530 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Emi Griffith	1941b184e5	Merge dev into openbao branch (dev moved when #128 landed)	2026-07-30 11:09:45 -07:00
Emi Griffith	8a2c838663	forgejo: restart the db service on a clean exit, not just on failure ... forgejo_db has been at 0/1 replicas since 2026-07-29 01:24 UTC. Postgres hit an invalid data-directory lock file ("could not open file postmaster.pid ... performing immediate shutdown because data directory lock file is invalid") and exited 0. With restart_policy.condition=on-failure, Swarm read the zero status as successful completion, marked the task Complete, and never rescheduled it. The forgejo service itself stayed Up and kept serving its homepage, so the outage presented as every repository page, the whole API and all CI returning 500 with "dial tcp: lookup db on 127.0.0.11:53: no such host" — including the auth path, which is why API calls reported "user does not exist [uid: 0]" rather than a database error. on-failure cannot distinguish "finished successfully" from "shut itself down and should be restarted", and Postgres exits 0 on several such paths, so it is the wrong policy for an always-on stateful service. This is the durable fix; it does not restart the currently stopped task.	2026-07-30 06:30:30 -07:00
Emi Griffith	7878763b66	forgejo: restart the db service on a clean exit, not just on failure ... forgejo_db has been at 0/1 replicas since 2026-07-29 01:24 UTC. Postgres hit an invalid data-directory lock file ("could not open file postmaster.pid ... performing immediate shutdown because data directory lock file is invalid") and exited 0. With restart_policy.condition=on-failure, Swarm read the zero status as successful completion, marked the task Complete, and never rescheduled it. The forgejo service itself stayed Up and kept serving its homepage, so the outage presented as every repository page, the whole API and all CI returning 500 with "dial tcp: lookup db on 127.0.0.11:53: no such host" — including the auth path, which is why API calls reported "user does not exist [uid: 0]" rather than a database error. on-failure cannot distinguish "finished successfully" from "shut itself down and should be restarted", and Postgres exits 0 on several such paths, so it is the wrong policy for an always-on stateful service. This is the durable fix; it does not restart the currently stopped task.	2026-07-29 21:42:01 -07:00
Emi Griffith	6bd07d33cb	openbao: add a dormant OpenBao backend alongside SOPS ... Phase 1 of moving the secret store to OpenBao. Nothing is cut over: TG_SECRETS_BACKEND defaults to sops for all three environments, so SOPS remains authoritative until an environment is flipped in a reviewed PR. The reason for the migration is one specific failure class. infra/CLAUDE.md requires that vps1 never hold prod credentials, but that rule is currently enforced by a caller-side shell flag (THERMOGRAPH_SECRETS_SKIP_COMMON) at three call sites. A fourth call site, or one by-hand render, writes both S3 keypairs, the VAPID private key, REGISTRY_TOKEN and the IndexNow/metrics tokens onto the Forgejo CI-runner box and exits 0. policies/tg-host-dev.hcl makes that a 403 instead: dev's identity cannot read the common path at all. Shape: - vps2 only, native systemd (not a container: a Swarm service is circular, and a plain docker run is one `prune -a` from gone), raft storage (2.6.0 deprecated the file backend), static auto-unseal so a reboot cannot block deploys, mesh-only self-signed TLS (not ACME — that would put DNS in the boot chain of the secret store). - AppRole per environment, CIDR-bound, 5-minute tokens. Each environment's secret-id is owned by its own deploy user, which is a boundary that does not exist today since prod and beta both reach the same root-owned age key. - Render still produces the same raw unquoted dotenv: Centralis compares /etc/thermograph.env textually and the Swarm entrypoint parses it by line. The backend dispatch in render-secrets.sh returns early rather than refactoring the shared write path, so the SOPS path stays byte-identical. Verified by rendering dev (12 keys) and prod (32 keys) through it, matching the live hosts. The duplicated write path is noted for consolidation once prod has been on OpenBao for a release cycle. The OpenBao renderer rejects values containing a newline or a shell metacharacter. /etc/thermograph.env is sourced by bash in six places, so such a value is a command-execution path on the deploy host; the SOPS path has always had this hazard and avoids it only because every current value happens to be alphanumeric. Also records that the age keypair is NOT retired by this migration: it is the backup encryption key for every off-box dump (ops-cron.yml:142,197, 30-day retention), so deleting it with the vault files would silently destroy a month of database recoverability. verify-parity.sh is the cutover gate — it renders both backends and diffs them, reporting key names and counts only, never values.	2026-07-29 21:35:20 -07:00
