vh
abc8f0ceab
End-of-session snapshot for /clear. In-flight compressed (four majors landed: zonos-gateway 0.2.1 emotion presets, soong-lab containerized cutover, Wyrd + wtsdk credential provisions). New Recent-decisions + Tried entries and three detail files capture the durable lessons (fleet Gitea build recipe, the vh-is-a-user package-write constraint, soong-lab deploy layout).
3.0 KiB
[2026-07-18]soong-lab containerize cutover — COMPLETE + LIVE on corviduo-dev.
Migrated soong-lab (Noonien Soong character-design studio) from a hand-built
soong-lab-studio.service (systemd + git-pull-on-webhook) to a containerized
deploy, image built by CI + pushed to the Gitea registry. soong-dev owns the
in-repo artifacts (Dockerfile/compose/workflow/docs/DEPLOY.md = checklist);
infra-ops owned the host cutover. Operator confirmed functional ("Soong works
great" — a real Soong turn round-trips + saves) → cutover 100% closed.
Final state (corviduo-dev, 10.250.50.152):
- Container
soong-lab-soong-lab-1LIVE + healthy on0.0.0.0:8443, imagegitea.phasefinal.com/vh/soong-lab:latest(v0.3.24),restart:unless-stopped(survives reboot; no systemd unit needed — docker restart policy handles boot). - Deploy dir
/home/infra-ops/soong-lab-deploy/— pull-basedcompose.yaml(image + env_file +8443:8443+ named volumes; NO build/secrets stanza) +.env(copied from the livesoong-lab.env, STRIPPED of theSOONG_LAB_*_DIRoverrides so the container uses image defaults/data/library+/data/portraits/app/web→ the volumes).
- Named volumes
soong-lab_soong-library+soong-lab_soong-portraits, migrated from/home/infra-ops/soong-lab-data/{library,portraits}(2 saved designs incl. Sindra + 27 portraits), chowned10001:999(the containersoonguser) so it can read AND write new designs. - Old
soong-lab-studio.service+soong-webhook.service(the:9010git-pull redeploy listener) both stopped + disabled.
Topology reality (≠ what DEPLOY.md assumed): there is NO TLS proxy.
WT-personal (:8081) and soong-lab are co-located on corviduo-dev, and the
Bifrost callback is plain-HTTP same-host http://10.250.50.152:8443 — the
value of SOONG_LAB_BIFROST_ENDPOINT_URL, unchanged by the move, so the WT
Bifrost host-allowlist stayed valid as-is. Nothing on the WT side needed touching.
Safety net: data backup /home/infra-ops/soong-lab-data-backup-20260718-091831.tar.gz
(35M) taken BEFORE migration. Verified pre-retire: /api/version 200 (0.3.24),
SPA / 200, POST /bifrost/tool-call → 401 (route present + auth-gated),
bidirectional WT↔soong reachability, container healthcheck green.
Ops commands:
- Redeploy a new image:
cd /home/infra-ops/soong-lab-deploy && sudo docker compose pull && sudo docker compose up -d. (Auto-pull-on-:latest— watchtower or a deploy hook — is an open follow-up.) - Rollback:
sudo docker compose down+sudo systemctl enable --now soong-lab-studio.service soong-webhook.service. - Homepage tile: manual
- Apps:entry "Soong Lab" (href http://10.250.50.152:8443) in esh-docker-vm/opt/docker/conf/homepage/services.yaml— corviduo-dev isn't a Homepage-watched docker endpoint, so docker-label auto-discovery can't surface it (see 2026-07-18-fleet-gitea-runner-build-recipe for the CI half).
See reference_corviduo_dev_emergency_ops, reference_claude_bot_gitea_creds.