From fdb465f8ac2ccef65cee0e9b4fdc05ff56b17468 Mon Sep 17 00:00:00 2001 From: archipelago Date: Sun, 21 Jun 2026 17:26:23 -0400 Subject: [PATCH] docs(#20): indeedhub fresh-create FIXED + verified on .228 (special-cases deleted + nginx caps); hook exec cgroup gap noted Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/PRODUCTION-MASTER-PLAN.md | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/docs/PRODUCTION-MASTER-PLAN.md b/docs/PRODUCTION-MASTER-PLAN.md index 021f7892..470080c1 100644 --- a/docs/PRODUCTION-MASTER-PLAN.md +++ b/docs/PRODUCTION-MASTER-PLAN.md @@ -160,7 +160,26 @@ phases 2–6 (`dual-ecash-design.md`). frontend :7778 → 200, nostr-provider.js → 200, **/api/ → 200 (proves network_aliases: frontend nginx `http://api:4000` resolved on indeedhub-net)**. Fleet healthy (36 containers, none down). - **FRESH-CREATE PATH = BLOCKED (found live 2026-06-21).** Removed the stateless + **FRESH-CREATE PATH = FIXED + VERIFIED (2026-06-21).** Deleted the legacy + indeedhub orchestrator special-cases (`b73084db`, −382 lines: reconcile_indeedhub_stack, + start_indeedhub_backends, the 120s dependency-DNS gate, patch_indeedhub_nostr_provider, + etc.) so "indeedhub" flows through the generic install_fresh path. Then two live fixes + on .228: (1) frontend nginx needs `capabilities: [CHOWN,DAC_OVERRIDE,SETGID,SETUID]` + under the orchestrator's --cap-drop=ALL (workers died "setgid(101) failed"); manifest + fix `ff8f11b8`. (2) NOTE: manifest reload needs an archipelago restart (manifests + cached at startup) — a disk manifest edit alone won't take. RESULT: frontend + fresh-creates via install_fresh, caps applied, post_install hook FIRES + (copy_from_host nostr-provider.js ✅), UI 200 (/, /nostr-provider.js, /api/). + **KNOWN GAP (general hook capability, NOT blocking indeedhub):** the post_install + `exec` steps fail via `podman exec` from the archipelago.service systemd cgroup + (`crun: write cgroup.procs: Permission denied / OCI permission denied`). Harmless + here (image bakes the nginx config so the exec steps are no-ops; copy_from_host is + the one that matters and works). FIX = wrap the hook executor's `podman exec` in a + transient user scope (`systemd-run --user --scope`, like `podman_user_scope`) in + core/archipelago/src/container/hooks.rs::run_podman. Do before relying on exec hooks + for an app whose image does NOT pre-bake its mutations. + + PRIOR (now resolved) — was: **FRESH-CREATE PATH = BLOCKED (found live 2026-06-21).** Removed the stateless frontend + reinstalled to exercise install_fresh → it FAILED: `orchestrator stack install indeedhub failed at app indeedhub: IndeedHub dependencies were not ready within 120s (indeedhub-api dependency DNS not ready)`,