a/U11)
|
||||
ConditionPathExists=/etc/svos/env/miranda.env
|
||||
[Service]
|
||||
Type=simple
|
||||
UMask=0077
|
||||
Restart=on-failure
|
||||
RestartSec=3
|
||||
TimeoutStopSec=20
|
||||
WorkingDirectory=/var/lib/svos/apps/miranda
|
||||
EnvironmentFile=/etc/svos/env/miranda.env
|
||||
Environment=SVOS_MIRANDA_CONFIG=/etc/svos/miranda/miranda.toml
|
||||
Environment=SVOS_DATA_ROOT=/var/lib/svos/apps/miranda
|
||||
Environment=SVOS_APP_LISTEN=127.0.0.1:8408
|
||||
Environment=SVOS_KERNEL_URL=https://svos-kernel.phasefinal.com
|
||||
ExecStart=/opt/svos/current/apps-env/bin/svos-miranda
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
@@ -0,0 +1,21 @@
|
||||
# eshpfi configs/svos-apps/nh3-dev/ (infra-ops, U13 2026-10-11): the althing bridge (app-postoffice) as lkraven, the
|
||||
# herald's user, because it owns the miranda handle's box-local push route. The kernel calls it over plain LAN HTTP.
|
||||
# Config /var/lib/svos/config/apps/postoffice.toml; credential /etc/svos/env/postoffice.env (vault nh3-svos/svos-postoffice-credential).
|
||||
[Unit]
|
||||
Description=SVOS Post office bridge (app-postoffice, U9a)
|
||||
ConditionPathExists=/etc/svos/env/postoffice.env
|
||||
[Service]
|
||||
Type=simple
|
||||
UMask=0077
|
||||
Restart=on-failure
|
||||
RestartSec=3
|
||||
TimeoutStopSec=20
|
||||
WorkingDirectory=/var/lib/svos
|
||||
EnvironmentFile=/etc/svos/env/postoffice.env
|
||||
Environment=SVOS_KERNEL_URL=https://svos-kernel.phasefinal.com
|
||||
Environment=SVOS_DATA_ROOT=/var/lib/svos
|
||||
Environment=SVOS_APP_LISTEN=10.100.10.50:8406
|
||||
Environment=ALTHING_POST_OFFICE=http://10.100.50.40:8390
|
||||
ExecStart=/opt/svos/current/apps-env/bin/svos-postoffice
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
@@ -0,0 +1,21 @@
|
||||
# eshpfi configs/svos-apps/nh3-dev/ (infra-ops, U13 2026-10-11): app-terminal as a USER unit of lkraven on nh3-dev.
|
||||
# It must be a user unit: its seat launcher runs `systemctl --user start zellij-fleet@Claude` and never parents the
|
||||
# zellij server. The kernel reaches it through https://svos-seathost.nh3.phasefinal.com (fleet Caddy -> :8404).
|
||||
# Config /var/lib/svos/config/apps/terminal.toml; credential /etc/svos/env/terminal.env (vault nh3-svos/svos-terminal-credential).
|
||||
[Unit]
|
||||
Description=SVOS Terminal connector + seat host (app-terminal, U8/U5b)
|
||||
ConditionPathExists=/etc/svos/env/terminal.env
|
||||
[Service]
|
||||
Type=simple
|
||||
UMask=0077
|
||||
Restart=on-failure
|
||||
RestartSec=3
|
||||
TimeoutStopSec=20
|
||||
WorkingDirectory=/var/lib/svos
|
||||
EnvironmentFile=/etc/svos/env/terminal.env
|
||||
Environment=SVOS_KERNEL_URL=https://svos-kernel.phasefinal.com
|
||||
Environment=SVOS_DATA_ROOT=/var/lib/svos
|
||||
Environment=SVOS_APP_LISTEN=127.0.0.1:8404
|
||||
ExecStart=/opt/svos/current/apps-env/bin/svos-terminal
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
@@ -138,8 +138,12 @@ https://svos.phasefinal.com:443 {
|
||||
# it passes through unmodified. /terminal/stream is a long-lived ndjson stream: no buffering (flush_interval -1)
|
||||
# and no write/idle deadline (none is set anywhere in this file). Same 1 MiB body cap.
|
||||
# - Mesh-only like the main site: headscale MagicDNS extra record -> 100.64.0.9; nh3-svos resolves it via /etc/hosts.
|
||||
# U13 (2026-10-11): app-terminal now runs on nh3-dev, loopback-only. This origin reaches it through nh3-dev's seat-host
|
||||
# origin (fleet Caddy, allowlisted to this box's 10.100.50.43); Host must be the upstream's name or the fleet Caddy's
|
||||
# host matcher misses it. The old upstream was 127.0.0.1:8404 here.
|
||||
(svos_terminal_upstream) {
|
||||
reverse_proxy 127.0.0.1:8404 {
|
||||
reverse_proxy https://svos-seathost.nh3.phasefinal.com {
|
||||
header_up Host {upstream_hostport}
|
||||
flush_interval -1
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user