emi	94de933cab	Merge pull request 'promote: dev → main (sign in with Google; shared OAuth engine)' (#127) from dev into main	2026-07-27 01:00:41 +00:00
emi	deb039ee24	accounts: sign in with Google, on a shared provider-agnostic OAuth engine (#122)	2026-07-27 00:56:43 +00:00
Emi Griffith	1d4defefb9	BRANCHING: the escape hatch, now that apply_to_admins binds the owner too ... Protection an admin walks through is documentation rather than a control, so apply_to_admins goes on — but that removes the direct-push route for everyone, including in an emergency, and the way back in should be written down before it is needed rather than improvised. There is no force flag; the supported route is lift the rule, act, restore it, with both halves audited. Names the failure mode that actually justifies it: a renamed status context makes the required check unsatisfiable, and with apply_to_admins on that blocks every merge into dev and main with no exemption for anyone.	2026-07-26 15:05:26 -07:00
Emi Griffith	890cb4a764	docs: the orchestrator runbook and the module map ... .claude/BRANCHING.md — how the trunk-based flow is actually run: the serialised merge queue (Forgejo has no native one, so whoever orchestrates is it), the two promotions and who decides each, and the hotfix down-merge that has to happen in the same session or it becomes a regression scheduled for the next promotion. Two things it states because getting them wrong is expensive here. CI does not gate PRs into `release` — pr-build.yml fires only for dev and main — so a required check on that branch would make every production promotion unmergeable with a 405 naming no cause; closing that gap means changing the workflow first and turning the requirement on second. And the chain cannot fast-forward: every promotion leaves a merge commit on the target the source never receives, so promotions are merge commits until someone deliberately reconciles the branches. .claude/ownership.md — which tasks may run concurrently, seamed along the four domains, plus the shared spine that has to be serialised: the workflows (CI lives only in the root .forgejo/), env-topology.sh, the deploy entry points and the CLAUDE.md files. Names the recurring collisions too — a schema change spans alembic and whatever reads the column, and if the payload shape moves it is PAYLOAD_VER and the frontend as well, which is one task and not two.	2026-07-26 12:53:33 -07:00
emi	ad4d2da120	promote: dev → main	2026-07-26 19:52:21 +00:00
emi	0617a3b067	db: raise max_connections to 200, cap work_mem at 64MB, trim async pool overflow (#124)	2026-07-26 19:48:50 +00:00
emi	beb5fa5259	bookmarks: don't fabricate a local save when the server rejects it (#121)	2026-07-26 19:17:46 +00:00
emi	2a4f516798	frontend: load bookmarks-ui.js from the Go SSR home template too (#120)	2026-07-26 19:17:46 +00:00
emi	3ec72ca75b	bookmarks: don't fabricate a local save when the server rejects it (#121)	2026-07-26 18:51:02 +00:00
emi	b57e280ad6	frontend: load bookmarks-ui.js from the Go SSR home template too (#120)	2026-07-26 18:49:42 +00:00
emi	4f21e47750	Merge pull request 'promote: dev → main (location bookmarks)' (#119) from dev into main	2026-07-26 18:46:01 +00:00
emi	1c6ecc2a6f	bookmarks: map + account UI for saved locations	2026-07-26 18:36:43 +00:00
emi	17cc14b48b	bookmarks: map + account UI for saved locations	2026-07-26 18:36:39 +00:00
emi	d6ead56971	bookmarks: map + account UI for saved locations	2026-07-26 18:36:34 +00:00
emi	4e1c4a4197	bookmarks: map + account UI for saved locations	2026-07-26 18:36:31 +00:00
emi	41858f3e4b	bookmarks: account-synced saved locations API	2026-07-26 18:27:45 +00:00
emi	58e3a8d625	bookmarks: account-synced saved locations API	2026-07-26 18:27:44 +00:00
emi	53fd5d9225	bookmarks: account-synced saved locations API	2026-07-26 18:27:43 +00:00
emi	3fafd67600	bookmarks: account-synced saved locations API	2026-07-26 18:27:41 +00:00
emi	67284dfe2e	bookmarks: account-synced saved locations API	2026-07-26 18:27:40 +00:00
emi	efcf32defc	Merge pull request 'promote: dev → main (sign in with Discord)' (#116) from dev into main	2026-07-26 18:22:03 +00:00
emi	8572c4aa6d	accounts: sign in with Discord, sharing the existing link callback (#115)	2026-07-26 18:16:55 +00:00
emi	c1ab9410d3	Merge pull request 'promote: dev → main' (#114) from dev into main	2026-07-26 08:29:19 +00:00
emi	801c767115	dev: leave /healthz outside the basic-auth boundary (#113)	2026-07-26 08:28:18 +00:00
emi	c86489b207	Merge pull request 'promote: dev → main (dev behind basic auth at dev.thermograph.org)' (#112) from dev into main	2026-07-26 08:06:32 +00:00
emi	4122f4353b	dev: serve at dev.thermograph.org behind basic auth, bound to loopback (#111)	2026-07-26 07:49:43 +00:00
