Promote to production #130

Merged
jfraeys merged 6 commits from main into prod 2026-10-13 17:03:00 -04:00
Owner

Promotion: staging passed. Run scripts/plan-prod.sh locally before merging

Merging this PR is the approval record; it deploys nothing. Then check out the validated commit and run scripts/promote-prod.sh (or scripts/deploy-services.sh --tags ... --limit services for an Ansible-only change); both refuse any other commit.

Staging validation: passed on commit 7aafd49550 (this run)
Production drift check: clean

Ansible preview (staging clone, synthetic secrets — approximate, not exact prod values)


PLAY [Deploy the Docker-based services stack] **********************************
skipping: no hosts matched

PLAY RECAP *********************************************************************
### Promotion: staging passed. Run `scripts/plan-prod.sh` locally before merging Merging this PR is the approval record; it deploys nothing. Then check out the validated commit and run `scripts/promote-prod.sh` (or `scripts/deploy-services.sh --tags ... --limit services` for an Ansible-only change); both refuse any other commit. **Staging validation:** passed on commit 7aafd49550fcb1cfe9c0cee48aef4bb5dd2317ce (this run) **Production drift check:** clean ### Ansible preview (staging clone, synthetic secrets — approximate, not exact prod values) ``` PLAY [Deploy the Docker-based services stack] ********************************** skipping: no hosts matched PLAY RECAP ********************************************************************* ```
feat: ./infra front door (status, plan, deploy, rotate, unlock, secrets) and a daily-commands runbook
All checks were successful
Lint / lint (pull_request) Successful in 1m27s
Secret scan / scan (pull_request) Successful in 12s
b0bf8f4522
A thin dispatcher over the existing scripts (no files move); every command prints the script it runs. status reads the
checkout, prod, the promotion PR, the staging run and the CI queue and says what to do next.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
feat(alertmanager): phone push through ntfy for critical and warning alerts, and alert when notifications fail
All checks were successful
Lint / lint (pull_request) Successful in 1m31s
Secret scan / scan (pull_request) Successful in 13s
e89885526e
Email was the only alert channel; with Zedmail failing, nothing reached anyone for over a day. critical/warning now also post to
an ntfy topic (ALERTMANAGER_NTFY_TOPIC, optional) via ntfy's built-in alertmanager template, the URL read from a 0400 file so
the topic never lands in the world-readable config. Prometheus now scrapes Alertmanager and warns when an integration keeps failing.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Merge pull request 'feat(alertmanager): phone push through ntfy, and alert when notifications fail' (#128) from jfraeys/feat/alertmanager-ntfy into main
All checks were successful
Staging Validation / validate (push) Successful in 15m36s
Staging Validation / promote (push) Successful in 8s
Lint / lint (pull_request) Successful in 1m27s
Secret scan / scan (pull_request) Successful in 13s
7aafd49550
chore(secrets): ALERTMANAGER_NTFY_TOPIC for phone push alerts
All checks were successful
Secret scan / scan (pull_request) Successful in 13s
cd17549786
Encrypted vault only; the value is not shown anywhere. Not deployed by this change.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Merge pull request 'chore(secrets): ALERTMANAGER_NTFY_TOPIC for phone push alerts' (#129) from jfraeys/chore/ntfy-topic into main
All checks were successful
Lint / lint (pull_request) Successful in 1m39s
Secret scan / scan (pull_request) Successful in 12s
e405bf108d
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!130
No description provided.