vh
d3f59aa2c5
albok-service leaves nh3-docker before unit 4 puts the personal vault and licensed books into restricted wings. On nh3-docker, portainer, portainer_agent, dockge (socket rw) and dockerd on plaintext tcp/2375 were each root over /srv/albok. The new host runs only albok-service: no socket containers and no TCP Docker API, so its Homepage tile is a static services.yaml entry. - nh3-pve-2: vmbr0 made VLAN-aware (applied by reboot, no guests running); pbs-ana storage in the new namespace nh3-pve-2, plus a 21:30 vzdump job (pbs-nh3's recursive sync mirrors it) - VM 110 nh3-albok, 10.100.50.44 on VLAN 50, Debian 13 cloud-init, 4 vCPU x86-64-v3 / 12 GiB / 100 GB; built to fleet conventions (vh 1000, infra-ops 850, docker 851) - compose: mem_limit 4g -> 8g, homepage labels removed; host port 8392 kept - cutover by tar stream, verified by digest (contents plus owner, group, mode, mtime and type identical); albok.nh3.internal now points at nh3-albok - old /srv/albok stays on nh3-docker (container removed, compose renamed) until acceptance and the operator's approval to delete it - sudo-io archive hosts and ops-log STACK_HOSTS include nh3-albok
50 lines
2.7 KiB
YAML
50 lines
2.7 KiB
YAML
# albok-service — the fleet knowledgebase service (vh/albok, packages/albok-service). The only
|
|
# writer of the buildings-and-wings store. Requested by albok-dev 2026-10-02 (operator-approved).
|
|
# Host: nh3-albok (VM 110 on nh3-pve-2, 10.100.50.44) since 2026-10-04, a VM that runs ONLY this.
|
|
# It moved off nh3-docker, where portainer/dockge/the agent and dockerd on tcp/2375 were all root
|
|
# over the store (servers/nh3-albok/README.md).
|
|
#
|
|
# Deploy: scripts/elway infra-ops@10.100.50.44 --playbook playbooks/albok-service-host.yaml (host prep, config)
|
|
# scripts/deploy-stack.sh nh3-albok albok-service (this file + conf/)
|
|
# Image: built from a clean `git archive` of vh/albok, pushed to the pfi org (see README.md).
|
|
#
|
|
# ⚠ Host port 8392 (kept from nh3-docker, where 8390 was the post office) so clients did not change.
|
|
# ⚠ Exactly ONE instance per private root: a second one exits 75 on the lease. Never scale this.
|
|
# ⚠ Nothing else may mount /srv/albok/store read-write. Viewers mount it :ro with group_add by gid
|
|
# (1510 albok-read, 1511 albok-personal) and need GIT_OPTIONAL_LOCKS=0 + a safe.directory entry.
|
|
# 1512 albok-feedback (restricted wing personal/agent-feedback) is default-deny: no viewer gets it.
|
|
services:
|
|
albok-service:
|
|
image: gitea.phasefinal.com/pfi/albok-service:0.1.8@sha256:239f900ee39a26414f34afe9b7583253986d838df9988228fab1039d18c414df
|
|
container_name: albok-service
|
|
restart: unless-stopped
|
|
ports:
|
|
- "8392:8390"
|
|
# Membership the service needs to chgrp wing dirs to the read groups (it runs as uid 1500, not root).
|
|
group_add:
|
|
- "1510"
|
|
- "1511"
|
|
- "1512" # albok-feedback: restricted wing personal/agent-feedback
|
|
volumes:
|
|
- /srv/albok/store:/srv/albok/store
|
|
- /srv/albok/private:/srv/albok/private
|
|
- /srv/albok/etc/albok.yaml:/etc/albok/albok.yaml:ro
|
|
# the read groups must RESOLVE BY NAME inside the container (layout.py uses grp.getgrnam)
|
|
- /opt/docker/conf/albok-service/group:/etc/group:ro
|
|
mem_limit: 8g # 4g on nh3-docker (7.7 GiB shared host); 12 GiB VM to itself now
|
|
healthcheck:
|
|
test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8390/health', timeout=5).status == 200 else 1)"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 60s
|
|
networks:
|
|
- tnet
|
|
# No homepage.* labels: Homepage discovers containers over a host's tcp/2375, and this host must not
|
|
# expose its Docker API. The Albok tile is a static entry in stacks/homepage/conf/services.yaml.
|
|
|
|
networks:
|
|
tnet:
|
|
name: traefik-net
|
|
external: true
|