From 542e8cfb1160fd58d687e4181555886605973f57 Mon Sep 17 00:00:00 2001 From: autonomic-bot <64+autonomic-bot@noreply.git.autonomic.zone> Date: Mon, 21 Sep 2026 16:52:53 +0000 Subject: [PATCH] domain cutover: front doors + drone + per-run naming to ci.autonomic.zone MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - acme-dns.nix: ONE dual-zone SAN cert (ci+*.ci.autonomic.zone AND ci+*.ci.commoninternet.net) via the same acmedns account — storage re-keyed by cc-ci-acme-storage-seed.service; handoff reads the new cert dir. Single secret pair => zero changes to the traefik reconciler. - dashboard/bridge/reports: dual Host rules during the bake window (bridge gets explicit parentheses so && does not shadow the dashboard on the new host). - drone abra app renamed to drone.ci.autonomic.zone (fresh DB supported: DRONE_USER_CREATE re-injects the sops bridge token); runner RPC + bootstrap-drone-oauth.sh follow. - harness: app_domain() issues *.ci.autonomic.zone run domains; RUN_APP_RE / stack-name regexes / docker-prune accept BOTH zones during the bake. Warm stacks deliberately stay on the legacy zone (data-warm volumes; post-bake migration). - URLs in bridge/dashboard defaults + recipe-report.py follow the new names. --- bridge/bridge.py | 4 +- dashboard/dashboard.py | 2 +- nix/modules/acme-dns.nix | 75 +++++++++++++++++++++++++++----- nix/modules/bridge.nix | 5 ++- nix/modules/dashboard.nix | 6 +-- nix/modules/docker-prune.nix | 6 ++- nix/modules/drone-runner.nix | 2 +- nix/modules/drone.nix | 4 +- nix/modules/reports.nix | 2 +- runner/harness/generic.py | 5 ++- runner/harness/lifecycle.py | 4 +- runner/harness/naming.py | 6 ++- runner/harness/warm.py | 6 ++- scripts/bootstrap-drone-oauth.sh | 4 +- tests/concurrency/concutil.py | 2 +- tests/gitea/recipe_meta.py | 3 +- 16 files changed, 102 insertions(+), 34 deletions(-) diff --git a/bridge/bridge.py b/bridge/bridge.py index bea79bc..457cd08 100644 --- a/bridge/bridge.py +++ b/bridge/bridge.py @@ -41,11 +41,11 @@ from datetime import UTC, datetime from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer GITEA_API = os.environ.get("GITEA_API", "https://git.autonomic.zone/api/v1") -DRONE_URL = os.environ.get("DRONE_URL", "https://drone.ci.commoninternet.net") +DRONE_URL = os.environ.get("DRONE_URL", "https://drone.ci.autonomic.zone") # Dashboard base URL — where per-run artifacts (summary card PNG, level badge SVG) are served # (Phase 3 U2.3: /runs//...). The PR comment (U3) embeds the card + badge from here. The # run_id is the Drone build number (== `num`), so the URLs are /runs//{summary.png,badge.svg}. -DASH_URL = os.environ.get("DASH_URL", "https://ci.commoninternet.net") +DASH_URL = os.environ.get("DASH_URL", "https://ci.autonomic.zone") CI_REPO = os.environ.get("CI_REPO", "recipe-maintainers/cc-ci") TRIGGER = "!testme" # Hidden HTML-comment marker embedded in the bot's PR comment so a re-`!testme` UPDATES the same diff --git a/dashboard/dashboard.py b/dashboard/dashboard.py index cae406f..a026a26 100644 --- a/dashboard/dashboard.py +++ b/dashboard/dashboard.py @@ -22,7 +22,7 @@ import urllib.error import urllib.request from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer -DRONE_URL = os.environ.get("DRONE_URL", "https://drone.ci.commoninternet.net") +DRONE_URL = os.environ.get("DRONE_URL", "https://drone.ci.autonomic.zone") CI_REPO = os.environ.get("CI_REPO", "recipe-maintainers/cc-ci") CACHE_TTL = int(os.environ.get("CACHE_TTL", "30")) # Per-recipe history display cap (phase dash): a long-lived recipe (plausible/custom-html have 30+ diff --git a/nix/modules/acme-dns.nix b/nix/modules/acme-dns.nix index 54c8b66..e7ee22e 100644 --- a/nix/modules/acme-dns.nix +++ b/nix/modules/acme-dns.nix @@ -1,8 +1,13 @@ -# Restricted DNS-01 certificate issuance for ci.commoninternet.net. +# Restricted DNS-01 certificate issuance for ci.autonomic.zone (+ legacy ci.commoninternet.net). # # This host is authoritative only for acme.commoninternet.net. Gandi continues -# to own commoninternet.net; it delegates this narrow zone and one permanent -# _acme-challenge CNAME manually. No Gandi credential is present here. +# to own commoninternet.net AND autonomic.zone; both zones delegate their narrow +# _acme-challenge CNAME to the same acme-dns account. No Gandi credential is present here. +# +# Domain cutover 2026-09: ONE cert now covers BOTH zones (SANs: ci/*.ci.autonomic.zone + +# ci/*.ci.commoninternet.net) — a single secret pair flows through the unchanged +# warm_reconcile._traefik_setup ssl_cert/ssl_key flow, avoiding dual-cert SNI entirely. +# The legacy commoninternet.net SANs are dropped in Phase 4 (post-bake reissue). { config, pkgs, ... }: let publicIPv4 = config.cc-ci.publicIPv4; @@ -42,11 +47,40 @@ let # These are wiring values only. The acme-dns account JSON is generated by # Lego below /var/lib/acme and never enters Nix, git, or /etc. + # Storage path points at the NEW cert's dir; cc-ci-acme-storage-seed.service + # (below) clones the legacy account entry into it under the new zone key so + # Lego can write the new zone's TXT via the same (registration-disabled) + # acme-dns account — the CNAME for _acme-challenge.ci.autonomic.zone already + # delegates to that account's subdomain. legoEnvironment = pkgs.writeText "cc-ci-acme-dns-lego.env" '' ACME_DNS_API_BASE=http://127.0.0.1:8080 - ACME_DNS_STORAGE_PATH=/var/lib/acme/ci.commoninternet.net/acme-dns-accounts.json + ACME_DNS_STORAGE_PATH=/var/lib/acme/ci.autonomic.zone/acme-dns-accounts.json ACME_DNS_ALLOWLIST=127.0.0.1/32 ''; + + # Seed the new cert's acmedns storage from the legacy one: same acme-dns + # account (same subdomain/credentials — the only thing the DNS CNAME points + # at), re-keyed for the new zone. Idempotent; runs before the ACME unit. + acmeStorageSeed = pkgs.writeShellApplication { + name = "cc-ci-acme-storage-seed"; + runtimeInputs = with pkgs; [ jq coreutils ]; + text = '' + src=/var/lib/acme/ci.commoninternet.net/acme-dns-accounts.json + dst=/var/lib/acme/ci.autonomic.zone/acme-dns-accounts.json + install -d -m 0700 /var/lib/acme/ci.autonomic.zone + if [ ! -s "$src" ]; then + echo "storage seed: no legacy accounts.json — skipping (fresh host?)" + exit 0 + fi + jq 'if has("ci.autonomic.zone") then . + elif has("ci.commoninternet.net") then + . + { "ci.autonomic.zone": .["ci.commoninternet.net"] } + else . end' "$src" > "$dst.tmp" + mv "$dst.tmp" "$dst" + chmod 0600 "$dst" + echo "storage seed: ok" + ''; + }; in { imports = [ ./options.nix ]; @@ -103,6 +137,20 @@ in }; }; + # Seed the new cert's acmedns storage before the ACME unit first runs (see + # acmeStorageSeed above). Ordering via the generated acme unit name. + systemd.services.cc-ci-acme-storage-seed = { + description = "Seed ci.autonomic.zone acme-dns storage from the legacy account"; + after = [ "acme-dns.service" ]; + wantedBy = [ "acme-ci.autonomic.zone.service" ]; + before = [ "acme-ci.autonomic.zone.service" ]; + serviceConfig = { + Type = "oneshot"; + UMask = "0077"; + }; + script = "${acmeStorageSeed}/bin/cc-ci-acme-storage-seed"; + }; + # Traefik consumes its wildcard as immutable Swarm secrets, so a renewed # host certificate must be copied and reconciled rather than merely reloaded. # This service is started only by the production-mode ACME postRun hook. @@ -116,7 +164,7 @@ in UMask = "0077"; }; script = '' - src=/var/lib/acme/ci.commoninternet.net + src=/var/lib/acme/ci.autonomic.zone dst=/var/lib/ci-certs/live test -s "$src/fullchain.pem" test -s "$src/key.pem" @@ -144,11 +192,18 @@ in security.acme = { acceptTerms = true; - certs."ci.commoninternet.net" = { - domain = "ci.commoninternet.net"; - extraDomainNames = [ "*.ci.commoninternet.net" ]; - # Staging issuance succeeded using the permanent, narrowly delegated - # CNAME. Production uses the same restricted acme-dns account. + certs."ci.autonomic.zone" = { + domain = "ci.autonomic.zone"; + # Dual-zone SANs: the new zone + the legacy one. One cert = one ssl_cert/ssl_key + # secret pair = zero traefik reconciler changes. Phase 4 drops the legacy SANs. + extraDomainNames = [ + "*.ci.autonomic.zone" + "ci.commoninternet.net" + "*.ci.commoninternet.net" + ]; + # Staging issuance proved the permanent, narrowly delegated CNAME and the + # restricted acme-dns account. Production uses the same account (re-keyed + # for the new zone by cc-ci-acme-storage-seed.service). dnsProvider = "acmedns"; environmentFile = "/etc/acme-dns/lego.env"; dnsResolver = "1.1.1.1:53"; diff --git a/nix/modules/bridge.nix b/nix/modules/bridge.nix index b8fb6fe..bb527c0 100644 --- a/nix/modules/bridge.nix +++ b/nix/modules/bridge.nix @@ -33,7 +33,8 @@ let image: cc-ci-bridge:${imageTag} environment: - GITEA_API=https://git.autonomic.zone/api/v1 - - DRONE_URL=https://drone.ci.commoninternet.net + - DRONE_URL=https://drone.ci.autonomic.zone + - DASH_URL=https://ci.autonomic.zone - CI_REPO=recipe-maintainers/cc-ci - BRIDGE_LISTEN=0.0.0.0:8080 # Polling is PRIMARY (outbound, read-only, always on); the /hook webhook is an optional @@ -57,7 +58,7 @@ let labels: - "traefik.enable=true" - "traefik.http.services.ccci-bridge.loadbalancer.server.port=8080" - - "traefik.http.routers.ccci-bridge.rule=Host(`ci.commoninternet.net`) && PathPrefix(`/hook`)" + - "traefik.http.routers.ccci-bridge.rule=(Host(`ci.autonomic.zone`) || Host(`ci.commoninternet.net`)) && PathPrefix(`/hook`)" - "traefik.http.routers.ccci-bridge.entrypoints=web-secure" - "traefik.http.routers.ccci-bridge.tls=true" networks: diff --git a/nix/modules/dashboard.nix b/nix/modules/dashboard.nix index b5c2bfd..918fe22 100644 --- a/nix/modules/dashboard.nix +++ b/nix/modules/dashboard.nix @@ -1,4 +1,4 @@ -# Results dashboard (§4.5, D7): the YunoHost-CI-like overview at ci.commoninternet.net. Reads the +# Results dashboard (§4.5, D7): the YunoHost-CI-like overview at ci.autonomic.zone. Reads the # Drone API (read-only) and renders latest-run-per-recipe + SVG badges. Packaged as a Nix-built OCI # image and run as a swarm service on `proxy`, routed by traefik at Host(ci.commoninternet.net) — the # comment-bridge's Host && PathPrefix(`/hook`) rule is longer, so /hook still wins (priority by rule @@ -33,7 +33,7 @@ let app: image: cc-ci-dashboard:${imageTag} environment: - - DRONE_URL=https://drone.ci.commoninternet.net + - DRONE_URL=https://drone.ci.autonomic.zone - CI_REPO=recipe-maintainers/cc-ci - DASH_LISTEN=0.0.0.0:8080 - DRONE_TOKEN_FILE=/run/secrets/drone_token @@ -57,7 +57,7 @@ let labels: - "traefik.enable=true" - "traefik.http.services.ccci-dashboard.loadbalancer.server.port=8080" - - "traefik.http.routers.ccci-dashboard.rule=Host(`ci.commoninternet.net`)" + - "traefik.http.routers.ccci-dashboard.rule=Host(`ci.autonomic.zone`) || Host(`ci.commoninternet.net`)" - "traefik.http.routers.ccci-dashboard.entrypoints=web-secure" - "traefik.http.routers.ccci-dashboard.tls=true" networks: diff --git a/nix/modules/docker-prune.nix b/nix/modules/docker-prune.nix index ba0abff..a809262 100644 --- a/nix/modules/docker-prune.nix +++ b/nix/modules/docker-prune.nix @@ -30,9 +30,11 @@ let exit 0 fi # NEVER prune mid-run: a live run-app stack means a deploy/test is in flight (mid-pull layers - # can look prunable). Run-app services: <=4char>-<6hex>_ci_commoninternet_net_* (lifecycle.py). + # can look prunable). Run-app services: <=4char>-<6hex>__* (lifecycle.py). + # Zone stem matches BOTH ci_autonomic_zone (current) and ci_commoninternet_net + # (legacy stacks from before the 2026-09 domain cutover) during the bake window. if docker service ls --format '{{.Name}}' \ - | grep -qE '^[a-z0-9]{1,4}-[0-9a-f]{6}_ci_commoninternet_net_'; then + | grep -qE '^[a-z0-9]{1,4}-[0-9a-f]{6}_ci_(autonomic_zone|commoninternet_net)_'; then echo "docker-prune: a run-app stack is live — skipping (never prune mid-run)" exit 0 fi diff --git a/nix/modules/drone-runner.nix b/nix/modules/drone-runner.nix index 3c14f01..2bc5791 100644 --- a/nix/modules/drone-runner.nix +++ b/nix/modules/drone-runner.nix @@ -35,7 +35,7 @@ in wantedBy = [ "multi-user.target" ]; environment = { DRONE_RPC_PROTO = "https"; - DRONE_RPC_HOST = "drone.ci.commoninternet.net"; + DRONE_RPC_HOST = "drone.ci.autonomic.zone"; DRONE_RUNNER_CAPACITY = maxTests; # MAX_TESTS concurrency cap (see let-binding above) DRONE_RUNNER_NAME = "cc-ci-exec"; # exec runner needs a writable root for build workspaces diff --git a/nix/modules/drone.nix b/nix/modules/drone.nix index 839db4a..09d0074 100644 --- a/nix/modules/drone.nix +++ b/nix/modules/drone.nix @@ -1,5 +1,5 @@ # Drone CI server = coop-cloud `drone` recipe via abra (swarm, traefik-routed at -# drone.ci.commoninternet.net, Gitea SSO, wildcard cert / no ACME). The exec *runner* is a +# drone.ci.autonomic.zone, Gitea SSO, wildcard cert / no ACME). The exec *runner* is a # separate host systemd service (modules/drone-runner.nix). See DECISIONS.md "CI engine"/"Drone # deployment shape". # @@ -17,7 +17,7 @@ let name = "cc-ci-reconcile-drone"; runtimeInputs = with pkgs; [ abra docker jq gnused gnugrep coreutils git curl ]; text = '' - DRONE_DOMAIN="drone.ci.commoninternet.net" + DRONE_DOMAIN="drone.ci.autonomic.zone" ENV_FILE="$HOME/.abra/servers/default/$DRONE_DOMAIN.env" if [ ! -r /run/secrets/drone_rpc_secret ] || [ ! -r /run/secrets/drone_gitea_client_secret ]; then diff --git a/nix/modules/reports.nix b/nix/modules/reports.nix index bcb62cc..3aa675a 100644 --- a/nix/modules/reports.nix +++ b/nix/modules/reports.nix @@ -73,7 +73,7 @@ let labels: - "traefik.enable=true" - "traefik.http.services.ccci-reports.loadbalancer.server.port=80" - - "traefik.http.routers.ccci-reports.rule=Host(`report.ci.commoninternet.net`)" + - "traefik.http.routers.ccci-reports.rule=Host(`report.ci.autonomic.zone`) || Host(`report.ci.commoninternet.net`)" - "traefik.http.routers.ccci-reports.entrypoints=web-secure" - "traefik.http.routers.ccci-reports.tls=true" networks: diff --git a/runner/harness/generic.py b/runner/harness/generic.py index d548bff..7db0af3 100644 --- a/runner/harness/generic.py +++ b/runner/harness/generic.py @@ -117,7 +117,10 @@ def assert_serving(domain: str, meta) -> None: # app is routed (Traefik serves the wildcard zone-wide). The serving proof is steps 1–2 above. verified, detail = served_cert(domain) assert verified, f"{domain}: served wildcard cert is not trusted/valid — {detail}" - assert "commoninternet.net" in detail.lower(), f"{domain}: served cert unexpected — {detail}" + # Dual-zone cert (2026-09 cutover): the SAN list covers both *.ci zones; a run + # domain in either zone must be covered by the one serving wildcard. + zone = "autonomic.zone" if domain.endswith(".autonomic.zone") else "commoninternet.net" + assert zone in detail.lower(), f"{domain}: served cert unexpected — {detail}" # ---- Op/assertion split (Phase 1e HC3) ------------------------------------------------------- diff --git a/runner/harness/lifecycle.py b/runner/harness/lifecycle.py index 8c827ed..e6e332b 100644 --- a/runner/harness/lifecycle.py +++ b/runner/harness/lifecycle.py @@ -25,7 +25,7 @@ from . import meta as meta_mod GATEWAY_IP = "143.244.213.108" # *.ci.commoninternet.net -> gateway (TLS passthrough to cc-ci) # A run app domain is "-<6hex>.ci.commoninternet.net" (see DECISIONS.md). Used by the # janitor to recognise orphaned run apps (infra apps like traefik/drone/backups don't match). -RUN_APP_RE = re.compile(r"^[a-z0-9]{1,4}-[0-9a-f]{6}\.ci\.commoninternet\.net$") +RUN_APP_RE = re.compile(r"^[a-z0-9]{1,4}-[0-9a-f]{6}\.ci\.(?:autonomic\.zone|commoninternet\.net)$") class TeardownError(RuntimeError): @@ -1190,7 +1190,7 @@ def janitor() -> None: # also catch stacks whose .env was already deleted (abra ls won't list them) for svc in _docker_names("service", ""): # svc like cust-c95a69_ci_commoninternet_net_app -> reconstruct domain - m = re.match(r"^([a-z0-9]{1,4}-[0-9a-f]{6})_ci_commoninternet_net_", svc) + m = re.match(r"^([a-z0-9]{1,4}-[0-9a-f]{6})_ci_(?:autonomic_zone|commoninternet_net)_", svc) if m: seen.add(f"{m.group(1)}.ci.commoninternet.net") diff --git a/runner/harness/naming.py b/runner/harness/naming.py index 8876d77..347403e 100644 --- a/runner/harness/naming.py +++ b/runner/harness/naming.py @@ -1,7 +1,9 @@ """Shared run-app domain naming (used by the conftest fixtures and the orchestrator). -Domain = "-<6hex(recipe|pr|ref)>.ci.commoninternet.net" — short enough for Docker's +Domain = "-<6hex(recipe|pr|ref)>.ci.autonomic.zone" — short enough for Docker's 64-char swarm config/secret name limit, unique per run, collision-safe across recipes (DECISIONS.md). +(Migrated from *.ci.commoninternet.net 2026-09; the legacy zone remains valid until the bake +window ends — lifecycle/warm name matching accepts both.) """ from __future__ import annotations @@ -18,4 +20,4 @@ def app_domain(recipe: str, pr: str = "0", ref: str | None = None) -> str: ref = ref or ("local" + str(int(time.time()))) tag = _short(recipe, 4).lower() h = hashlib.sha1(f"{recipe}|{pr}|{ref}".encode()).hexdigest()[:6] - return f"{tag}-{h}.ci.commoninternet.net" + return f"{tag}-{h}.ci.autonomic.zone" diff --git a/runner/harness/warm.py b/runner/harness/warm.py