ops(svos): U13 phase B — nh3-svos on v0.0.9 (schema 12), kernel app origin, seat-host and high-seat origins, bridge env on nh3-dev

Prime approved svos-dev's U13 pre-edit ask (2026-10-10 1639). - B1: release afab123 on nh3-svos (kernel 0.0.9, migration 11->12) after a vzdump and an offline svos.db copy; app-terminal and app-postoffice held on b588510 by drop-ins until the edit. - B2: --app-listen 127.0.0.1:8410 (drop-in) fronted by Caddy as svos-kernel.phasefinal.com on the LAN, allowlisted to nh3-dev; the path list adds /auth/kernel-key, which every connector client needs. DNS rewrite on the three internal AdGuards. - B3/B4: svos-seathost (-> :8404) and svos-highseat (-> :8773) on nh3-dev's fleet Caddy, allowlisted to nh3-svos; /opt/svos apps env on nh3-dev with svos-postoffice[push] (althing-core 3.7.0 from althing 7a2a1c1) and svos-terminal. The fleet Caddyfile is now tracked in configs/.
2026-10-10 16:50:18 -07:00
parent 129122d9b4
commit feef8330ca
8 changed files with 169 additions and 1 deletions
@@ -0,0 +1,55 @@
+{
+	email lkraven@lkraven.com
+}
+
+# Fleet internal TLS — caddy is the WILDCARD CERT AUTHORITY for *.nh3.phasefinal.com
+# (publicly-trusted LE via Cloudflare DNS-01, renewed automatically). Consumers:
+#   * self-terminate with a copy of this cert (talk: ~/talk/certs, kept fresh by
+#     fleet-tls-cert-check.timer), OR
+#   * front here via a reverse_proxy handle block on @<tool> host <tool>.nh3.phasefinal.com
+*.nh3.phasefinal.com {
+	tls {
+		dns cloudflare {env.CF_API_TOKEN}
+		resolvers 1.1.1.1 8.8.8.8
+	}
+	# Scriberr (fv-ml1:8080, plain HTTP). Fronted so the browser recorder gets a SecureContext:
+	# getUserMedia is refused on http:// origins ("Failed to initialize recorder"). 2026-10-01.
+	# Scriberr's ALLOWED_ORIGINS must list this name (fv-ml1 /opt/docker/compose/scriberr/.env).
+	@scriberr host scriberr.nh3.phasefinal.com
+	handle @scriberr {
+		reverse_proxy 10.251.50.54:8080 {
+			flush_interval -1
+		}
+	}
+	# SVOS U13 (2026-10-10, Prime-approved; svoperatingsystem docs/operations/u13-svos-edit.md "Before the edit" 2,
+	# svos docs/u13-cutover-runbook.md B3/B4). Two app origins on nh3-dev's LOOPBACK, reachable only from nh3-svos
+	# (10.100.50.43), whose kernel signs every call it makes to them. Until each app runs (the U13 edit) they answer 502.
+	# - svos-seathost: app-terminal, which moves to nh3-dev at the edit (svos-terminal, listener 127.0.0.1:8404).
+	#   The kernel's instance.toml names this as app-terminal's base_url. No buffering (the app has long-lived routes).
+	# - svos-highseat: app-high-seat, the High Seat's signed-only listener (127.0.0.1:8773, enabled at the edit's E1).
+	@svos_seathost host svos-seathost.nh3.phasefinal.com
+	handle @svos_seathost {
+		@not_nh3_svos not remote_ip 10.100.50.43
+		handle @not_nh3_svos {
+			respond 403
+		}
+		handle {
+			reverse_proxy 127.0.0.1:8404 {
+				flush_interval -1
+			}
+		}
+	}
+	@svos_highseat host svos-highseat.nh3.phasefinal.com
+	handle @svos_highseat {
+		@not_nh3_svos not remote_ip 10.100.50.43
+		handle @not_nh3_svos {
+			respond 403
+		}
+		handle {
+			reverse_proxy 127.0.0.1:8773
+		}
+	}
+	handle {
+		respond "nh3 fleet TLS authority — no tool fronted here (talk self-terminates on :8092)" 404
+	}
+}
@@ -0,0 +1,8 @@
+# /etc/systemd/system/svos-postoffice.service.d/10-hold-b588510.conf on nh3-svos (U13 B1, 2026-10-10).
+# TEMPORARY: keeps app-postoffice on release b588510's code while the kernel runs v0.0.9 (afab123). Its v0.0.9 manifest
+# changed, and a new version would re-register, be held for the owner's approval, and refuse the kernel's calls as
+# wrong-revision until then (svos-dev's sequencing). The app moves to nh3-dev at the U13 edit; REMOVE this drop-in
+# there, and keep /opt/svos/releases/b588510 on disk until it is gone.
