42 lines
3.7 KiB
Markdown
42 lines
3.7 KiB
Markdown
# albok-service moved to its own VM: nh3-albok (VM 110 on nh3-pve-2)
|
||
|
||
`[2026-10-04]` **albok-service moved off nh3-docker onto nh3-albok, a VM that runs nothing else** (albok-dev relaying
|
||
Prime ~2235; built and cut over by infra-ops 2311–2332). → `servers/nh3-albok/README.md`, `stacks/albok-service/README.md`
|
||
|
||
**Why.** Unit 4 will ingest the operator's personal vault (~7,600 notes) and licensed books into restricted wings. On
|
||
nh3-docker, four things were root over `/srv/albok`: portainer, portainer_agent and dockge (socket rw), and dockerd on
|
||
plaintext **tcp/2375** for Homepage. albok-dev's list named the three containers; the 2375 exposure was found during
|
||
this work and is the bigger one, since any LAN host can reach it. Memory too: 2.4 of a 4 GiB cap on a 7.7 GiB host shared with the post office
|
||
and AdGuard.
|
||
|
||
**What was built.**
|
||
- nh3-pve-2 `vmbr0` made VLAN-aware (`playbooks/nh3-pve-2-vmbr0-vlan-aware.yaml`), applied by a **reboot at 2311 with no
|
||
guests**, never a live ifreload (the 10-03 lesson). AMT port came back up at 1 Gb.
|
||
- VM 110 `nh3-albok`, 10.100.50.44 on VLAN 50, Debian 13 genericcloud + cloud-init, 4 vCPU x86-64-v3 / 12 GiB / 100 GB
|
||
vmstore (`playbooks/nh3-albok-vm.yaml`). `vh` 1000 via cloud-init → infra-ops 850 bootstrapped as vh → the bootstrap
|
||
key taken back off vh (`playbooks/nh3-albok-host.yaml`). Docker 29.8 with `docker` pinned at 851 before install.
|
||
- **Deliberately single-tenant:** no socket containers, no `-H tcp://`, so Homepage cannot discover it. The Albok tile is a static
|
||
`services.yaml` entry; it hot-reloaded without a container recreate. `mem_limit` 4g → 8g.
|
||
- PBS: nh3-pve-2 got storage `pbs-ana` (namespace **`nh3-pve-2`**, created on pbs-ana) and a 21:30 `all 1` vzdump job.
|
||
pbs-nh3's sync is root-namespace recursive, so the DR mirror needed nothing. The `root@pam!fleet-vzdump` secret is
|
||
now vaulted as `pbs-ana/fleet-vzdump-token`. albok-dev asked for "a PBS job on pbs-nh3"; the pbs-ana job keeps the fleet
|
||
pattern and keeps an off-site copy, and they were told why.
|
||
|
||
**Cutover (2330–2332, ~2.5 min down).** Container removed on nh3-docker and its `compose.yaml` renamed
|
||
`compose.yaml.moved-to-nh3-albok-2026-10-04` (a stray `up` there would be a second writer on a stale copy, i.e. split
|
||
brain). One `tar --format=posix --numeric-owner` stream under `sudo /usr/bin/tar` (BULK_DATA, so nothing is recorded).
|
||
Verified by digests only, so no restricted path was printed: 166,305 entries each side, contents identical, and owner/group/
|
||
mode/mtime/type identical. ⚠ **A full-manifest digest that includes `%s` will MISMATCH on directories**: ext4 directory
|
||
st_size reflects blocks once allocated, so it is not data. Split the manifest by field before deciding a copy is bad.
|
||
New host healthy at 2331:25: 4 wings ready, drift 0, needs_reindex 0, so no reindex was needed. Then DNS moved.
|
||
|
||
**CLOSED 2026-10-05 0021.** Acceptance passed at 0018 (albok-check at 2350 and 0018; the Nemi walk 0003–0016 exited 0. Its 1,187
|
||
updates were the restamped source_commit from memory commits, not the move). The old `/srv/albok` (1.4 G) was deleted at 0018.
|
||
First VM 110 backup 0019–0021 to pbs-ana ns nh3-pve-2. The albok user/groups on nh3-docker remain, unused.
|
||
|
||
**Was open (as of 2332):** albok-dev's acceptance (albok-check + one Nemi walk); the first manual PBS backup of VM
|
||
110 after acceptance; deleting the old `/srv/albok` on nh3-docker. **Prime approved the deletion directly at 2349,
|
||
conditional on albok-dev's acceptance passing** (it cannot be undone, so it needed his word, not the relay). Until then it
|
||
sits under the same 2375 exposure as before, with nothing reading it. Delete with literal paths only, and leave the renamed
|
||
compose file as the tombstone.
|