autonomic-bot
12f86fd3fb
Orchestrator decision: deploy canonical coop-cloud traefik via abra instead of a hand-rolled module. abra packaged in Nix (pinned). custom-html deployed over HTTPS (200) via the gateway and torn down clean. docs/install.md seeded. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
34 lines
2.2 KiB
Markdown
34 lines
2.2 KiB
Markdown
# STATUS — cc-ci Builder
|
|
|
|
**Phase:** M1 complete & CLAIMED → starting M2 (Drone). M0 PASS (Adversary @21:35Z). M1 awaiting verdict.
|
|
**In-flight:** M2 — Drone server + exec runner via Nix + Gitea OAuth app (first M2 task).
|
|
**Last updated:** 2026-05-26 (M1 claimed)
|
|
|
|
## Gates
|
|
- **Gate: M0 — CLAIMED, awaiting Adversary** (2026-05-26). Evidence: flake rebuilds cc-ci from repo
|
|
(`switch --flake /root/cc-ci#cc-ci`, gen healthy, no failed units); sops-nix decrypts
|
|
`/run/secrets/test_secret` (0400 root, value = generated `cc-ci-m0-…`). Repro: clone repo, sync to
|
|
host, `nixos-rebuild switch --flake .#cc-ci`, then `systemctl is-system-running` + check the secret.
|
|
Per §6.1 I will NOT advance past this gate to M2; M1 work proceeds as independent unblocked work.
|
|
→ **M0 PASS** logged by Adversary in REVIEW.md @2026-05-26T21:35Z (cold verify, leak probe clean).
|
|
- **Gate: M1 — CLAIMED, awaiting Adversary** (2026-05-26). Evidence: Docker single-node swarm +
|
|
`proxy` overlay; real coop-cloud/traefik via abra (wildcard/file-provider, no ACME); custom-html
|
|
deployed by hand → HTTP 200 over HTTPS via gateway at cchtml1.ci.commoninternet.net with the
|
|
wildcard cert; torn down clean (services/volumes/secrets/containers all 0). Repro:
|
|
`scripts/deploy-proxy.sh` + `abra app new/deploy/undeploy`. Starting M2 as independent work; will
|
|
not flip M2's gate until M1 shows PASS.
|
|
|
|
## Blocked
|
|
- (none)
|
|
|
|
## Notes
|
|
- **Disk RESOLVED:** operator grew the VM 8.9→**28 GiB** (22 GiB free) on 2026-05-26. Inodes
|
|
1.78M total / 1.21M free (was ~6k free — old 8.9 GiB fs had only 586k inodes, which the flake's
|
|
nixpkgs fetch exhausted). Both byte + inode pressure gone.
|
|
- M0 base config: flake at repo root pins nixpkgs to the exact rev cc-ci ran (50ab793) → first
|
|
rebuild is no-op-then-base. Deployed via `nixos-rebuild switch --flake /root/cc-ci#cc-ci` run as
|
|
a detached transient systemd unit (survives ssh-over-tailscale drops). Gen 3 current, healthy.
|
|
- Open warning: incus module enables `systemd.network` while we set `networking.useDHCP=true`
|
|
(scripted dhcpcd) — Nix warns both may manage interfaces. Inherited from baseline, networking is
|
|
up; clean up later (pick networkd OR scripting). Tracked, non-blocking.
|