vh
3132a16ca0
Every fv-ml1 link on the Homepage dashboard was broken. Measured against the
live dashboard API before the fix: 16 entries pointing at the dead 10.250.50.54
and zero at the live 10.251.50.54, covering gen, M.O.G.-SEC, Scriberr, Embed,
Rerank, Reward, Coder, Dockge and six dormant seats.
The miss was structural, not careless. fv-ml1-rename-sweep.sh works from an
allowlist assembled from files that mention the HOST, and a homepage.href label
mentions only an IP -- so every stack whose sole stale reference was a label
fell outside it. The allowlist now covers those 24 files, and records how to
derive the list next time (grep the old address, subtract history) rather than
enumerating from memory.
History is still untouched, and the exclusions are now written down with the
reason each one keeps the old address: recorded benchmark results, whose
base_url is part of a measurement's provenance; the one LiteLLM comment
preserving a retired hand-test endpoint; and the cutover runbooks, where the old
address is the subject matter.
Two bugs found while applying it, both fixed here:
- deploy-stack.sh rejected any stack name containing a dot, so qwen3.5-122b,
qwopus3.5-122b and mistral-medium-3.5 could not be deployed by the script at
all. The check exists to stop path traversal, which means rejecting ".." and
"/" -- not every dot. Traversal is now rejected explicitly and tested.
- stacks/scriberr/.env.example allowed CORS only from the dead IP and from
scriberr.ana.internal, which no longer resolves; the box is at the fv site
and DNS already carries scriberr.fv.internal. The live .env had both stale
origins, i.e. an allowlist with nothing reachable in it.
Host side, applied separately: canonical pushed for the 16 stacks whose only
difference from the host was this renumber, and an in-place address-only fix for
the nine whose host copy has genuinely drifted or has no canonical copy, so that
drift survives for a deliberate reconciliation instead of being clobbered. Every
compose.yaml on fv-ml1 now reads 10.251.50.54. The labels themselves only take
effect at container creation, so the running containers still need recreating.
134 lines
6.4 KiB
Bash
Executable File
134 lines
6.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# fv-ml1-rename-sweep.sh — the cosmetic half of the ana-ml2 -> fv-ml1 cutover.
