Repository navigation
docs: D4 done; the rebuild drill's fixes - #86
Merged
Merged
Conversation
Following docs/deployment.md on an empty Ubuntu 24.04 VM got from
nothing to a running stack, and showed five places where a rebuild
stumbles:
- The setup and k3s steps installed files without saying how they
reach the server; the scp commands are added.
- k3s did not start: config.yaml points the API server at the OIDC
authentication file, which the document copied only after k3s's
first start ("failed to load authentication configuration ... no such
file"). The file is now installed before. With the corrected block
k3s came up on the first try.
- secrets-encrypt status answers an error in its first seconds
(runtime core not ready), and the checksum note named only the amd64
list.
- The manual deploy said the namespace is created by hand (not since
it moved to the auto-deploy directory), did not wait for the rollout,
and checked whatever DNS points at rather than the server itself.
- A rehearsal cluster without the public name should not get the Let's
Encrypt issuers: its cert-manager opened production orders that could
never validate.
Plan: D4
Refs: Bulgu #89
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The runbook was followed on an Ubuntu 24.04 VM (Multipass, arm64) standing in for an empty VPS, from the admin user to a manual deploy: k3s with Secrets encrypted, the cluster-level manifests, the Secret, and the prod overlay with 10 of 10 pods ready in 22 s, serving the deployed commit through Traefik. The provider firewall, DNS and Let's Encrypt were not part of it; they were measured step by step on the real server. Five places in the document were wrong or missing and are fixed; the worst, k3s not starting on a fresh install, is finding #89. Also noted: Traefik's permanent redirect is 301 for GET and 308 for other methods. Plan: D4 Refs: Bulgu #89 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The runbook (
docs/deployment.md) was followed on an empty Ubuntu 24.04 VM (Multipass, arm64) standing in for a fresh VPS (cloud-init put the admin key on root, as netcup's installer does). It got from nothing to a running stack: admin user, SSH policy, updates, Tailscale, k3s with Secrets encrypted, the cluster-level manifests, the Secret, and a manual deploy (25 objects, 10/10 pods ready in 22 s, arm64 images), serving the deployed commit through Traefik. Anonymous API access 401; the admission policy refuses NodePort. Not covered: provider firewall, DNS, Let's Encrypt (measured on the real server).Five fixes
scpcommands.config.yamlpoints the API server at the OIDC file, which was copied only after the first start (failed to load authentication configuration ... no such file). Now installed before; the corrected block came upactiveon the first try.secrets-encrypt statuserrors in its first seconds (runtime core not ready); the checksum note now names the arm64 list too.--resolve) instead of whatever DNS points at.Plan: D4 ticked. Also noted: Traefik's permanent redirect is 301 for GET, 308 for other methods.
🤖 Generated with Claude Code