index 9de854b..988afcc 100644 --- a/runner/harness/warm.py +++ b/runner/harness/warm.py @@ -25,6 +25,9 @@ import urllib.request # Recipes that, when declared as a dep, are served from a shared live-warm instance at a stable # domain instead of being co-deployed per run. Maps dep-recipe -> stable domain. WARM_DOMAINS = { + # Warm stacks stay on the legacy zone through the 2026-09 domain cutover (data-warm + # volumes + stack names are tied to the abra app name; renaming re-seeds the CI bases). + # They move to *.ci.autonomic.zone in a post-bake phase together with their stacks. "keycloak": "warm-keycloak.ci.commoninternet.net", } @@ -38,11 +41,12 @@ _CTX.check_hostname = False _CTX.verify_mode = ssl.CERT_NONE # A cold per-run stack name looks like "-<6hex>_ci_commoninternet_net_"; extract the hex. -_STACK_HEX_RE = re.compile(r"^[a-z0-9]{1,4}-([0-9a-f]{6})_ci_commoninternet_net_") +_STACK_HEX_RE = re.compile(r"^[a-z0-9]{1,4}-([0-9a-f]{6})_ci_(?:autonomic_zone|commoninternet_net)_") def stable_domain(recipe: str) -> str: """The stable warm domain for a recipe: `warm-.ci.commoninternet.net` — the canonical + base's hostname (legacy zone until the post-bake warm-stack migration; see WARM_DOMAINS note). scheme for BOTH the live-warm keycloak and the data-warm canonicals (WC2), distinct from cold per-run `-<6hex>`. (WARM_DOMAINS['keycloak'] equals stable_domain('keycloak').)""" return f"warm-{recipe}.ci.commoninternet.net" diff --git a/scripts/bootstrap-drone-oauth.sh b/scripts/bootstrap-drone-oauth.sh index db39746..efd1ac9 100644 --- a/scripts/bootstrap-drone-oauth.sh +++ b/scripts/bootstrap-drone-oauth.sh @@ -13,10 +13,10 @@ set -euo pipefail : "${GITEA_USERNAME:?set GITEA_USERNAME}" : "${GITEA_PASSWORD:?set GITEA_PASSWORD}" GITEA="${GITEA:-https://git.autonomic.zone}" -DRONE="${DRONE:-https://drone.ci.commoninternet.net}" +DRONE="${DRONE:-https://drone.ci.autonomic.zone}" CLIENT_ID="${CLIENT_ID:-ab4cdb9d-ee96-4867-875f-87384505fc52}" REPO="${REPO:-recipe-maintainers/cc-ci}" -RES=(--resolve "drone.ci.commoninternet.net:443:127.0.0.1") +RES=(--resolve "drone.ci.autonomic.zone:443:127.0.0.1") export PATH=/run/current-system/sw/bin:"$PATH" cj=$(mktemp) diff --git a/tests/concurrency/concutil.py b/tests/concurrency/concutil.py index 374e747..8a0e16d 100644 --- a/tests/concurrency/concutil.py +++ b/tests/concurrency/concutil.py @@ -15,7 +15,7 @@ sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner") from harness import lifecycle # noqa: E402 HELPERS = os.path.join(os.path.dirname(__file__), "helpers.py") -DOMAIN = "test-abc123.ci.commoninternet.net" # matches RUN_APP_RE +DOMAIN = "test-abc123.ci.autonomic.zone" # matches RUN_APP_RE class HelperPool: diff --git a/tests/gitea/recipe_meta.py b/tests/gitea/recipe_meta.py index 13b6ed5..fe623c1 100644 --- a/tests/gitea/recipe_meta.py +++ b/tests/gitea/recipe_meta.py @@ -72,7 +72,8 @@ def UPGRADE_SECRET_PREP(ctx): import subprocess # abra derives STACK_NAME from the domain by replacing dots with underscores - # (e.g. gite-e1cb78.ci.commoninternet.net → gite-e1cb78_ci_commoninternet_net). + # (e.g. gite-e1cb78.ci.autonomic.zone → gite-e1cb78_ci_autonomic_zone; legacy + # *.ci.commoninternet.net run stacks are matched too during the bake window). stack_name = ctx.domain.replace(".", "_") docker_secret = f"{stack_name}_lfs_jwt_secret_v1" value = base64.urlsafe_b64encode(_os.urandom(32)).rstrip(b"=").decode() -- 2.54.0