vh
7ca2f76d21
Prime ruled albok subsumes note intake (1530). The wing is like personal/notes (albok-personal 1511, not service-restricted); health reads 7 wings ready. Nemi's token was re-minted with read+write on the new wing and vaulted over albok/token-nemi. /srv/nemi/inbox is lkraven:nemi-drop 2770 with a default ACL, plus u:lkraven:rx on /srv/nemi, so Nemi reaches it from lkraven's user manager, whose groups predate nemi-drop. Both paths are verified by the playbook.
42 lines
2.2 KiB
YAML
42 lines
2.2 KiB
YAML
# nh3-albok: the personal/inbox wing (unit 4.4 slice C's capture target; albok-dev 2026-10-13, after Prime's 1530 ruling
|
|
# that albok subsumes library/note intake). Like personal/notes: building personal, default_group albok-personal (1511),
|
|
# not service-restricted. Run between two Nemi walks (albok-nemi.timer on nh3-dev fires hourly at ~:01).
|
|
# scripts/elway infra-ops@10.100.50.44 --playbook playbooks/albok-personal-inbox.yaml
|
|
steps:
|
|
- name: Back up the live config
|
|
sudo: true
|
|
shell: cp -p /srv/albok/etc/albok.yaml /srv/albok/etc/albok.yaml.pre-inbox
|
|
creates: /srv/albok/etc/albok.yaml.pre-inbox
|
|
- name: Add wing personal/inbox after personal/notes
|
|
sudo: true
|
|
shell: |
|
|
python3 - <<'PY'
|
|
import os, grp
|
|
p = "/srv/albok/etc/albok.yaml"; s = open(p).read()
|
|
if " - id: inbox" in s:
|
|
print("already present"); raise SystemExit(0)
|
|
old = " wings:\n - id: notes\n"
|
|
assert s.count(old) == 1, s.count(old)
|
|
s = s.replace(old, old + " - id: inbox # unit 4.4 capture wing (Nemi's drop-box /srv/nemi/inbox on nh3-dev); like notes (2026-10-13)\n")
|
|
t = p + ".tmp"
|
|
fd = os.open(t, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o640)
|
|
with os.fdopen(fd, "w") as f: f.write(s)
|
|
os.chown(t, 0, grp.getgrnam("albok").gr_gid); os.replace(t, p); print("edited")
|
|
PY
|
|
- name: Restart the service (config is read at start) and wait for health
|
|
sudo: true
|
|
shell: |
|
|
docker restart albok-service >/dev/null
|
|
for i in $(seq 1 60); do
|
|
h=$(curl -s -m 3 http://127.0.0.1:8392/health) && echo "$h" | grep -q '"status":"ok"' && break; sleep 2
|
|
done
|
|
echo "$h" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('status'), d.get('wings'), d.get('leaks'))"
|
|
verify:
|
|
- name: Seven wings ready, none degraded
|
|
shell: curl -s -m 5 http://127.0.0.1:8392/health | python3 -c "import json,sys; w=json.load(sys.stdin)['wings']; print(w); assert w['ready']==7 and w['degraded']==0 and w['locked']==0"
|
|
changed_when: "false"
|
|
- name: The wing's store dir carries the personal group
|
|
sudo: true
|
|
shell: stat -c '%A %U:%G %n' /srv/albok/store/personal/inbox* | head -3
|
|
changed_when: "false"
|