memory: snapshot — soong-lab cutover + zonos 0.2.1 presets + fleet CI recipe + peer creds

End-of-session snapshot for /clear. In-flight compressed (four majors landed: zonos-gateway 0.2.1 emotion presets, soong-lab containerized cutover, Wyrd + wtsdk credential provisions). New Recent-decisions + Tried entries and three detail files capture the durable lessons (fleet Gitea build recipe, the vh-is-a-user package-write constraint, soong-lab deploy layout).
2026-07-18 16:40:49 -07:00
parent deae057399
commit abc8f0ceab
4 changed files with 168 additions and 22 deletions
@@ -0,0 +1,46 @@
+- `[2026-07-18]` **soong-lab containerize cutover — COMPLETE + LIVE on corviduo-dev.**
+
+Migrated soong-lab (Noonien Soong character-design studio) from a hand-built
+`soong-lab-studio.service` (systemd + git-pull-on-webhook) to a containerized
+deploy, image built by CI + pushed to the Gitea registry. soong-dev owns the
+in-repo artifacts (Dockerfile/compose/workflow/`docs/DEPLOY.md` = checklist);
+infra-ops owned the host cutover. Operator confirmed functional ("Soong works
+great" — a real Soong turn round-trips + saves) → cutover 100% closed.
+
+**Final state (corviduo-dev, 10.250.50.152):**
+- Container `soong-lab-soong-lab-1` LIVE + healthy on `0.0.0.0:8443`, image
+  `gitea.phasefinal.com/vh/soong-lab:latest` (v0.3.24), `restart:unless-stopped`
+  (survives reboot; no systemd unit needed — docker restart policy handles boot).
+- Deploy dir **`/home/infra-ops/soong-lab-deploy/`** — pull-based `compose.yaml`
+  (image + env_file + `8443:8443` + named volumes; NO build/secrets stanza) +
+  `.env` (copied from the live `soong-lab.env`, STRIPPED of the `SOONG_LAB_*_DIR`
+  overrides so the container uses image defaults `/data/library` + `/data/portraits`
+  + `/app/web` → the volumes).
+- Named volumes `soong-lab_soong-library` + `soong-lab_soong-portraits`, migrated
+  from `/home/infra-ops/soong-lab-data/{library,portraits}` (2 saved designs incl.
+  **Sindra** + 27 portraits), **chowned `10001:999`** (the container `soong` user)
+  so it can read AND write new designs.
+- Old `soong-lab-studio.service` + `soong-webhook.service` (the `:9010` git-pull
+  redeploy listener) both **stopped + disabled**.
+
+**Topology reality (≠ what DEPLOY.md assumed):** there is **NO TLS proxy**.
+WT-personal (`:8081`) and soong-lab are **co-located on corviduo-dev**, and the
+Bifrost callback is **plain-HTTP same-host** `http://10.250.50.152:8443` — the
+value of `SOONG_LAB_BIFROST_ENDPOINT_URL`, unchanged by the move, so the WT
+Bifrost host-allowlist stayed valid as-is. Nothing on the WT side needed touching.
+
+**Safety net:** data backup `/home/infra-ops/soong-lab-data-backup-20260718-091831.tar.gz`
+(35M) taken BEFORE migration. Verified pre-retire: `/api/version` 200 (0.3.24),
+SPA `/` 200, `POST /bifrost/tool-call` → 401 (route present + auth-gated),
+bidirectional WT↔soong reachability, container healthcheck green.
+
+**Ops commands:**
+- Redeploy a new image: `cd /home/infra-ops/soong-lab-deploy && sudo docker compose pull && sudo docker compose up -d`.
+  (Auto-pull-on-`:latest` — watchtower or a deploy hook — is an open follow-up.)
+- Rollback: `sudo docker compose down` + `sudo systemctl enable --now soong-lab-studio.service soong-webhook.service`.
+- Homepage tile: manual `- Apps:` entry "Soong Lab" (href http://10.250.50.152:8443)
+  in esh-docker-vm `/opt/docker/conf/homepage/services.yaml` — corviduo-dev isn't
+  a Homepage-watched docker endpoint, so docker-label auto-discovery can't surface
+  it (see [[2026-07-18-fleet-gitea-runner-build-recipe]] for the CI half).
+
+See [[reference_corviduo_dev_emergency_ops]], [[reference_claude_bot_gitea_creds]].