# Cutover checklist — Phase 6: apps/105 → Docker stack on mac-mini

Status: [x] = done, [ ] = pending

## Pre-cutover

- [x] **Backup**: `pg_dump oikos > backups/pre-cutover-20260707.sql` (145K)
- [x] **CI green**: pushed to main, `.gitea/workflows/ci.yml` exists
- [x] **Deploy test**: Docker stack running with api + scheduler + notifier + hermes
- [x] **Caddy config**: `compose/caddy/Caddyfile.oikos` pushed to `dtoro/caddy-conf` (ed20908). Auto-deploys to caddy (121).
- [x] **DNS**: `oikos.hubris.network` already resolves to 192.168.8.175 (mac-mini mesh)
- [x] **Secrets**: Infisical bootstrapped 2026-07-07 — running on `:8080` (profile: full+infisical). Admin: `oikos@hubris.network`. Project: `oikos` (a436936f). Machine identity: `oikos-api` (UA: 82e6e362-bbee-...). ENCRYPTION_KEY must be 32-char raw string (Infisical docs incorrectly say hex). Env vars wired in `.env`: OIKOS_INFISICAL_SITE_URL/CLIENT_ID/CLIENT_SECRET/PROJECT_ID/ENV + OIKOS_SECRET_BACKEND=infisical. SOPS fallback preserved.
- [x] **Watchdog**: crontab entry added (every 2 min → `scripts/watchdog.sh`). Path fixed 2026-07-07 (was stale worktree path).

## Cutover

- [x] **Stop apps/105 services**: homelab-mcp-deploy, secrets-issuance, secrets-issuance-deploy, oikos-console, oikos-console-deploy
- [x] **Disable apps/105 services**: all 5 units disabled
- [x] **Deploy to mac-mini**: Docker stack running (`docker compose --profile full up -d`)
- [x] **Caddy reload**: pushed to `dtoro/caddy-conf` — auto-deploy triggers on LXC 121.
- [x] **DNS verify**: `oikos.hubris.network` → 192.168.8.175

## Post-cutover verification

- [x] **./scripts/verify-phase6.sh** — all 14 checks pass
- [x] **Hermes query**: `curl http://localhost:8092/query -d '{"query":"fleet health"}'` → HTTP 200
- [x] **Agent activity**: `curl http://localhost:8090/api/v1/agent-activity` → returns data
- [x] **Scheduler ticking**: 30s ticks logged
- [x] **Notifier polling**: running
- [x] **Watchdog tested**: 2026-07-07 — full cycle verified. API down → failure counting → Matrix alert sent (!alerts:hubris.network) → API recovery → counter reset. Crontab path fixed (was stale worktree path, now /Users/dtoro/Projects/oikos). MATRIX_TOKEN wired in crontab env.

## Rollback drill

- [ ] **./scripts/rollback.sh <previous-sha>** — pending rehearsal
- [ ] **Verify health**: pending
- [ ] **Re-deploy latest**: pending

## Cleanup

- [ ] Remove Gitea webhooks for apps/105 (ids 10, 11) from `dtoro/Homelab-Docs`
- [ ] Archive apps/105 LXC (keep for 30 days, then destroy)
- [x] Update auto-deploy docs — apps/105 entries marked deprecated