mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-11 05:06:36 +00:00
kevinveenbirkenbachandClaude Opus 5.5
ff288a3dd4
Brings feature/updater3966abdb16, including updater-lockdown-probe: the deferred probe host guard (aa88429c25), the per-host post-load queue (70ed8a2e98), the NFS probe noauto (0ece4fcbc4), the E2E prepull gate (ef20262813), the worktree swarm lab subnet fixes, the Tor port window and restart skip, the Prometheus Docker poller, the Stalwart JMAP client cache and the FusionDirectory PHP hardening mount. Conflict resolutions: - plugins/lookup/email.py: keep store-i18n's NETWORK_MODE forwarding into the provider view and add updater's provider carrier. - roles/svc-net-tor/templates/test.env.j2: updater's ONION_PORT_TIMEOUT=130, store-i18n's ONION_SUFFIX. - roles/svc-swarm-node/README.md: updater's ingress guard wording, without the generated Quick Setup and Credits sections. - roles/test-e2e-cli/tasks/main.yml: updater's cli_role_id loop variable with store-i18n's async cli.once condition. - roles/web-app-prometheus/templates/nginx/locations.conf.j2: store-i18n's entity_name filter with updater's container_service lookup. - tasks/stages/01_constructor.yml: updater's order (svc-swarm-node after the preload context opens) under store-i18n's task name, whose loop also covers svc-cache. Integration fixes: - roles/sys-stk-front-proxy: git applied updater's IS_STACK_HOST guard to the "Freeze front proxy context" task, which would have left workers without front_proxy_* facts. main.yml stays as on store-i18n; the guard moves into the per-sibling vhost.yml split, where the probe facts and the queue sit behind IS_STACK_HOST and front_proxy_domain_conf_dst_resolved stays unguarded for the Deploy arguments. deferred_probe.yml takes updater's host guard verbatim. - roles/svc-net-tor/tasks/00_core.yml: the restart probe tests IS_SWARM_MODE instead of a literal DEPLOYMENT_MODE comparison. - roles/web-app-stalwart/tasks/jmap_call.yml: the cached client splits into stalwart_jmap_url and stalwart_jmap_user_password, so the exec argv references no fact that carries a credential. - roles/sys-service-loader/tasks/list_or_shoot.yml: the two direct-shoot tasks share their preload condition in one block. - tests: the Prometheus wiring test imports entity_name and pins the host resources its renders need; the email carrier tests use an onion-only provider, which on store-i18n is what drops TLS (a dual-stack provider keeps it). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
