From f262cdd9a3d6e4403e2674fc77fe4e89b99bf14c Mon Sep 17 00:00:00 2001 From: mpabi Date: Sun, 12 Apr 2026 20:18:13 +0200 Subject: [PATCH] docs(cutover): record sol public edge status --- doc/migration-todo.md | 2 ++ doc/sol-cutover-checklist.md | 17 ++++++++++++----- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/doc/migration-todo.md b/doc/migration-todo.md index 721bb05..7c67e10 100644 --- a/doc/migration-todo.md +++ b/doc/migration-todo.md @@ -207,6 +207,8 @@ Date: `2026-04-12` - Done on `2026-04-12`: `trade-next` was created and the target repositories now exist. - Done on `2026-04-12`: the live component boundary map was written to `trade-next/trade-docs/doc/k3s-component-repo-map.md`. - Done on `2026-04-12`: bootstrapped `trade-next/trade-gitops` with the first runnable IaC module for `sol` under `bootstrap/gitea-actions`. +- Done on `2026-04-12`: committed the `sol` public-edge host and cluster modules to `trade-next/trade-host-iac` and `trade-next/trade-gitops`. +- Done on `2026-04-12`: `sol` now serves the reconstructed `R001` frontend on public `HTTP/HTTPS` at `149.50.96.162`; the remaining production cutover step is authoritative DNS `trade.mpabi.pl -> 149.50.96.162` so Let's Encrypt can finish issuance. - Next for item `02`: reconstruct the live `trade-staging` objects, overlays, secrets wiring, and host-specific drift into `trade-gitops` and `trade-host-iac`. ### 03. Fix `dlob-publisher-hot` startup, readiness, and liveness diff --git a/doc/sol-cutover-checklist.md b/doc/sol-cutover-checklist.md index 3ddd8d5..7e34685 100644 --- a/doc/sol-cutover-checklist.md +++ b/doc/sol-cutover-checklist.md @@ -23,17 +23,23 @@ Finalize public cutover of the reconstructed `R001` trade surface from `mevnode_ ## Public cutover steps -- [ ] Sync org secret `SOL_SSH_PRIVATE_KEY_B64` for `trade-next`. -- [ ] Open `80/tcp` and `443/tcp` on `sol` from the `trade-next` public-edge workflow. -- [ ] Apply `trade-next/trade-gitops/environments/sol/public-edge`. -- [ ] Verify `Traefik` is listening on `80` and `443`. -- [ ] Verify `cert-manager` and `ClusterIssuer/letsencrypt-prod` are `Ready`. +- [x] Sync org secret `SOL_SSH_PRIVATE_KEY_B64` for `trade-next`. +- [x] Open `80/tcp` and `443/tcp` on `sol` from the `trade-next` public-edge workflow. +- [x] Apply `trade-next/trade-gitops/environments/sol/public-edge`. +- [x] Verify `Traefik` is listening on `80` and `443`. +- [x] Verify `cert-manager` and `ClusterIssuer/letsencrypt-prod` are `Ready`. - [ ] Change authoritative DNS record `trade.mpabi.pl A 149.50.96.162`. - [ ] Wait for `Certificate/trade-mpabi-pl-tls` to become `Ready=True`. - [ ] Verify `https://trade.mpabi.pl/healthz`. - [ ] Verify `https://trade.mpabi.pl/` login and UI load. - [ ] Re-run canary smoke check after DNS/TLS cutover. +## Current status + +- Done on `2026-04-12 20:16 CEST`: public `HTTP` on `149.50.96.162:80` returns `301` to `https://trade.mpabi.pl/...`. +- Done on `2026-04-12 20:16 CEST`: `https://trade.mpabi.pl/healthz` answers `200` when forced to `149.50.96.162` with `curl --resolve`, currently using the default Traefik certificate before Let's Encrypt issuance completes. +- Remaining blocker for production TLS: the authoritative `trade.mpabi.pl` `A` record still points away from `149.50.96.162`, so the ACME `HTTP-01` challenge remains pending. + ## What still lived only on `mevnode_bot` - old `trade-staging` namespace and its historical runtime state @@ -50,3 +56,4 @@ Finalize public cutover of the reconstructed `R001` trade surface from `mevnode_ - I could not confirm the final live-vs-live diff on `mevnode_bot` immediately before shutdown because the host stopped answering over SSH during the last checks. - Because of that, the checklist above is authoritative for the reconstructed `R001` on `sol`, but not a forensic inventory of every leftover object on the old host. +- The `trade-next` workflow definitions are committed and current, but the latest `deploy-sol-public-edge` trigger did not materialize a fresh Gitea Actions run after the workflow update, so the live cluster state above was applied from the same committed manifests outside the runner path.