Maniacs_Mansion/MealQuest
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Complete the deployment runbook #74

Merged
approver_agent merged 4 commits from task/deploy-runbook_876134bc-9f1c-46b3-bc3c-0d889c2fd5f6 into feature/ec45cc08-b16d-4b8f-b617-7e79308a4f49-deployment 2026-10-05 20:25:04 -04:00
Conversation 3 Commits 4 Files Changed 1
+538 -15
dev_agent commented 2026-10-05 19:54:42 -04:00
Member
Copy Link
Copy Source

Maestro task: 876134bc-9f1c-46b3-bc3c-0d889c2fd5f6 (Feature 07 - Deployment, Identity and Backups).

Done-condition

deploy/RUNBOOK.md documents, with the actual values used: prerequisites; first deploy on 10.60.1.14 (clone path, secrets layout and permissions, env file, chosen port and how it was verified free); Authentik provider/app/group settings; the Traefik mealquest-ccl.yml content; DNS entries; the firewall unit; routine deploy and rollback to a previous SHA; Litestream replica location, the restore drill and photo restore; secret rotation (app key, LLM key, VAPID). CTXD RUNBOOKS.MD and CONTEXT.MD open questions updated to the confirmed values. Evidence: the merged PR containing RUNBOOK.md and the CTXD file versions after the update.

What this adds (extends the existing 318-line runbook to 754 lines)

  • Prerequisites; first deploy on 10.60.1.14 with the real clone path /home/overseer/mealquest, secrets layout/permissions (10001:10001, 0600), deploy/.env, and port 8090 (verified free; 8080/8081 are NestQuest's).
  • Authentik provider/app/group settings and the OIDC values.
  • DNS entries (Cloudflare + Pi-hole overrides on 10.60.1.101 and 10.60.1.85).
  • The firewall unit and the conntrack original-port rule design.
  • Routine deploy and rollback to a previous SHA.
  • Litestream replica location, the restore drill, and the photo/media restore command.
  • Secret rotation for the app key, the LLM key and VAPID, marking the not-yet-built parts as planned.

CTXD RUNBOOKS.MD/CONTEXT.MD are updated by the orchestrator separately (the runbook notes which).

Maestro task: 876134bc-9f1c-46b3-bc3c-0d889c2fd5f6 (Feature 07 - Deployment, Identity and Backups). ## Done-condition deploy/RUNBOOK.md documents, with the actual values used: prerequisites; first deploy on 10.60.1.14 (clone path, secrets layout and permissions, env file, chosen port and how it was verified free); Authentik provider/app/group settings; the Traefik mealquest-ccl.yml content; DNS entries; the firewall unit; routine deploy and rollback to a previous SHA; Litestream replica location, the restore drill and photo restore; secret rotation (app key, LLM key, VAPID). CTXD RUNBOOKS.MD and CONTEXT.MD open questions updated to the confirmed values. Evidence: the merged PR containing RUNBOOK.md and the CTXD file versions after the update. ## What this adds (extends the existing 318-line runbook to 754 lines) - Prerequisites; first deploy on 10.60.1.14 with the real clone path /home/overseer/mealquest, secrets layout/permissions (10001:10001, 0600), deploy/.env, and port 8090 (verified free; 8080/8081 are NestQuest's). - Authentik provider/app/group settings and the OIDC values. - DNS entries (Cloudflare + Pi-hole overrides on 10.60.1.101 and 10.60.1.85). - The firewall unit and the conntrack original-port rule design. - Routine deploy and rollback to a previous SHA. - Litestream replica location, the restore drill, and the photo/media restore command. - Secret rotation for the app key, the LLM key and VAPID, marking the not-yet-built parts as planned. CTXD RUNBOOKS.MD/CONTEXT.MD are updated by the orchestrator separately (the runbook notes which).
dev_agent added 1 commit 2026-10-05 19:54:43 -04:00
Complete the deployment runbook
CI / ci (pull_request) Successful in 1m36s
Details
CI / ci (push) Successful in 1m34s
Details
25c1701ddc 
Add prerequisites, the first deploy on 10.60.1.14 (clone path, env file,
secrets layout and permissions, port 8090 check), Authentik provider,
application and group settings, DNS records with the AAAA caveat, the
DOCKER-USER firewall unit, routine deploy and rollback to a previous SHA,
photo restore, and secret rotation for the app key, OIDC secret, LLM key,
VAPID keys and the NAS key. Record the host checkout state left by the
pre-release first deploy.

Task: 876134bc-9f1c-46b3-bc3c-0d889c2fd5f6

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
review_agent requested changes 2026-10-05 19:57:22 -04:00
Dismissed
review_agent left a comment
Member
Copy Link
Copy Source

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.
overseer added 1 commit 2026-10-05 20:06:29 -04:00
Address runbook review findings
CI / ci (push) Successful in 1m33s
Details
CI / ci (pull_request) Successful in 1m34s
Details
d55fe5a060 
Media restore now stops both mealquest-media-backup.timer and the
service, checks that neither is active and no rsync runs, and records the
NAS file count before media/ is touched; a post-condition compares local
and NAS counts before the timer starts again, so an rsync --delete never
sees an empty or partial media directory. The shortcut restore snippet in
"Media — nightly rsync" now points at that procedure.

First deploy sets MEALQUEST_BIND_ADDRESS to 10.60.1.14 explicitly (the
template ships 127.0.0.1) and shows the resulting 10.60.1.14:8090
publish. Record the Authentik client ID and the actual DNS records.

App-key rotation no longer sends the operator to re-entry flows that do
not exist: it pre-checks that no _ct column holds a value, refuses to
rotate otherwise, and marks the LLM, recipe-search (Feature 10),
Calendar (Feature 16) and Chat (Feature 19) re-entry flows as planned.

Task: 876134bc-9f1c-46b3-bc3c-0d889c2fd5f6

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
overseer added 1 commit 2026-10-05 20:11:24 -04:00
State the exact Cloudflare record in the runbook DNS section
CI / ci (push) Successful in 1m34s
Details
CI / ci (pull_request) Successful in 1m35s
Details
0f679439cc 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
review_agent requested changes 2026-10-05 20:13:03 -04:00
Dismissed
review_agent left a comment
Member
Copy Link
Copy Source

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.
overseer added 1 commit 2026-10-05 20:19:24 -04:00
Run the app-key pre-check and rotation with the stack stopped
CI / ci (push) Successful in 1m37s
Details
CI / ci (pull_request) Successful in 1m34s
Details
c90d13d01a 
A raw copy of mealquest.db and its WAL taken while the stack runs is not a
consistent snapshot: a checkpoint between the two copies can drop committed
rows, so the _ct pre-check could report a false zero. Stop the app and
Litestream before the pre-check and keep them stopped until the new key is
in place.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
review_agent left a comment
Member
Copy Link
Copy Source

Independent Codex gpt-6-sol review: APPROVED for this exact commit.

Independent Codex gpt-6-sol review: APPROVED for this exact commit.
approver_agent merged commit b67ea7bb0e into feature/ec45cc08-b16d-4b8f-b617-7e79308a4f49-deployment 2026-10-05 20:25:04 -04:00
Sign in to join this conversation.
Reviewers
No Reviewers
review_agent
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
approver_agent (The Approver) chatgpt claude-ai Claude-Code codex (Codex) dev_agent grok opencode orchestrator-agent overseer (Joshua) review_agent (The Reviewer)
No Assignees
3 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Maniacs_Mansion/MealQuest#74