recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

opencode UI stack is ccci-opencode-ui, on the weekly sweep's keep-list; journal: first weekly run on the new host

Browse Source 
The 2026-09-07 weekly run's step-0 orphan sweep removed the `opencode-ui`
swarm stack (the traefik route to the opencode web UI) because it was not
on sweep-orphans.sh's keep-list. Renamed to ccci-opencode-ui alongside the
other control-plane stacks and added to KEEP_RE.

Journal: the run itself (lasuite-docs #8, n8n #7 GREEN on the new Drone,
report week-2026-09-07 published) ran entirely on the new host.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
This commit is contained in:
notplants
2026-09-07 22:13:43 +00:00
co-authored by Claude Fable 5.1
parent be9687962c
commit 48226dd78f
4 changed files with 20 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cc-ci-plan/JOURNAL.md
+10 -29
View File
@@ -1062,33 +1062,14 @@ Plan + live log: `cc-ci-plan/plan-cc-ci-combined-host.md` (on the branch; copy h
- Open: tailscale auth key revoked (`invalid key: API key does not exist`) → operator issues a
new one. DNS cutover at Gandi (ci, *.ci, ns-acme → 195.201.88.249) → operator.
## Session 2026-09-07 21:10 UTC — CUTOVER DONE; orchestrator now on the new host
## 2026-09-07 22:15 UTC — first weekly upgrade run on the new host: GREEN, report published
CI is served from 195.201.88.249 (DNS repointed by the operator, no tailscale on the new box,
opencode UI on 443 via traefik + basic auth, fail2ban on). `!testme` → Drone build 1326 on the
new box. This session (on the old shared host) is the last one here: cc-ci units runtime-masked
on the old host; a fresh orchestrator session is up on the new box (`ssh root@195.201.88.249`,
`sudo -iu loops tmux attach -t cc-ci-orchestrator`). Details + the two incidents:
`cc-ci-plan/plan-cc-ci-combined-host.md` (log) and README §2a/§7. Operator to merge
notplants-nix `chore/drop-cc-ci`, delete the old CI server in a week, revoke the Hetzner token.
## Session 2026-09-07 21:35 UTC — evening changes on the cc-ci host (from Claude on notplants-orchestrator)
- notplants-nix `chore/drop-cc-ci` merged + applied on the old box (gen 57). cc-ci push self-test
green again (#33 ruff format, #34 statix). cc-ci input relocked on the host (NAR-hash note in
README day-2).
- Operator: NO Claude on the cc-ci host. The orchestrator there is an opencode agent
(agents.toml: opencode/glm-5.2) steered from https://oc.ci.commoninternet.net; claude-install,
CLAUDE_BIN and all Claude state removed from the host. Claude sessions stay on
notplants-orchestrator, whose loops `ssh cc-ci` now points at 195.201.88.249.
- Operator: only strictly necessary secrets on the cc-ci host, none of this machine's keys.
`/secrets/files` there now holds exactly: cc-ci.testenv (GITEA_PASSWORD, DOCKERHUB_*),
cc-ci-local-ed25519 (loops→root loopback, generated there, pub in nix/hosts/cc-ci/ssh-keys),
autonomic-bot-cc-ci-ed25519 (generated there, Gitea key id 156, root uses it for cc-ci-secrets),
opencode-auth.json. Gone: tailscale key, tangled key, copied cc-ci-root + bot keys, htpasswd
plaintext, TINFOIL/OPENAI keys, the master age key (cc-ci-secrets re-keyed to the host's ssh
host key age1tmvg…, cc-ci PR #35; /var/lib/sops-nix/key.txt = host-derived identity). /old-root
deleted. Inventory: /secrets/README.txt on the host.
- Weekly upgrade run started by hand on the new host at 21:23 UTC (`systemctl start
cc-ci-upgrade-all`; opencode/deepseek-v4-flash, session ses_f823e7a18ffejcu0) as the post-move
proof; result + report recorded below when done.
Started by hand 21:23 UTC (`systemctl start cc-ci-upgrade-all` on 195.201.88.249, opencode /
deepseek-v4-flash); `UPGRADE RUN COMPLETE` 22:02 (39 min). Everything ran on the new host — old
server's Drone/bridge at 0/0, no new run dirs or report there. 20 recipes surveyed, 2 upgrade PRs
extended and `!testme` GREEN on the new Drone (lasuite-docs #8 → v5.6.1, build 1338; n8n #7 →
2.38.4, build 1339), 1 PR closed as merged upstream (custom-html #7), 18 skipped as up-to-date or
covered. Summary: `.cc-ci-logs/upgrades/upgrade-all-2026-09-07.md`. Report agent published
https://report.ci.commoninternet.net/week-2026-09-07.html (200, 42 KB, indexed) at 22:11.
One side effect: the run's orphan sweep removed the `opencode-ui` swarm stack (traefik route to
the opencode web UI) — redeployed, renamed `ccci-opencode-ui`, added to the sweep keep-list.