vh
fb7b5959f3
Deferred-work capture: Vuong approved wiring soong-lab auto-redeploy; operator deferred execution to a fresh context. Recorded in Recent decisions with the mechanism (WT-style CI-deploy step), the blocker (a vh-owned deploy SSH-key secret), and next-session steps; handoff updated to make it the primary task. The "5 AM clock" report was a hallucination in another window — clock verified correct (US/Pacific, NTP-synced), no change.
38 lines
2.3 KiB
Markdown
38 lines
2.3 KiB
Markdown
- `[2026-07-18]` **soong-lab auto-redeploy — APPROVED, queued for next session (DEFERRED, not started).**
|
|
|
|
Vuong approved wiring auto-redeploy for soong-lab (relayed via soong-dev, thread
|
|
`01KXT3A6C3908TA4V9THV3AMH7`): new images should go live on corviduo-dev without
|
|
the manual `docker compose pull && up -d`. Host-side implementation is infra-ops's
|
|
lane; mechanism is infra-ops's call per fleet conventions. Operator deferred
|
|
execution — "we'll do soong on fresh context."
|
|
|
|
**Chosen mechanism (recommended, agrees with soong-dev): Worldtree-style
|
|
CI-deploy step** — NOT watchtower polling.
|
|
- Add a deploy job/step to soong-lab's `.gitea/workflows/build-and-push.yml` that,
|
|
after the build+push job succeeds, **SSHes from the pfi-fleet runner to
|
|
corviduo-dev** and runs `cd /home/infra-ops/soong-lab-deploy && docker compose
|
|
pull && docker compose up -d`, then a **health-gate** (`curl -fsS
|
|
http://localhost:8443/api/version`).
|
|
- This is exactly how WT deploys the demo instance to the SAME host: see
|
|
`~/development/Worldtree/.gitea/workflows/deploy.yml` — the "Deploy to demo VM +
|
|
health-gate" step uses `secrets.DEMO_VM_SSH_KEY` / `DEMO_VM_HOST` / `DEMO_VM_USER`.
|
|
Explicit-over-implicit (visible in the run log, fires exactly on build success),
|
|
one less always-on service than watchtower.
|
|
|
|
**Constraints (from soong-dev):** deploy on CI success only; keep the trigger
|
|
gated to `v*` tags + `workflow_dispatch` (as today); preserve the one-command
|
|
rollback posture (`docker compose down` / pin a previous tag).
|
|
|
|
**BLOCKER — needs from vh (owner-only):** a **runner→corviduo-dev deploy SSH key**
|
|
as a repo secret (+ host/user), same class as WT's `DEMO_VM_SSH_KEY`. Likely
|
|
**reuse WT's existing demo-deploy key** (WT's runner already SSHes to 10.250.50.152
|
|
as its deploy user). Repo secrets are vh-owner-only (see
|
|
[[2026-07-18-fleet-gitea-runner-build-recipe]]).
|
|
|
|
**Next-session steps:** (1) confirm/obtain the deploy SSH-key secret from vh (reuse
|
|
WT's or mint fresh); (2) add the deploy job to build-and-push.yml (infra-ops has
|
|
push on vh/soong-lab); (3) dispatch a build to verify it deploys + health-gates;
|
|
(4) ping soong-dev so they sync DEPLOY.md's "open follow-up" note to the as-built
|
|
mechanism. Auto-pull (watchtower) explicitly NOT chosen. See
|
|
[[2026-07-18-soong-lab-containerize-cutover]].
|