Promote to production #135

Merged

jfraeys merged 10 commits from main into prod 2026-10-13 18:20:06 -04:00

Conversation 0 Commits 10 Files changed 11 +264 -138

jfraeys commented 2026-10-13 18:09:06 -04:00

Owner

Copy link

Promotion: staging passed. Run scripts/plan-prod.sh locally before merging

Merging this PR is the approval record; it deploys nothing. Then check out the validated commit and run scripts/promote-prod.sh (or scripts/deploy-services.sh --tags ... --limit services for an Ansible-only change); both refuse any other commit.

Staging validation: passed on commit bbc85650c0 (this run)
Production drift check: clean

Ansible preview (staging clone, synthetic secrets — approximate, not exact prod values)

PLAY [Deploy the Docker-based services stack] **********************************
skipping: no hosts matched

PLAY RECAP *********************************************************************

### Promotion: staging passed. Run `scripts/plan-prod.sh` locally before merging Merging this PR is the approval record; it deploys nothing. Then check out the validated commit and run `scripts/promote-prod.sh` (or `scripts/deploy-services.sh --tags ... --limit services` for an Ansible-only change); both refuse any other commit. **Staging validation:** passed on commit bbc85650c0cb074cf834742e255a7eada6679811 (this run) **Production drift check:** clean ### Ansible preview (staging clone, synthetic secrets — approximate, not exact prod values) ``` PLAY [Deploy the Docker-based services stack] ********************************** skipping: no hosts matched PLAY RECAP ********************************************************************* ```

jfraeys added 10 commits 2026-10-13 18:09:06 -04:00

fix(hardening): cap the persistent systemd journal at 500M ... e386ef03f8

The journal reached 2.4 GB of the 25 GB services disk (82% used, HostDiskSpaceWarning) because nothing capped it.
A journald drop-in sets SystemMaxUse (hardening_journald_max_use); changing it restarts journald and vacuums once.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

ci(lint): run amtool check-config in CI with a checksum-pinned amtool ... 59ce6cc4b5

The lint runners have no Docker, so the Alertmanager config test skipped its amtool step there. The job now installs a pinned
amtool (v0.34.1, SHA-256 checked, registered in docs/tool-versions.yml); the test uses a local amtool, else Docker, else skips.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

ci(lint): pinned promtool, amtool, sops and age so the alert-rule and key-isolation tests run in CI ... 5600d6eecc

The runners have no Docker, sops or age, so test-alert-rules.sh and test-project-key-isolation.sh printed SKIP in the lint job.
One checksum-verified install step now provides all four (promtool 3.15.0 = running Prometheus); test-alert-rules.sh uses a
local promtool, else Docker, else skips. Registered in docs/tool-versions.yml.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Merge pull request 'ci(lint): run amtool check-config in CI (checksum-pinned amtool)' (#131) from jfraeys/ci/amtool-in-lint into main bc1ec7ac4b

Merge pull request 'ci(lint): pinned promtool, sops and age so the alert-rule and key-isolation tests run in CI (stacked on #131)' (#132) from jfraeys/ci/pinned-test-tools into main f1a4ee88ce

chore(secrets): new POSTFIX_SENDER_ALERTS_APIKEY (the old key was rejected by Zedmail with 535) ... 6530355942

Encrypted vault only; the value is not shown anywhere. Postfix already runs with the new key (operator redeployed it).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Merge pull request 'chore(secrets): new POSTFIX_SENDER_ALERTS_APIKEY after Zedmail rejected the old one' (#133) from jfraeys/chore/alerts-sender-key into main b72232a205

Merge pull request 'fix(hardening): cap the persistent systemd journal at 500M' (#127) from jfraeys/fix/journald-size-cap into main ... fae7a21696

Reviewed-on: #127

fix(staging): the journald-cap check belongs to the post-deploy validation pass ... ac0a511cca

The first validate-hardening pass runs before web.yml/services.yml apply the hardening role, so the drop-in does not exist yet and
the check failed both staging nodes (run #596 after the journald-cap merge). Gate it like the auditd and Docker checks.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Merge pull request 'fix(staging): run the journald-cap check in the post-deploy validation pass' (#134) from jfraeys/fix/journald-check-post-deploy into main bbc85650c0

jfraeys referenced this pull request 2026-10-13 18:09:48 -04:00

Next: immediate steps (merge, deploy, verify) after the 2026-10-13 session #116

jfraeys referenced this pull request 2026-10-13 18:09:48 -04:00

Infra backlog: capacity, CI verification, alerts, older loose ends #121

jfraeys referenced this pull request 2026-10-13 18:09:49 -04:00

Roadmap: remaining infra and secrets work (tracker) #122

jfraeys merged commit a6d72191b5 into prod 2026-10-13 18:20:06 -04:00

jfraeys referenced this pull request from a commit 2026-10-13 18:20:08 -04:00

Merge pull request 'Promote to production' (#135) from main into prod

jfraeys referenced this pull request 2026-10-13 19:03:19 -04:00

fix(staging): retry the TCP connectivity probes that expect an open port #137

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jfraeys/infra!135

No description provided.