120 lines
3.5 KiB
Bash
Executable File
120 lines
3.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# shellcheck shell=bash
|
|
#
|
|
# Create an isolated git worktree for a branch and pin it to a free slot, so
|
|
# its compose stack no longer collides with the primary checkout on subnet,
|
|
# host ports, container names or volumes. The cache stack is not duplicated:
|
|
# the worktree joins the running one over an external network.
|
|
#
|
|
# Use `make worktree-up` rather than calling this script directly.
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
|
|
|
|
# shellcheck source=scripts/system/worktree/lib.sh
|
|
source "${SCRIPT_DIR}/lib.sh"
|
|
|
|
branch="${1:?branch name required}"
|
|
base="${2:-}"
|
|
max_slot=255
|
|
|
|
cd "${REPO_ROOT}"
|
|
|
|
base="${base:-$(worktree_default_base)}"
|
|
|
|
slug="$(worktree_slug "${branch}")"
|
|
if [ -z "${slug}" ]; then
|
|
echo "FAILURE: branch '${branch}' slugs to an empty name" >&2
|
|
exit 1
|
|
fi
|
|
|
|
path="$(worktree_path "${branch}" "${base}")"
|
|
mkdir -p "$(dirname "${path}")"
|
|
if [ -e "${path}" ]; then
|
|
echo "FAILURE: ${path} already exists; run 'make worktree-down branch=${branch}' first" >&2
|
|
exit 1
|
|
fi
|
|
|
|
slot="$(worktree_next_slot)"
|
|
if [ "${slot}" -gt "${max_slot}" ]; then
|
|
echo "FAILURE: no free slot left (max ${max_slot}); tear down an existing worktree" >&2
|
|
exit 1
|
|
fi
|
|
|
|
cache_network="$(worktree_cache_network)"
|
|
if [ -z "${cache_network}" ]; then
|
|
echo ">>> WARNING: no running cache stack found; the worktree will start without a shared cache"
|
|
fi
|
|
|
|
echo ">>> Creating worktree for '${branch}' at ${path} (slot ${slot})"
|
|
git worktree add "${path}" "${branch}"
|
|
|
|
git_common_dir="$(git rev-parse --path-format=absolute --git-common-dir)"
|
|
|
|
lab_prefix="10.160.${slot}"
|
|
|
|
echo ">>> Pinning slot ${slot} in ${path}/custom.env"
|
|
cat >"${path}/custom.env" <<PINS
|
|
INFINITO_INSTANCE=${slot}
|
|
INFINITO_GIT_COMMON_DIR=${git_common_dir}
|
|
INFINITO_SUBNET=172.30.${slot}.0/24
|
|
INFINITO_GATEWAY=172.30.${slot}.1
|
|
INFINITO_DNS_IP=172.30.${slot}.53
|
|
INFINITO_IP4=172.30.${slot}.10
|
|
INFINITO_BIND_IP=127.0.0.$((slot + 1))
|
|
INFINITO_SWARM_LAB_SUBNET=${lab_prefix}.0/24
|
|
INFINITO_SWARM_MGR_IP=${lab_prefix}.10
|
|
INFINITO_SWARM_WRK1_IP=${lab_prefix}.11
|
|
INFINITO_SWARM_WRK2_IP=${lab_prefix}.12
|
|
INFINITO_SWARM_NFS_IP=${lab_prefix}.13
|
|
INFINITO_SWARM_BACKUP_IP=${lab_prefix}.14
|
|
INFINITO_RUNNER_PREFIX=infinito-${slug}
|
|
INFINITO_CONTAINER=infinito_nexus_${slug//[.-]/_}
|
|
INFINITO_CACHE_NETWORK=${cache_network}
|
|
PINS
|
|
|
|
echo ">>> Generating .env from the pins"
|
|
env -i -C "${path}" \
|
|
HOME="${HOME}" \
|
|
PATH="${PATH}" \
|
|
INFINITO_INSTANCE="${slot}" \
|
|
INFINITO_GIT_COMMON_DIR="${git_common_dir}" \
|
|
INFINITO_SUBNET="172.30.${slot}.0/24" \
|
|
INFINITO_GATEWAY="172.30.${slot}.1" \
|
|
INFINITO_DNS_IP="172.30.${slot}.53" \
|
|
INFINITO_IP4="172.30.${slot}.10" \
|
|
INFINITO_BIND_IP="127.0.0.$((slot + 1))" \
|
|
INFINITO_SWARM_LAB_SUBNET="${lab_prefix}.0/24" \
|
|
INFINITO_SWARM_MGR_IP="${lab_prefix}.10" \
|
|
INFINITO_SWARM_WRK1_IP="${lab_prefix}.11" \
|
|
INFINITO_SWARM_WRK2_IP="${lab_prefix}.12" \
|
|
INFINITO_SWARM_NFS_IP="${lab_prefix}.13" \
|
|
INFINITO_SWARM_BACKUP_IP="${lab_prefix}.14" \
|
|
INFINITO_RUNNER_PREFIX="infinito-${slug}" \
|
|
INFINITO_CACHE_NETWORK="${cache_network}" \
|
|
python3 -m cli.meta.env
|
|
|
|
cat <<SUMMARY
|
|
|
|
Worktree ready.
|
|
|
|
branch ${branch}
|
|
path ${path}
|
|
slot ${slot}
|
|
subnet 172.30.${slot}.0/24
|
|
bind IP 127.0.0.$((slot + 1))
|
|
container infinito_nexus_${slug//[.-]/_}
|
|
cache net ${cache_network:-<none>}
|
|
domain $(awk -F= '$1 == "INFINITO_DOMAIN" { print $2 }' "${path}/.env")
|
|
|
|
Next:
|
|
cd ${path}
|
|
make compose-up
|
|
make network-dns-setup # routes the domain above to the bind IP
|
|
|
|
Release with:
|
|
make worktree-down branch=${branch}
|
|
SUMMARY
|