ochenstarik/randomayzer
1
0
Fork 0
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions
randomayzer/agents/codex/done/2026-10-19-r5-vps-container-runbook.md

3.3 KiB
Raw Blame History

Result — R5 runbook for existing proxy containers

Base SHA: 8284eb5d006943d42133eb665c99dcbc3133d6a6 Result SHA: 8284eb5d006943d42133eb665c99dcbc3133d6a6 (working-tree edits only; no commit)

Files changed

  • deploy/randomayzer.Caddyfile — Caddy 2.8 site snippet, Basic Auth fallback, 1 MB request body limit, no access log, safe header overrides, no second proxy/listener.
  • deploy/randomayzer.haproxy.cfg — additive SNI/HTTP routing examples with separate TLS and cleartext Caddy backends and explicit preservation of existing routes/default behavior.
  • deploy/randomayzer.nginx.conf — removed obsolete nginx alternative, which does not match the confirmed Docker Caddy/HAProxy setup.
  • docs/STAGE1_DEPLOYMENT_RUNBOOK.md — R5 operator procedure for actual container topology, redacted inspection, private backups, in-place source updates and inode/hash checks, pre/post validation, no-restart reload gates, other-site baselines, external checks, and rollback. Historical R4 loopback steps remain in place.
  • agents/codex/inbox/2026-10-19-r5-vps-container-runbook.md
  • agents/codex/notes/2026-10-19-r5-vps-container-runbook.md
  • agents/codex/done/2026-10-19-r5-vps-container-runbook.md

Verification actually run

  • docker run --rm --entrypoint caddy caddy:2.8-alpine version — exit 0, local image reports v2.8.4.
  • docker run --rm --entrypoint haproxy haproxy:3.0-alpine -vv — exit 0, local image reports 3.0.30-47d806b.
  • docker run --rm -i --entrypoint caddy caddy:2.8-alpine validate --config /dev/stdin --adapter caddyfile with the proposed site block and an artificial bcrypt hash — exit 0, Valid configuration; formatting and explicit X-Forwarded-For warnings only.
  • python3 temporary-fixture harness running docker run --rm -v <tempdir>:/tmp/config:ro --entrypoint haproxy haproxy:3.0-alpine -c -f /tmp/config/haproxy.cfg — exit 0. The fixture includes TCP SNI routing plus a distinct HTTP/cleartext backend; it is not the unknown active VPS config.
  • git diff --check -- docs/STAGE1_DEPLOYMENT_RUNBOOK.md deploy/randomayzer.Caddyfile deploy/randomayzer.nginx.conf — exit 0.
  • Python trailing-whitespace scan on the new HAProxy example and task inbox — no trailing whitespace.

Parent separately reported target-image validation of these templates; evidence files are under agents/codex/notes/r5-*.

No npm, Prisma or application test/lint/build gates were run for this documentation/config-template task. No remote machine was accessed or changed.

Findings: no new CRITICAL/HIGH/MEDIUM/LOW finding from these local template checks. The runbook intentionally leaves live R5 blocked until actual inspection confirms the host source/config paths, active SNI/HTTP routing, safe HAProxy reload mechanism, Caddy admin endpoint, correct DNS and WG peer. No HAProxy signal/restart is guessed.

UNVERIFIED: exact deployed patch versions; actual HAProxy topology/backend names/master-worker/control socket/reload procedure; active mounted config source paths and inode semantics; port-80 path to Caddy; whether Authelia policy is usable for this vhost; DNS target and peer identity; live issuance/renewal, Basic Auth/VK callback, other-site health and network isolation. No production claim is made.

Remaining blockers: operator/owner must perform the gated inspection and live acceptance. Non-blocking tech debt: none identified in this scoped task.