From 7610e5394c4f46b40e9e0f5245e0b98b772edee0 Mon Sep 17 00:00:00 2001 From: dtoro Date: Mon, 6 Jul 2026 13:57:50 +0200 Subject: [PATCH] Deploy Oikos Console to apps (105); fix missing-directory crash MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Console is live: cloned to /opt/oikos-console, deploy.sh ran clean, webhook secret written to /etc/oikos-console-deploy/secret from the pre-registered SOPS secret (never printed — decrypted and piped straight into the target file in one command), both systemd units enabled and active. Verified locally (127.0.0.1:8091 -> 200) and end-to-end (https://oikos.hubris.network/ -> 302, the Authentik gate firing correctly). Found a real bug during first boot: oikos-console.service's ReadWritePaths listed /opt/homelab-context/signals and .../approvals, but neither existed yet on apps' clone — git doesn't track empty directories, and nothing had ever written a signal/approval from that host. ProtectSystem=strict + a missing ReadWritePaths target is a hard 226/NAMESPACE crash, not a graceful degradation. Fixed two ways: the unit now marks those paths optional (`-` prefix) so a fresh deploy never crash-loops on this again, and deploy.sh now mkdir -p's them explicitly so the console has real write access from the first boot, not just a non-crashing-but-broken start. This is also the first real exercise of the auto-deploy pipeline: this push should land via Gitea webhook 14 -> oikos-console-deploy.service on apps, same as homelab-mcp/secrets-issuance already work. Co-Authored-By: Claude Fable 5 --- ledger/2026-07.jsonl | 1 + oikos/console/deploy/deploy.sh | 7 +++++++ oikos/console/deploy/oikos-console.service | 7 ++++++- 3 files changed, 14 insertions(+), 1 deletion(-) diff --git a/ledger/2026-07.jsonl b/ledger/2026-07.jsonl index 31faa0a..b91313b 100644 --- a/ledger/2026-07.jsonl +++ b/ledger/2026-07.jsonl @@ -2,3 +2,4 @@ {"ts": "2026-07-06T11:15:04+00:00", "agent": "mac-mini", "entity": "repo:Homelab-Docs", "action": "register-webhook", "risk": "config_mutation", "result": "ok", "notes": "webhook id 14 for oikos-console deploy"} {"ts": "2026-07-06T11:29:56+00:00", "agent": "mac-mini", "entity": "service:caddy", "action": "add-site-block", "risk": "config_mutation", "verification": "curl -s https://git.hubris.network (unrelated route still healthy after reload)", "result": "ok", "notes": "oikos.hubris.network -> 192.168.8.205:8091, Authentik-gated, in dtoro/caddy-conf@c195142"} {"ts": "2026-07-06T11:40:28+00:00", "agent": "mac-mini", "entity": "host:dns", "action": "add-record", "risk": "config_mutation", "verification": "dig @192.168.8.2 +short oikos.hubris.network", "result": "ok", "notes": "oikos.hubris.network A -> 192.168.8.175 (Caddy LAN IP), via Technitium API, no token persisted"} +{"ts": "2026-07-06T11:57:21+00:00", "agent": "mac-mini", "entity": "host:apps", "action": "deploy-oikos-console", "risk": "config_mutation", "verification": "curl http://127.0.0.1:8091/ on apps -> 200; https://oikos.hubris.network/ -> 302 (Authentik gate)", "result": "ok"} diff --git a/oikos/console/deploy/deploy.sh b/oikos/console/deploy/deploy.sh index ac44449..13381ee 100755 --- a/oikos/console/deploy/deploy.sh +++ b/oikos/console/deploy/deploy.sh @@ -32,6 +32,13 @@ if [ ! -d /opt/homelab-context/.git ]; then exit 1 fi +# signals/ and approvals/ are untracked-when-empty (git doesn't version +# empty directories), so a fresh clone won't have them. The systemd unit's +# ReadWritePaths need these to exist before the process starts (confirmed +# the hard way on first deploy, 2026-07-06 — a missing dir here is a +# 226/NAMESPACE crash-loop, not a graceful degradation). +mkdir -p /opt/homelab-context/signals /opt/homelab-context/approvals + systemctl daemon-reload if systemctl is-active --quiet oikos-console.service; then systemctl restart oikos-console.service diff --git a/oikos/console/deploy/oikos-console.service b/oikos/console/deploy/oikos-console.service index 6cc1ecd..3bd20d7 100644 --- a/oikos/console/deploy/oikos-console.service +++ b/oikos/console/deploy/oikos-console.service @@ -21,7 +21,12 @@ ProtectHome=true PrivateTmp=true NoNewPrivileges=true ReadOnlyPaths=/opt/homelab-context /opt/oikos-console -ReadWritePaths=/opt/homelab-context/signals /opt/homelab-context/approvals /opt/homelab-context/ledger /opt/homelab-context/oikos +# "-" prefix marks each path optional — signals/ and approvals/ are +# untracked-when-empty (git doesn't version empty dirs), so a fresh +# /opt/homelab-context clone won't have them yet. Without "-", systemd +# refuses to start at all (226/NAMESPACE) until something else creates +# them first — confirmed the hard way on first deploy (2026-07-06). +ReadWritePaths=-/opt/homelab-context/signals -/opt/homelab-context/approvals -/opt/homelab-context/ledger -/opt/homelab-context/oikos [Install] WantedBy=multi-user.target