51 lines
5.4 KiB
Markdown
51 lines
5.4 KiB
Markdown
# Auditor1 R5 runbook review
|
|
|
|
## Scope and revision
|
|
|
|
- Base SHA: `8284eb5d006943d42133eb665c99dcbc3133d6a6`
|
|
- Reviewed SHA: `ca28be6ae629d3d67936475ea5896b6f70f6e1e4`
|
|
- Review scope: immutable R5 delta, especially `deploy/randomayzer.haproxy.cfg`, `deploy/randomayzer.Caddyfile`, `docs/STAGE1_DEPLOYMENT_RUNBOOK.md`, and `agents/codex/notes/validate-r5-templates.sh`.
|
|
- Resulting code SHA: not applicable; reviewer made no production or test changes.
|
|
- Changed files: this report and its assignment only; pre-existing `AGENTS.md` modification left untouched.
|
|
|
|
## Findings
|
|
|
|
### MEDIUM — HAProxy no-restart reload procedure is not executable from this runbook
|
|
|
|
`docs/STAGE1_DEPLOYMENT_RUNBOOK.md:396-403` deliberately leaves out the HAProxy reload command, and requires the operator to independently discover and prove a safe native reload method. The rollback at `:449-453` likewise requires “both confirmed reload commands.” The task's acceptance explicitly requires reloading without restarting the shared proxy. Until the operator has separately established the process model and worked out the command, this runbook cannot perform or roll back that accepted operation; it correctly blocks rather than guessing, but does not yet supply an executable conditional path.
|
|
|
|
Reproducer/evidence: inspect the runbook at those lines; there is no HAProxy command or procedure to establish the target process and verify graceful worker handoff. `git diff --check 8284eb5d006943d42133eb665c99dcbc3133d6a6 ca28be6ae629d3d67936475ea5896b6f70f6e1e4` exited 0, but does not address this operational gap. No live VPS process model was inspected.
|
|
|
|
### LOW — Directory-tree backup copies have no explicit completion/integrity check
|
|
|
|
For directory mounts, `docs/STAGE1_DEPLOYMENT_RUNBOOK.md:289-304` copies both active trees and both host source trees, but unlike the single-file path at `:284-286`, it has no explicit check that all four copies completed or that the saved trees match their source. The later hash guidance at `:306-307` is general and does not provide a tree-backup verification command. A partial `docker cp`/`cp -a` can therefore leave an incomplete private backup before edits proceed, reducing rollback confidence.
|
|
|
|
Reproducer/evidence: follow the directory-mount backup block; after its four copy commands it only runs `chmod`. No `diff`, manifest/hash, or copy-result gate verifies the backup trees. `bash -n agents/codex/notes/validate-r5-templates.sh` exited 0; the validator is a syntax/config fixture and does not exercise VPS backup commands.
|
|
|
|
## Reviewed controls that appear correctly represented
|
|
|
|
- The runbook gates work on confirmed domain/VPS/WireGuard facts and says to stop for unknown topology (`docs/STAGE1_DEPLOYMENT_RUNBOOK.md` R5 preflight and sections 6.1-6.2).
|
|
- It requires root context for `/root` backups, avoids printing `.Config.Env`, backs up both active configs and host sources for file mounts, restricts backup permissions, compares active/source content, and preserves single-file bind-mount inode during edits (`:260-332`). The separate directory-tree integrity gap is above.
|
|
- HAProxy SNI routing is conditional on confirmed TCP TLS passthrough; the new explicit hostname rule is to follow existing explicit routes and precede catch-all. Port 80 is conditional on existing HTTP routing and must preserve the ACME challenge path unmodified and target Caddy's cleartext HTTP backend (`:352-361`).
|
|
- Caddy and HAProxy are validated inside their running containers before and after edits (`:310-323`, `:363-381`). Caddy reload is concrete and gated on its active admin endpoint; container ID/uptime checks and prior-site baseline checks are specified (`:383-415`).
|
|
- Rollback limits restoration to changed files, preserves mounted-file inode, validates both configs, and explicitly prohibits restarting/recreating the shared proxy (`:440-456`).
|
|
- The local fixture script is syntactically valid and scoped to Docker network none. It was not executed in this review, per coordinator instruction to avoid duplicating the validator run.
|
|
|
|
## Commands and results
|
|
|
|
- `git rev-parse HEAD` — `ca28be6ae629d3d67936475ea5896b6f70f6e1e4`.
|
|
- `git diff --check 8284eb5d006943d42133eb665c99dcbc3133d6a6 ca28be6ae629d3d67936475ea5896b6f70f6e1e4` — exit 0.
|
|
- `bash -n agents/codex/notes/validate-r5-templates.sh` — exit 0.
|
|
- No application tests/build, Docker template validator, Docker commands, or VPS commands were run by this reviewer. Root owns the full gates and validator.
|
|
|
|
## UNVERIFIED and blockers
|
|
|
|
- Actual VPS container arguments, mounts, active config paths, HAProxy routing order, HAProxy process model/reload mechanism, Caddy admin endpoint, and source/active inode relationship were not observable from this local review.
|
|
- Public DNS, live TLS/ACME issuance, external auth/login, WireGuard peer identity, firewall isolation, and preservation of existing public sites remain UNVERIFIED.
|
|
- Parent reported a local fixture experiment with a `haproxy -W -db` master-worker process and USR2 signal; that is not evidence of the actual VPS process model and was not used to close the finding.
|
|
- No project phase or deployment is declared closed.
|
|
|
|
## Remaining non-blocking debt
|
|
|
|
- Add a conditional HAProxy reload branch only when the active PID 1/process model and exact config set are inspected, then specify observable graceful-handoff and unchanged-container checks plus failure/rollback handling.
|
|
- Add explicit verification for all active/source directory-tree backup copies before permitting edits.
|