admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

STATUS.md: a plain-language operator page, and today's four decisions recorded

Browse Source 
Documentation only — no code, no box, no build.

STATUS.md (repo root, 652 words / 67 lines): what works · what's broken ·
what we're working on · waiting on you · changed since. A VIEW of
OPEN-ITEMS.md, holding nothing of its own; not CONTEXT.md, and both files
now say why they stay separate. No R-n is the subject of a sentence —
identifiers are bracketed pointers only.

CONTEXT.md S-5 records the four operator decisions taken 2026-08-02
(D-a … D-d), none of them implemented:
  D-a merge mp1 into mp0 rather than resize it — before any external
      install, and D-c ships in the same step        → R-165
  D-b desired/observed app state in its own store, with the state-store
      safety rule verbatim                           → R-166 (BLOCKED)
  D-c customer fill warning + operator backup-failure alert → R-167
  D-d only DooPlex and Peti's box are protected      → target-selection.md

R-163 RE-FRAMED, not closed: the sizing question is withdrawn rather than
answered; the row survives as the record of the constraint until R-165
lands. R-156's papra referral RESOLVED — deployed nowhere, so the template
fix strands nothing; the docker ps evidence is recorded with its
provenance and its scope limit.

target-selection.md: two protected machines, everything else disposable.
ep0 is no longer Tier 2 but is not scratch (it holds the only off-premises
copy of real customer data) — flagged for explicit operator confirmation.
The demo-box backup-target fence drops from prohibition to stated cost,
because D-d spends that reference anyway.