+[Service]
+ExecStart=
+ExecStart=/opt/svos/releases/b588510/apps-env/bin/svos-postoffice
@@ -0,0 +1,8 @@
+# /etc/systemd/system/svos-terminal.service.d/10-hold-b588510.conf on nh3-svos (U13 B1, 2026-10-10).
+# TEMPORARY: keeps app-terminal on release b588510's code while the kernel runs v0.0.9 (afab123). Its v0.0.9 manifest
+# changed, and a new version would re-register, be held for the owner's approval, and refuse the kernel's calls as
+# wrong-revision until then (svos-dev's sequencing). The app moves to nh3-dev at the U13 edit; REMOVE this drop-in
+# there, and keep /opt/svos/releases/b588510 on disk until it is gone.
+[Service]
+ExecStart=
+ExecStart=/opt/svos/releases/b588510/apps-env/bin/svos-terminal
@@ -212,3 +212,47 @@ https://svos-terminal.phasefinal.com:443 {
 		}
 	}
 }
+
+# The kernel's app origin (U13 B2, 2026-10-10, Prime-approved; svoperatingsystem U9a and docs/operations/u13-svos-edit.md
+# "Before the edit" 1). Apps that run OFF this box reach the kernel here: from the U13 edit, app-terminal,
+# app-postoffice (the bridge) and app-high-seat, all on nh3-dev. LAN only, because nh3-dev is not on the mesh; the
+# internal AdGuards answer svos-kernel.phasefinal.com -> 10.100.50.43 and no MagicDNS record exists.
+# - Upstream is the kernel's SECOND listener, `serve --app-listen 127.0.0.1:8410` (configs/svos-kernel/20-app-listen.conf):
+#   a request there is never a human and loopback trust never applies, so every call authenticates with its own bearer.
+#   NO Basic auth, and Authorization passes through untouched.
+# - Source allowlisted to nh3-dev (10.100.10.50); anything else gets 403 from Caddy.
+# - Paths: svos-dev's app surface (/auth/enroll, /auth/proofs, /registry/*, /verbs/*, /seats/enroll) plus
+#   /auth/kernel-key, which every svos_connector client fetches to trust the kernel's signatures (client.kernel_key; it
+#   is also the joint runbook's B2 check: refused by the KERNEL with 401 without a credential). Anything else 404.
+# - Client identity/forwarding headers are deleted as on the other sites; the same 1 MiB body cap; nothing streams.
+https://svos-kernel.phasefinal.com:443 {
+	bind 10.100.50.43
+	tls {
+		dns cloudflare {env.CF_API_TOKEN}
+		resolvers 1.1.1.1 8.8.8.8
+	}
+	route {
+		request_header -Tailscale-User-*
+		request_header -X-Forwarded-*
+		request_header -Tailscale-Headers-Info
+		request_header -X-Real-IP
+		request_header -Forwarded
+		request_header -X-SVOS-Peer
+
+		request_body {
+			max_size 1MiB
+		}
+
+		@not_nh3_dev not remote_ip 10.100.10.50
+		handle @not_nh3_dev {
+			respond 403
+		}
+		@app_surface path /auth/enroll /auth/proofs /auth/kernel-key /registry/* /verbs/* /seats/enroll
+		handle @app_surface {
+			reverse_proxy 127.0.0.1:8410
+		}
+		handle {
+			respond 404
+		}
+	}
+}
@@ -0,0 +1,9 @@
+# /etc/systemd/system/svos-kernel.service.d/20-app-listen.conf on nh3-svos (U13 B2, 2026-10-10, Prime-approved).
+# Adds the kernel's second listener for apps OFF the box (kernel >= 0.0.9, svoperatingsystem U9a). A request on
+# 127.0.0.1:8410 is never a human and loopback trust never applies there; Caddy fronts it as svos-kernel.phasefinal.com
+# on the LAN, allowlisted to nh3-dev (configs/svos-front/Caddyfile). The primary listener is unchanged. The ExecStart
+# below is the release unit's (deployment/nh3-svos/svos-kernel.service) plus --app-listen; keep the two in step when
+# that unit changes. serve refuses --app-listen on the primary listener's port.
+[Service]
+ExecStart=
+ExecStart=/opt/svos/current/kernel-env/bin/svos-kernel serve --data-root /var/lib/svos --host 127.0.0.1 --port 8400 --trust-loopback --app-listen 127.0.0.1:8410