dtoro
ec119566fd
Some checks failed
Removes the entire Matrix-based notifier (internal/notifier/) that polled
for pending approvals, sent Matrix alerts, and checked for reaction-based
approve/deny. Approval decisions now work on any chat platform (Hermes
desktop, Telegram, Discord, WhatsApp, CLI) via two new MCP tools:
- list_approvals — query pending/recent approvals by status or entity
- decide_approval — approve/deny via same API endpoint as UI + nomos
Config fields removed: MatrixHomeserver, MatrixUserID, MatrixToken,
MatrixRoomID, ApprovalHMACSecret. Docker notifier: service removed.
Approval HMAC token generation removed (unused by code).
The existing chat-assent path in nomos (cmd/nomos/assent.go) and the
control-room Approve button keep working unchanged — both call the
shared POST /api/v1/approvals/{id}/decision endpoint.
2.7 KiB
2.7 KiB
Cutover checklist — Phase 6: apps/105 → Docker stack on mac-mini
Status: [x] = done, [ ] = pending
Pre-cutover
- Backup:
pg_dump oikos > backups/pre-cutover-20260707.sql(145K) - CI green: pushed to main,
.gitea/workflows/ci.ymlexists - Deploy test: Docker stack running with api + scheduler + nomos
- Caddy config:
compose/caddy/Caddyfile.oikospushed todtoro/caddy-conf(ed20908). Auto-deploys to caddy (121). - DNS:
oikos.hubris.networkalready resolves to 192.168.8.175 (mac-mini mesh) - Secrets: Infisical bootstrapped + migration complete 2026-07-07. All 11 SOPS secrets migrated to Infisical (oikos project, dev env). Machine identity
oikos-apihas RW access verified via Go SDK. ENCRYPTION_KEY must be 32-char raw string (docs incorrect). SOPS fallback preserved for DR. secrets-issuance decommissioned — stopped/disabled on apps/105; superseded by Infisical. - Watchdog: crontab entry added (every 2 min →
scripts/watchdog.sh). Path fixed 2026-07-07 (was stale worktree path).
Cutover
- Stop apps/105 services: homelab-mcp-deploy, secrets-issuance, secrets-issuance-deploy, oikos-console, oikos-console-deploy
- Disable apps/105 services: all 5 units disabled
- Deploy to mac-mini: Docker stack running (
docker compose --profile full up -d) - Caddy reload: pushed to
dtoro/caddy-conf— auto-deploy triggers on LXC 121. - DNS verify:
oikos.hubris.network→ 192.168.8.175
Post-cutover verification
- ./scripts/verify-phase6.sh — all 14 checks pass
- Nomos query:
curl http://localhost:8092/query -d '{"query":"fleet health"}'→ HTTP 200 - Agent activity:
curl http://localhost:8090/api/v1/agent-activity→ returns data - Scheduler ticking: 30s ticks logged
- Notifier polling: running
- Watchdog tested: 2026-07-07 — full cycle verified. API down → failure counting → Matrix alert sent (!alerts:hubris.network) → API recovery → counter reset. Crontab path fixed (was stale worktree path, now /Users/dtoro/Projects/oikos). MATRIX_TOKEN wired in crontab env.
Rollback drill
- ./scripts/rollback.sh — rehearsed 2026-07-07. Backup (674KB) → stop stack → restore DB → checkout
7ac2521→ rebuild → health OK (20 tools working) → re-deploy latest (21 tools). Full cycle verified.
Cleanup
- Remove Gitea webhooks for apps/105 (ids 10, 11, 14) from
dtoro/oikos— deleted 2026-07-08 via Gitea API - Archive apps/105 LXC (keep for 30 days, then destroy)
→
ssh hubris pct stop 105 && pct snapshot 105 archive-$(date +%Y%m%d) - Update auto-deploy docs — apps/105 entries marked deprecated