trade-next/trade-docs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(cutover): record sol public edge status

Browse Source
This commit is contained in:
mpabi
2026-04-12 20:18:13 +02:00
parent 48092b4158
commit f262cdd9a3
2 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
doc/migration-todo.md
View File

@@ -207,6 +207,8 @@ Date: `2026-04-12`
- Done on `2026-04-12`: `trade-next` was created and the target repositories now exist.
- Done on `2026-04-12`: the live component boundary map was written to `trade-next/trade-docs/doc/k3s-component-repo-map.md`.
- Done on `2026-04-12`: bootstrapped `trade-next/trade-gitops` with the first runnable IaC module for `sol` under `bootstrap/gitea-actions`.
- Done on `2026-04-12`: committed the `sol` public-edge host and cluster modules to `trade-next/trade-host-iac` and `trade-next/trade-gitops`.
- Done on `2026-04-12`: `sol` now serves the reconstructed `R001` frontend on public `HTTP/HTTPS` at `149.50.96.162`; the remaining production cutover step is authoritative DNS `trade.mpabi.pl -> 149.50.96.162` so Let's Encrypt can finish issuance.
- Next for item `02`: reconstruct the live `trade-staging` objects, overlays, secrets wiring, and host-specific drift into `trade-gitops` and `trade-host-iac`.
### 03. Fix `dlob-publisher-hot` startup, readiness, and liveness

17
doc/sol-cutover-checklist.md
View File

@@ -23,17 +23,23 @@ Finalize public cutover of the reconstructed `R001` trade surface from `mevnode_
## Public cutover steps
- [ ] Sync org secret `SOL_SSH_PRIVATE_KEY_B64` for `trade-next`.
- [ ] Open `80/tcp` and `443/tcp` on `sol` from the `trade-next` public-edge workflow.
- [ ] Apply `trade-next/trade-gitops/environments/sol/public-edge`.
- [ ] Verify `Traefik` is listening on `80` and `443`.
- [ ] Verify `cert-manager` and `ClusterIssuer/letsencrypt-prod` are `Ready`.
- [x] Sync org secret `SOL_SSH_PRIVATE_KEY_B64` for `trade-next`.
- [x] Open `80/tcp` and `443/tcp` on `sol` from the `trade-next` public-edge workflow.
- [x] Apply `trade-next/trade-gitops/environments/sol/public-edge`.
- [x] Verify `Traefik` is listening on `80` and `443`.
- [x] Verify `cert-manager` and `ClusterIssuer/letsencrypt-prod` are `Ready`.
- [ ] Change authoritative DNS record `trade.mpabi.pl A 149.50.96.162`.
- [ ] Wait for `Certificate/trade-mpabi-pl-tls` to become `Ready=True`.
- [ ] Verify `https://trade.mpabi.pl/healthz`.
- [ ] Verify `https://trade.mpabi.pl/` login and UI load.
- [ ] Re-run canary smoke check after DNS/TLS cutover.
## Current status
- Done on `2026-04-12 20:16 CEST`: public `HTTP` on `149.50.96.162:80` returns `301` to `https://trade.mpabi.pl/...`.
- Done on `2026-04-12 20:16 CEST`: `https://trade.mpabi.pl/healthz` answers `200` when forced to `149.50.96.162` with `curl --resolve`, currently using the default Traefik certificate before Let's Encrypt issuance completes.
- Remaining blocker for production TLS: the authoritative `trade.mpabi.pl` `A` record still points away from `149.50.96.162`, so the ACME `HTTP-01` challenge remains pending.
## What still lived only on `mevnode_bot`
- old `trade-staging` namespace and its historical runtime state
@@ -50,3 +56,4 @@ Finalize public cutover of the reconstructed `R001` trade surface from `mevnode_
- I could not confirm the final live-vs-live diff on `mevnode_bot` immediately before shutdown because the host stopped answering over SSH during the last checks.
- Because of that, the checklist above is authoritative for the reconstructed `R001` on `sol`, but not a forensic inventory of every leftover object on the old host.
- The `trade-next` workflow definitions are committed and current, but the latest `deploy-sol-public-edge` trigger did not materialize a fresh Gitea Actions run after the workflow update, so the live cluster state above was applied from the same committed manifests outside the runner path.