emi	e6d9b36742	Merge pull request 'promote: dev → main (cutover fixes: sync-dev guard, owner-db hardening, post-deploy gate)' (#110) from dev into main	2026-07-26 07:29:33 +00:00
emi	64986189e1	deploy.sh: honour TG_POST_DEPLOY on the compose path too (#109)	2026-07-26 07:28:43 +00:00
emi	5c41ee4dad	provision-env-db: revoke PUBLIC connect on the owner database too (#108)	2026-07-26 07:17:20 +00:00
emi	d5357d0670	Merge pull request 'promote: dev → main (vps1/vps2 estate split)' (#106) from dev into main	2026-07-26 07:07:28 +00:00
emi	7583258509	infra-sync: refuse to render dev's vault onto a host that is not dev (#107)	2026-07-26 07:05:09 +00:00
emi	d138f00a20	infra: split the estate into vps1/vps2 — beta joins prod, dev gets a home (#103)	2026-07-26 06:56:38 +00:00
emi	4d6ce5b70b	Merge pull request 'promote: dev → main (Weekly UTC-today date fix)' (#105) from dev into main	2026-07-26 06:22:09 +00:00
emi	5b7e30dad9	fix(frontend): Weekly view must always send an explicit date to /grade	2026-07-26 06:20:19 +00:00
emi	ba1085bf39	Merge pull request 'promote: dev → main' (#100) from dev into main	2026-07-25 21:14:22 +00:00
emi	5f20fba9f5	frontend: fix the three inconsistencies the onboarding guide found (#99)	2026-07-25 21:11:32 +00:00
Emi Griffith	12441be0c1	docs: add a developer onboarding guide for the monorepo ... Twelve documents under docs/onboarding/ covering orientation, local setup, the repo map, per-domain deep dives, the cross-service contracts, CI and the release flow, infra and secrets, observability, task recipes, and a list of which docs in this tree are currently stale. Every command in the setup guide was run against this checkout: the backend suite (429 passed, 8 skipped), the frontend Go suite, a venv boot of the backend, and a build+boot of the Go frontend. Two findings recorded along the way: - static/units.js's F_REGIONS is guarded by no test, despite three source comments claiming "a test asserts all three stay identical". The Go test only cross-checks the Go copy against the backend's Python. All four copies are currently identical. - backend/ and frontend/docker-compose.test.yml still default to the retired emi/thermograph-backend/app image path, and the frontend harness pins the split-era v0.0.2-split-ci tag. Claude-Session: https://claude.ai/code/session_01AfXqHrxCJLs2D7hpQkiUiJ	2026-07-25 18:34:44 +00:00
emi	0766fd6bcb	Merge pull request 'promote: dev → main (alert template: omit empty value line)' (#97) from dev into main	2026-07-25 18:19:09 +00:00
emi	b32b5841f3	alerting: don't print a bare "value:" when ValueString is empty (#96)	2026-07-25 18:17:37 +00:00
emi	c67d22b152	Merge pull request 'promote: dev → main (alerting liveness rules onto the app heartbeat)' (#95) from dev into main	2026-07-25 17:53:31 +00:00
emi	1a56a63800	alerting: base web/worker liveness on the app heartbeat, not container stdout (#94)	2026-07-25 17:51:42 +00:00
emi	aa4ee7f4c4	Merge pull request 'promote: dev → main (CI consolidation, 15 workflows → 9)' (#90) from dev into main	2026-07-25 16:58:11 +00:00
emi	d4a00099f2	climate: stop dropping the current day from the Open-Meteo bundle (#92)	2026-07-25 16:56:21 +00:00
emi	52cfe5b77a	Merge pull request 'Merge main back into dev to reconcile the squash-promotion divergence' (#91) from sync/main-into-dev into dev	2026-07-25 08:45:51 +00:00
Emi Griffith	be4aa940d9	Merge main back into dev to reconcile the squash-promotion divergence ... The dev → main promotion could not merge: `main` sat 22 commits ahead of `dev` with content dev had never seen, and git found genuine conflicts in CLAUDE.md and README.md plus modify/delete on the eight workflow files #87 removed. The cause is that recent promotions were merged with squash rather than "Create merge commit". A squash replays dev's commits onto main under new SHAs, so the two branches share content but not history — main appears to have independently edited the same files, and every subsequent promotion inherits the divergence. `promote` warns about exactly this. Resolution: both conflicts take dev's side, not as a default but because main's side describes workflows that no longer exist (`*-deploy-dev.yml`, `backend-build-push` and friends). Keeping it would reintroduce the class of staleness the root CLAUDE.md now forbids — statements naming files that are not there. The eight deleted workflows stay deleted; the merge result carries the nine that #87 left behind. Verified after resolution: no conflict markers anywhere, no unmerged paths, no document naming a deleted workflow, all nine workflow files parse, and shellcheck is clean across the tree. Promotions from here should use "Create merge commit" so this does not recur.	2026-07-25 01:44:54 -07:00
emi	d42a57a011	ci: collapse the eight deploy and build-push workflows into two (#87)	2026-07-25 07:48:49 +00:00