Promote to production #142

Merged

jfraeys merged 6 commits from main into prod 2026-10-13 20:56:25 -04:00

Conversation 0 Commits 6 Files changed 13 +16 -192

jfraeys commented 2026-10-13 20:03:57 -04:00

Owner

Copy link

Promotion: staging passed. Run scripts/plan-prod.sh locally before merging

Merging this PR is the approval record; it deploys nothing. Then check out the validated commit and run scripts/promote-prod.sh (or scripts/deploy-services.sh --tags ... --limit services for an Ansible-only change); both refuse any other commit.

Staging validation: passed on commit a97294a6b9 (this run)
Production drift check: clean

Ansible preview (staging clone, synthetic secrets — approximate, not exact prod values)

PLAY [Deploy the Docker-based services stack] **********************************
skipping: no hosts matched

PLAY RECAP *********************************************************************

### Promotion: staging passed. Run `scripts/plan-prod.sh` locally before merging Merging this PR is the approval record; it deploys nothing. Then check out the validated commit and run `scripts/promote-prod.sh` (or `scripts/deploy-services.sh --tags ... --limit services` for an Ansible-only change); both refuse any other commit. **Staging validation:** passed on commit a97294a6b9a8ff7c0b14bdfe66616c3f166f8366 (this run) **Production drift check:** clean ### Ansible preview (staging clone, synthetic secrets — approximate, not exact prod values) ``` PLAY [Deploy the Docker-based services stack] ********************************** skipping: no hosts matched PLAY RECAP ********************************************************************* ```

jfraeys added 6 commits 2026-10-13 20:03:57 -04:00

fix(hardening): bump cadvisor, node-exporter and fail2ban off CRITICAL CVEs ... 2c7d73d4a5

The first trivy report (2026-10-13) failed these three on CRITICAL findings.
trivy on the new tags reports 0 CRITICAL for each. cAdvisor moves to
ghcr.io/google/cadvisor (gcr.io has no tag past v0.49.x); all eight trimmed
flags still exist in v0.60.6. tool-versions.yml pin regex follows the new path.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix(hardening): move watchtower to the maintained nicholas-fedor fork ... aadfbfe5eb

containrrr/watchtower is archived (1.7.1 is its last release) and the trivy
report fails it on 5 CRITICAL findings. The fork's 1.23.1 reports 0 CRITICAL,
has every flag both instances use, and a one-shot --monitor-only run with
--label-enable --scope notify on services scanned 6 containers, 0 failed.
The com.centurylinklabs.watchtower.* labels on other services are unchanged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Merge pull request 'fix(hardening): bump cadvisor, node-exporter and fail2ban off CRITICAL CVEs' (#139) from jfraeys/fix/bump-critical-cve-images into main 2f17fc104b

Merge pull request 'fix(hardening): move watchtower to the maintained nicholas-fedor fork' (#140) from jfraeys/fix/watchtower-maintained-fork into main cf2e78bb2c

chore: remove the hugo-docs service and docs.git hostname ... a4592e9210

Added 2026-07-08 with no recorded plan; its jfraeys/docs repo never existed,
so it only ever served the built-in placeholder site (Hugo 0.111.3 on
klakegg/hugo, which is abandoned: 55 CRITICAL findings in the 2026-10-13
trivy report). Removes the compose service, entrypoint script, docs_hostname,
the Forgejo extra_hosts entry, and the staging /etc/hosts and TLS-warmup steps.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Merge pull request 'chore: remove the hugo-docs service and docs.git hostname' (#141) from jfraeys/chore/remove-hugo-docs into main a97294a6b9

jfraeys merged commit d033bc57a1 into prod 2026-10-13 20:56:25 -04:00

jfraeys referenced this pull request from a commit 2026-10-13 20:56:26 -04:00

Merge pull request 'Promote to production' (#142) from main into prod

jfraeys referenced this pull request 2026-10-13 21:02:21 -04:00

Infra backlog: capacity, CI verification, alerts, older loose ends #121

jfraeys referenced this pull request 2026-10-13 21:02:22 -04:00

Next: immediate steps (merge, deploy, verify) after the 2026-10-13 session #116

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jfraeys/infra!142

No description provided.