Roadmap: remaining infra and secrets work (tracker) #122
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Tracking issue for everything left after the 2026-10-13 session. Status as of ~19:50 EDT (updated). #77 and #126 merged; rotated secrets and the provisioner fix are deployed (Forgejo and Vaultwarden SSO verified; Grafana is disabled by design); the Terraform apply is done and clean (
./infra plan: no changes, no drift). CI green, queue empty,main=221396d, operator checkout synced, #125 merged, staging #573 passed and #77 validated atfd26dc3. Work top to bottom; later items depend on earlier ones.plan-prod.sh, merge #77, deploy secrets together; then deploy metrics/cAdvisor (host memory ~95 MB free)secrets/dev.sops.ymland drills are operator-machine workMerged today: #98, #99, #100 (P8 code), #103, #104 (dependency bumps), #105, #107, #108, #109 (P7 convention), #110, #111, #113, #114, #115, #123, #124; forge-agent #3, app-skeleton #1.
Open PRs: #138 (promotion to production: merge after
./infra plan; approval only), #101, #102 (green; merge or close), #106 (redundant, close). #136 (trivy report keeps failing images) and #137 (staging TCP probe retries) are merged; staging run API 607 (UI #416) is green, validated ata1250c6. Staging run API 599 (UI #408) passed; promotion PR #135 is open (validated atbbc8565= main head). Branches cleaned up (merged ones deleted).Blockers right now: none; no alert is firing and everything merged is deployed and verified (rotated secrets, provisioner fix, metrics/cAdvisor, phone push, alert email, journald cap; Terraform clean). Needs a look (#121):
trivy-scan(119 CRITICAL across 9 of 15 images on 2026-10-11, before the #103 patch updates); its report was dropping the failing images, fixed in #136 (merged; deploy waits for promotion PR #138 and./infra deploy --tags hardening --limit services, see #116). Thebackup-restore-testfailures were investigated: the scheduled 2026-10-12 run passed fully (primary and OVH secondary restore), and the two red units were manualsystemd-runruns without the service environment. Open checks: the new Vaultwarden admin token at/admin; the other three Postfix sender keys; the Bitwarden re-save and live rotation-lock test (#117). Resolved today: stale state lock, SSOinvalid_client, provisioner deploy, Terraform apply, host memory, phone push, alert email,alerts@key, journald cap and disk.Gate status lives in
docs/secrets-remediation.md; update its rows as each issue closes.Tracker update 2026-10-14 ~12:00 EDT (the body above is stale):
Open PRs: none.
Tracker update 2026-10-15: rotation wave 1 is done and deployed (forgejo, headscale, ci-ephemeral-wakeup, lldap); details and the wave 2 checklist (19 provider-issued credentials) and wave 3 decisions (5) are in #117. New operator tooling merged:
./infra approvecarry-over and retry (#164, #174),./infra secrets get(#175),vault-prhook fix and the deploy gate's uncommitted-vault refusal (#167). Production = main (prodat the #178 promotion). Open PRs: none. Still blocked as before: #118 gate test 2, #119 history search/Trash, #120 until P8/P7/R close.Roadmap status 2026-10-17. Completed this cycle: OVH rehearsal on both nodes; Terraform state snapshot into every backup (6 workspaces, both repos); DR-relevant firewall fix; Traefik->web over the tailnet; tailnet ACL admin group + Authelia login policy + Alertmanager behind Authelia (tracking #251, deployed and verified); manage CLI: user roles/access/grant/revoke, health fixes, restore snapshot validation, node list on macOS; cleanup items A, B, D and the safe part of C (#204). In progress: OVH cutover prep (#187: firewall tag on ovh-services, stale Headscale nodes, name swap and backup flip decisions); #220 (dedicated state bucket, OVH copy, encryption); #242 (Headscale DNS names). Not started: DR drill, tag:ci split (#251), coach-site backup unit fix (#240, other repo), rest of cleanup C (waits on #120).