vh
ffe7b24935
infra-ops and infra-hermes act as the same OS identity and dockerd does not
log exec per caller, so host-side changes carry no fingerprint. Git cannot
close the gap either: every commit here is attributed to Vuong Hoang by
convention, which is correct for authorship and useless for attribution.
On 2026-09-18 a second session edited the searxng stack mid-deploy, crash-
looping fleet search for ~4 minutes, and the author was unidentifiable.
scripts/ops-log records one line per host-changing action and holds a
lightweight claim so two agents do not deploy the same stack at once.
Four design questions, settled:
* Central on nh3-dev, not per-host and not the post office. Both agents
run as the same unix user there, so one file is shared with zero
provisioning. Per-host needs a writable path on ~25 heterogeneous boxes
and stores "we changed host Y" on host Y. journald looked free but shows
an unprivileged reader only their own _UID, which would have split the
log silently between the infra-ops and lkraven halves of the fleet.
* The claim is advisory and enforced in the tooling. deploy-stack.sh
refuses a foreign claim across the diff, the prompt and the apply -- the
whole review window, which is where the collision happened. Acquire is
mkdir, so it is atomic rather than probably-fine. Stale claims auto-break
and the break is recorded.
* Writers are automatic. deploy-stack.sh and elway record themselves; a log
that depends on remembering is the same class of instrument as a health
check that passes in both states.
* There is a detector. `ops-log audit` asks each host what changed on disk
and compares it to the newest log line for that stack, covering the
manual ssh-and-edit path the automatic writers structurally cannot.
ops-log being absent or broken never blocks a deploy; only a live foreign
claim does. `ops-log baseline` marks the 136 stacks that predate the
instrument so the detector starts from today rather than reporting the whole
fleet forever and training us to ignore it.
An unreachable host reports INCOMPLETE and exit 5, never clean.
50 lines
1.4 KiB
Plaintext
50 lines
1.4 KiB
Plaintext
# Secrets — real .env files must never land here, only .env.example templates.
|
|
.env
|
|
.env.local
|
|
.env.*.local
|
|
**/.env
|
|
!**/.env.example
|
|
|
|
# Live mirror of server /opt/docker/{compose,conf}/ trees pulled by
|
|
# sync-stacks.sh. Contains upstream compose files that can carry embedded
|
|
# plaintext credentials (e.g. legacy seafile/paperless configs), so we
|
|
# don't track them in git. Audited, hand-curated copies live under
|
|
# stacks/<name>/ and are the source of truth.
|
|
stacks-mirror/
|
|
|
|
# Staged htpasswd / secrets files that might get written to /tmp during
|
|
# helper scripts.
|
|
htpasswd-new
|
|
*.netrc
|
|
|
|
# Editor / OS cruft
|
|
.DS_Store
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
|
|
# Logs
|
|
*.log
|
|
*.log.*
|
|
|
|
# Claude Code runtime state — locks, scheduled-task ledgers, etc.
|
|
# Per-machine, not interesting cross-checkout.
|
|
.claude/scheduled_tasks.lock
|
|
.claude/*.lock
|
|
|
|
# graphify: commit only the lightweight labeled map; ignore heavy/regenerable artifacts
|
|
graphify-out/*
|
|
!graphify-out/GRAPH_REPORT.md
|
|
|
|
# Python bytecode (e.g. from local py_compile of stack wrappers)
|
|
__pycache__/
|
|
*.pyc
|
|
stacks/lobe-chat/.env
|
|
|
|
# Fleet ops log — who changed what, when, plus live stack claims
|
|
# (scripts/ops-log, docs/pfi/ops-log.md). Runtime record, not committed
|
|
# intent: it is append-only, machine-written, would conflict on every merge,
|
|
# and every commit here is attributed to Vuong Hoang anyway, so git could
|
|
# not carry the attribution this file exists to provide.
|
|
.ops-log/
|