CLAUDE.md gains an End-of-session checklist carrying the STATUS.md
maintenance rule and "a finding goes in OPEN-ITEMS.md first".
This commit is contained in:
authentik Default Admin
2026-08-02 14:20:29 +02:00
parent 260a8f6e58
commit e994bf35d2
6 changed files with 314 additions and 146 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/runbooks/target-selection.md
+38 -14
View File
@@ -2,28 +2,48 @@
> Read before picking a machine for a drill, a destructive test, or a throwaway VM. It answers one
> question: *what is safe to lose.* Reachability is in `CLAUDE.md`; hardware in `operations/nodes.md`.
> Added 2026-07-30.
> Added 2026-07-30. **Revised 2026-08-02 by operator decision D-d** (`CONTEXT.md` S-5).
## The rule
> **Start at Tier 0 and work down only if Tier 0 genuinely cannot host the work.**
> **A Tier 2 machine is used only when a task says so explicitly** — never by inference from what was
> **Two machines are protected: `DooPlex` and Peti's box. Everything else is disposable.**
> Operator decision **D-d**, 2026-08-02. DooPlex because it holds Gitea, the hub, the backups and the
> registry — everything else rebuilds from it, and it rebuilds from nothing. Peti's box because there
> is a real person behind it. **Every other box, both demo boxes included, may be broken or
> reinstalled freely.**
>
> **This is a correction, not a relaxation.** The earlier posture was costing whole sessions to
> caution and pushing drills onto DooPlex — the one machine that should never host them. If you are
> weighing whether a demo box can take a destructive test: it can. **Reach for a Tier 0 box first and
> do not ask.**
>
> Still true: **start at Tier 0 and work down only if Tier 0 genuinely cannot host the work**, and a
> protected machine is used only when a task says so explicitly — never by inference from what was
> not forbidden. An absent fence is not permission. If no tier fits, **stop and ask.**
Fences name **acts**, not machines. "Do not re-target demo-hp's backup target" and "do not use demo-hp
to host a throwaway VM" are unrelated; only the first has ever been meant. Read a per-machine
Fences name **acts**, not machines. "Do not destroy demo-hp's `drill-r50` fixture" and "do not use
demo-hp to host a throwaway VM" are unrelated; only the first has ever been meant. Read a per-machine
prohibition as covering the act it names and nothing more.
| Tier | Meaning | Machines |
|---|---|---|
| **0 — disposable. Reach here first.** | Exists to be broken; reinstalling is a routine afternoon, not an incident. **A drill that needs a victim uses one of these.** | `demo-hp` (t740), `demo-felhom` (N100) |
| **1 — create and destroy freely** | Throwaway VMs, guests, scratch customers — **hosted on a Tier 0 machine** | drill VMs, scratch guests |
| **2 — precious. Never a drill target.** | Losing it costs the recovery chain or a real relationship | **DooPlex**, **Peti's cluster**, **ep0** + the Hetzner Storage Boxes |
| **2 — protected. Never a drill target.** | Losing it costs the recovery chain or a real relationship | **DooPlex**, **Peti's cluster** — and, by D-d, **nothing else** |
**DooPlex is Tier 2 because it *is* the recovery chain** — hub, Gitea, registry, PBS, k3s + Longhorn.
Everything else rebuilds from it; it rebuilds from nothing. A bad moment in a DR drill there costs the
thing under test, the source of truth for it, and the backups, at once.
**`ep0` + the Hetzner Storage Boxes were Tier 2 until 2026-08-02 and are no longer** — D-d's protected
list names two machines and ep0 is not one of them. **That does not make them scratch, and the
difference is an act, not a tier** (see the rule above the table): ep0 holds the **PBS-DR datastore and
the restic copy of a real customer's data**, which is the only off-premises copy that exists, so
*deleting datastores, prune jobs, tunnel config or nftables rules* remains forbidden by what it would
destroy rather than by what tier it sits in. Reads are fine; it is still never a drill target.
**Flagged for the operator: D-d did not name ep0 either way.** Confirm it explicitly — this page has
read it the narrow way (not protected, but not wipeable) rather than assume the broad one.
**Standing ruling, 2026-07-25 (`operations/nodes.md`):** drill and build VMs live on the **t740** — not
felhom-pve, and **moved off DooPlex**. This page exists because that ruling sat where no session reads.
@@ -38,20 +58,24 @@ felhom-pve, and **moved off DooPlex**. This page exists because that ruling sat
**`/mnt/nvme-1tb`, at its root** (a subdirectory fails the agent's `exactMount` check → storage reads
`disconnected` forever). **That warning is about one storage, not the box.** `/mnt/nvme-1tb` is also
the `felhom-backup` target and the enrolled user-data drive, so remove scratch storages when done.
- **Forbidden:** do not re-target its backup configuration (below). Do not destroy or unblock
**`drill-r50` (VM 300)** — the only drift fixture (R-93). No baked SSH key; access is the hub-vaulted
G1 break-glass password (R-61).
- **Forbidden:** do not destroy or unblock **`drill-r50` (VM 300)** — the only drift fixture (R-93).
(Access: the docs say no baked SSH key and G1 break-glass, but a key authenticated on 2026-07-31 —
**R-129**, unresolved.)
### `demo-felhom` — N100 · **Tier 0**
- **Freely:** create/destroy guests and scratch customers; reinstall the box.
- **Care:** it carries the **PBS-DR / offsite tier** (demo-hp has none), so it is the Tier 0 box whose
backup chain a test can actually disturb. Prefer demo-hp, per the 2026-07-25 ruling.
- **Forbidden:** do not re-target its backup configuration.
**Both Tier 0 boxes, one shared prohibition and its reason:** do not re-point either backup target.
They are the only two **correctly configured** boxes, so they are the regression path new installer
logic is measured against — losing that reference costs more than the box does.
**Both Tier 0 boxes — the shared backup-target fence is DOWNGRADED to a cost, 2026-08-02 (D-d).** It
read *"do not re-point either backup target"*, because these are the only two **correctly configured**
boxes and therefore the regression path new installer logic is measured against. D-d makes both boxes
freely breakable and reinstallable, which loses that reference just as thoroughly — so the fence was
inconsistent with the decision and is not kept as a prohibition. **What survives is the reason:**
re-pointing (or reinstalling) costs the reference configuration, so know that you are spending it and
put the box back. If both are spent at once there is no correctly-configured box left to compare
against.
### `DooPlex` — 192.168.0.180 · **Tier 2**
@@ -71,7 +95,7 @@ still shares a device with its guest, so a drive failure is **offsite-only recov
migrated, parked until the tester reinstalls (`PETI` in `backlog/OPEN-ITEMS.md`). Currently DOWN, no
enrolled host. No access route from DooPlex, and nothing here needs one.
### `ep0` (`felhom-hetzner`, `ep0.felhom.eu`) + the Hetzner Storage Boxes — **Tier 2**
### `ep0` (`felhom-hetzner`, `ep0.felhom.eu`) + the Hetzner Storage Boxes — **not protected by D-d; not scratch either**
Reads are fine. It is the **offsite of last resort** (PBS-DR datastore, WireGuard hub, operator OOB
path) and RAM-constrained (3.8 GB, R-90) so a large restore can OOM it. Do not delete datastores, prune