|
|
# Run AT cutover, AFTER the box serves at Fountain Valley and the DNS + LiteLLM
|
|
# steps in docs/runbooks/fv-ml1-cutover.md are done.
|
|
#
|
|
# ⚠ SCOPED ON PURPOSE. A blind `sed s/ana-ml2/fv-ml1/g` across the repo would
|
|
# rewrite HISTORY — dated persistent-memory entries, archival-memory, incident
|
|
# records, and model .PROVENANCE.txt prose all say "ana-ml2" because that is what
|
|
# the box WAS when those things happened. Rewriting them makes the record lie.
|
|
# This touches ONLY current-state files (the server tables, live display refs,
|
|
# ssh targets, playbooks) on an explicit ALLOWLIST, and prints a manual-review
|
|
# list for the judgement calls it deliberately will not automate.
|
|
#
|
|
# Default is DRY-RUN. Pass --apply to make changes. Not idempotent-hostile: safe
|
|
# to re-run (already-renamed files simply match nothing).
|
|
set -uo pipefail
|
|
APPLY=0; [ "${1:-}" = "--apply" ] && APPLY=1
|
|
OLD_IP=10.250.50.54; NEW_IP=10.251.50.54
|
|
say(){ echo " $*"; }
|
|
run(){ if [ "$APPLY" = 1 ]; then eval "$@"; else echo " DRY: $*"; fi; }
|
|
|
|
# --- files that describe CURRENT STATE (safe to repoint) --------------------
|
|
ALLOW=(
|
|
CLAUDE.md
|
|
README.md
|
|
docs/runbooks/disaster-recovery.md
|
|
docs/pfi/proxmox-vms.md
|
|
docs/pfi/docker-stack.md
|
|
docs/pfi/reranker-selection-ledger.md
|
|
servers/pfi-pve/README.md
|
|
stacks/homepage/conf/services.yaml
|
|
stacks/homepage/conf/docker.yaml
|
|
stacks/homepage/README.md
|
|
stacks/beszel/README.md
|
|
stacks/dockge/.env.example
|
|
stacks/llama-swap/compose.yaml
|
|
stacks/gemma4-charrp/compose.yaml
|
|
stacks/gemma4-charrp/README.md
|
|
stacks/meromero-charrp/compose.yaml
|
|
stacks/erp-seat/compose.yaml
|
|
stacks/sglang/compose.yaml
|
|
stacks/heretic2-charrp-reasoning/README.md
|
|
# --- ADDED 2026-09-13. The first pass's allowlist missed every stack whose only
|
|
# --- stale reference was a `homepage.href` LABEL, and the result was measurable:
|
|
# --- 16 live Homepage entries pointing at the dead 10.250.50.54 and ZERO at the
|
|
# --- live 10.251.50.54, i.e. every fv-ml1 dashboard link broken. The miss was
|
|
# --- structural, not careless -- the original list was assembled from files that
|
|
# --- mention the HOST, and a homepage.href mentions only an IP. If this script is
|
|
# --- ever reused for another relocation, derive the list from
|
|
# --- grep -rl '<old-ip>' stacks/ docs/ services/
|
|
# --- and subtract history, rather than enumerating from memory.
|
|
# --- ⚠ A label edit needs `docker compose up -d <svc>`, not `restart`: labels are
|
|
# --- only applied at container CREATION. Editing the file changes nothing live.
|
|
stacks/char-rp-gguf/compose.yaml
|
|
stacks/char-rp-gguf/README.md
|
|
stacks/darkscarlett-charrp-reasoning/compose.yaml
|
|
stacks/dockge/README.md
|
|
stacks/dozzle/.env.example
|
|
stacks/dozzle/README.md
|
|
stacks/fablefusion-charrp-probe/README.md
|
|
stacks/gen-seat/compose.yaml
|
|
stacks/gen-seat/README.md
|
|
stacks/heretic2-charrp-reasoning/compose.yaml
|
|
stacks/litellm/README.md
|
|
stacks/mistral-small-4/compose.yaml
|
|
stacks/mistral-small-4-heretic/compose.yaml
|
|
stacks/mog-sec/compose.yaml
|
|
stacks/qwen-image-bench/compose.yaml
|
|
stacks/qwen3.5-122b/compose.yaml
|
|
stacks/qwen36-vl/compose.yaml
|
|
stacks/qwopus3.5-122b/compose.yaml
|
|
stacks/scriberr/compose.yaml
|
|
stacks/scriberr/README.md
|
|
stacks/scriberr/.env.example
|
|
stacks/selene/compose.yaml
|
|
stacks/sglang/README.md
|
|
stacks/vllm/compose.yaml
|
|
)
|
|
# --- NEVER touched: history, provenance, the mirror -------------------------
|
|
# persistent-memory.md, persistent-memory.d/, archival-memory.md,
|
|
# **/*.PROVENANCE.txt (on the box, not the repo), graphify-out/, stacks-mirror/
|
|
#
|
|
# Also deliberately excluded, verified 2026-09-13 -- each of these still contains
|
|
# 10.250.50.54 and each SHOULD:
|
|
# services/*/bench/*.json, services/refusal-probe/results-*/raw-*.json
|
|
# recorded benchmark results; the base_url IS part of the measurement's
|
|
# provenance. Repointing it would claim a run happened somewhere it did not.
|
|
# stacks/litellm/conf/config.yaml (one comment)
|
|
# preserves a past hand-test endpoint, :8099, which no longer exists anywhere.
|
|
# docs/runbooks/fv-ml1-cutover.md, docs/runbooks/fv-onsite-playbook.md
|
|
# the old address is the SUBJECT MATTER of those runbooks.
|
|
# configs/homepage/
|
|
# a dead April-era duplicate of stacks/homepage/conf/ -- nothing reads it.
|
|
# It needs deleting, not repointing, which is a separate decision.
|
|
|
|
echo "=== 1. rename the server dir ==="
|
|
if [ -d servers/ana-ml2 ]; then run "git mv servers/ana-ml2 servers/fv-ml1"; else say "servers/ana-ml2 already moved"; fi
|
|
|
|
echo "=== 2. rename ana-ml2 playbooks ==="
|
|
for f in playbooks/ana-ml2-*.yaml; do
|
|
[ -e "$f" ] || continue
|
|
run "git mv '$f' '${f/ana-ml2/fv-ml1}'"
|
|
done
|
|
|
|
echo "=== 3. repoint current-state files (name + IP) on the allowlist ==="
|
|
for f in "${ALLOW[@]}" servers/fv-ml1/README.md servers/fv-ml1/ssh-target playbooks/fv-ml1-*.yaml; do
|
|
[ -e "$f" ] || continue
|
|
if grep -qE "ana-ml2|$OLD_IP" "$f" 2>/dev/null; then
|
|
say "edit $f"
|
|
run "sed -i 's/$OLD_IP/$NEW_IP/g; s/ana-ml2/fv-ml1/g' '$f'"
|
|
fi
|
|
done
|
|
# BMC + site labels are hand-verified below, not blanket-sed (10.250.250.50 -> 10.251.250.50,
|
|
# 'Anaheim' -> 'Fountain Valley' only where it means THIS box).
|
|
echo "=== 4. BMC IP + site label (targeted) ==="
|
|
run "sed -i 's/10.250.250.50/10.251.250.50/g' servers/fv-ml1/README.md CLAUDE.md docs/runbooks/disaster-recovery.md 2>/dev/null || true"
|
|
|
|
echo
|
|
echo "=== MANUAL REVIEW (NOT automated — judgement calls) ==="
|
|
cat <<'REVIEW'
|
|
- stacks/ana-ml2-proxy/ : the Homepage Docker-API relay is named + built around
|
|
ana-ml2. Decide: rename the stack to fv-ml1-proxy and repoint :2375, or retire it
|
|
if Homepage reaches FV over the mesh directly. Not auto-renamed (stack identity).
|
|
- stacks/litellm/conf/config.yaml : handled by the LiteLLM step in the runbook
|
|
(api_base repoint), NOT here — its comments carry historical model notes.
|
|
- servers/fv-ml1/README.md : re-read fully — site is now Fountain Valley, the BMC
|
|
subnet is 10.251.250.x, the mesh path is the OPNsense subnet-router (not ana-scale).
|
|
- dns/internal.yaml : handled by the DNS step (piggyback records), NOT here.
|
|
- 'Anaheim' prose in the allowlisted docs : change to 'Fountain Valley' only where it
|
|
refers to THIS box, not the colo generally. grep -n Anaheim <file> and eyeball.
|
|
REVIEW
|
|
echo
|
|
[ "$APPLY" = 1 ] && echo "APPLIED. Review the diff: git diff --stat" || echo "DRY-RUN. Re-run with --apply to make changes."
|