vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(nh3-svos): credential-free SVOS offline shell before Basic auth; contract static routes; backup drill results

Browse Source 
svos-dev: the service worker fetches its hash-pinned INVENTORY with credentials omitted. Exactly those files plus /sw.js are now served before basic_auth (GET/HEAD, exact files). The list is generated from the release's sw.js by svos-front-inventory, which hash-checks each file and validates before reload. Gated static routes follow the web/README hosting contract: missing assets 404 instead of index.html, other document requests get index.html, everything else 404, unversioned files no-cache. acceptance-matrix.sh: 35/35 live; 16 FAIL against the previous config (positive control). git added to the nh3-svos playbook (kernel's remote check). Live backup drill: quiesced backup ~1-2 s outage; a refused freeze does NOT abort vzdump (unfrozen backup, job reported successful); both images restore-mounted read-only and verified.
This commit is contained in:
vh
2026-10-05 19:58:19 -07:00
parent 7c3eee877a
commit e369b1c769
6 changed files with 186 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
playbooks/nh3-svos-host.yaml
+3 -2
View File
@@ -9,6 +9,7 @@
# - /var/lib/svos svc-svos 0700, LOCAL ext4 (the root disk on vmstore): SQLite WAL, one writer, never shared/NFS
# - /opt/svos root:svc-svos 2775, the release tree (releases/<id>/ + a `current` link; svos-dev lays it out)
# - Python 3.13 (Debian 13) + venv, sqlite3, qemu-guest-agent (vzdump freeze/thaw), timesyncd checked
# - git: the SVOS kernel's data-root production-remote check needs it (svos-dev, 2026-10-05); no checkout lives here
# - /etc/qemu/fsfreeze-hook.d/ exists for the application-consistent snapshot hook svos-dev will add (the guest
# agent runs those scripts on vzdump's freeze/thaw)
# No Docker: nothing here needs it.
@@ -30,8 +31,8 @@ steps:
- name: base packages
sudo: true
shell: DEBIAN_FRONTEND=noninteractive apt-get install -y -q qemu-guest-agent python3 python3-venv sqlite3 rsync jq curl ca-certificates
when: "! dpkg -s qemu-guest-agent python3-venv sqlite3 rsync jq >/dev/null 2>&1"
shell: DEBIAN_FRONTEND=noninteractive apt-get install -y -q qemu-guest-agent python3 python3-venv sqlite3 rsync jq curl ca-certificates git
when: "! dpkg -s qemu-guest-agent python3-venv sqlite3 rsync jq git >/dev/null 2>&1"
- name: qemu-guest-agent running
sudo: true