recipe-maintainer: public snapshot (secrets + deployment plans removed, single commit)

Sanitized single-commit public mirror of recipe-maintainer. - Removed test-ssh/.testenv (live creds); added test-ssh/.testenv.example placeholders. - Removed plans/ and planned-updates/ (deployment-planning docs) so no client/ deployment domains appear in the public repo. - All other secret stores were already gitignored. - docs.coopcloud.tech retained as a submodule (public upstream).
2026-06-16 20:18:24 +00:00
commit f283a371bb
253 changed files with 15975 additions and 0 deletions
@@ -0,0 +1,140 @@
+---
+description: Provision the t1cc DigitalOcean test server and deploy Traefik
+allowed-tools: [Bash, Read, Write, Edit, Glob, Grep]
+---
+
+# t1cc-start
+
+Provision a fresh DigitalOcean droplet for t1cc (2 vCPU, 8 GB RAM), wait for cloud-init to finish, verify Docker Swarm health, and deploy Traefik. The reserved IP is static — DNS does not need updating.
+
+Read and follow the instructions in `.claude/commands/includes/logging.md`.
+
+## Prerequisites
+
+### 1. Check `.testenv`
+
+Read `terraform/.testenv`. It must contain:
+- `DO_TOKEN` — DigitalOcean API token
+- `RESERVED_IP` — pre-allocated reserved IP (allocated on first run by `setup.sh`)
+
+If `DO_TOKEN` is missing, stop and tell the user to create `terraform/.testenv` with their DO token:
+```
+echo 'DO_TOKEN=dop_v1_...' > terraform/.testenv
+```
+
+If `RESERVED_IP` is missing, that is fine — `setup.sh` will allocate one automatically and save it.
+
+### 2. Check SSH key
+
+Verify the SSH key exists:
+```bash
+test -f test-ssh/test-ssh-keys/nptest && echo "key exists" || echo "MISSING"
+```
+
+If the key is missing, stop and tell the user to place the private key at `test-ssh/test-ssh-keys/nptest`.
+
+## Steps
+
+### 3. Run terraform
+
+From the workspace root, run:
+```bash
+./terraform/setup.sh
+```
+
+This will:
+- Allocate a reserved IP if not already present (and save it to `.testenv`)
+- Write `terraform/terraform.tfvars`
+- Run `terraform init` (if needed)
+- Run `terraform apply -auto-approve`
+- Wait for cloud-init to complete (handled by terraform's `remote-exec` provisioner)
+
+This step can take 3–5 minutes. Stream the output and report progress. If it fails, show the terraform error and stop.
+
+### 4. Verify server health via SSH
+
+SSH into the server and run health checks. Use:
+```bash
+ssh -F test-ssh/ssh-config -o StrictHostKeyChecking=no t1cc.commoninternet.net "<command>"
+```
+
+Run these checks:
+
+**a. Docker is running:**
+```bash
+ssh -F test-ssh/ssh-config -o StrictHostKeyChecking=no t1cc.commoninternet.net "docker info --format '{{.ServerVersion}}'"
+```
+
+**b. Swarm is active:**
+```bash
+ssh -F test-ssh/ssh-config -o StrictHostKeyChecking=no t1cc.commoninternet.net "docker info --format '{{.Swarm.LocalNodeState}}'"
+```
+Expected output: `active`
+
+**c. Proxy network exists:**
+```bash
+ssh -F test-ssh/ssh-config -o StrictHostKeyChecking=no t1cc.commoninternet.net "docker network ls --filter name=proxy --format '{{.Name}}'"
+```
+Expected output: `proxy`
+
+If any check fails, report the failure and stop. Do not proceed to Traefik deployment on an unhealthy server.
+
+### 5. Deploy Traefik
+
+Check whether the traefik app env file already exists:
+```bash
+test -f ~/.abra/servers/t1cc.commoninternet.net/t1cc.commoninternet.net.env && echo "exists" || echo "missing"
+```
+
+**If the env file is missing** — create the traefik app:
+```bash
+abra app new traefik --server t1cc.commoninternet.net --domain t1cc.commoninternet.net --no-input
+```
+
+Then set the required email:
+```bash
+abra app config t1cc.commoninternet.net --update LETS_ENCRYPT_EMAIL=certs@commoninternet.net
+```
+
+**If the env file exists** — check that `LETS_ENCRYPT_EMAIL` and `DOMAIN` are set correctly. Read the env file:
+```bash
+cat ~/.abra/servers/t1cc.commoninternet.net/t1cc.commoninternet.net.env | grep -E "LETS_ENCRYPT_EMAIL|^DOMAIN"
+```
+If `DOMAIN` is set to something other than `t1cc.commoninternet.net`, update it:
+```bash
+abra app config t1cc.commoninternet.net --update DOMAIN=t1cc.commoninternet.net
+```
+
+**Deploy Traefik:**
+```bash
+abra app deploy t1cc.commoninternet.net --chaos --force --no-input
+```
+
+Wait up to 90 seconds for the Traefik service to start, checking every 10 seconds:
+```bash
+ssh -F test-ssh/ssh-config -o StrictHostKeyChecking=no t1cc.commoninternet.net \
+  "docker service ls --filter name=traefik --format '{{.Replicas}}'"
+```
+Wait until the replicas show `1/1`. If not ready after 90 seconds, report a warning but continue.
+
+### 6. Switch default instance to t1cc
+
+```bash
+python3 scripts/switch_default_instance.py t1cc
+```
+
+Verify:
+```bash
+python3 scripts/get_test_instance.py
+```
+
+### 7. Report
+
+Print a summary:
+- Reserved IP (from `terraform/.testenv` or `terraform output -raw reserved_ip`)
+- Domain: `t1cc.commoninternet.net`
+- Docker Swarm: active
+- Traefik: running (1/1 replicas)
+- Default instance: t1cc
+
+Remind the user to run `/init-instance` if they want all maintained recipes deployed.