fix(runbooks): vpn-remote-access step 1 named a nonexistent script; step 2 cited the wrong gitignore rule

Conversation 0 Commits 1 Files Changed 2

+140 -5

1 Commits

Author SHA1 Message Date

Author	SHA1	Message	Date
jakman85andClaude Opus 5	18f741d744	fix(runbooks): vpn-remote-access step 1 named a nonexistent script; step 2 cited the wrong gitignore rule gate / gate (pull_request) Successful in 1m47s Details gate / conformance (pull_request) Has been skipped Details Both reported by the operator on first use of the runbook merged in #55. Step 1 said `cd infra/ansible && ./site.sh --tags system --limit k3s_prod`. There is no site.sh anywhere in this repo. It was wrong four ways at once: this repo drives Ansible with `ansible-playbook <playbook>` and never a wrapper (playbooks/site.yml is the full bring-up chain, not this); the module work is in playbooks/node-baseline.yml; targeting here is `-e k3s_hosts=...`, not `--limit`; and Ansible exists only in the pinned toolbox, with ansible.cfg read only from infra/ansible. Replaced with the real command plus why `-e k3s_hosts=k3s_prod` matters (the default group is decommissioned dev) and why `--tags system` must never be dropped (an untagged run also executes the `disks` tasks, which assert on prod's deliberate placeholder devices). Step 2 told the operator to stage the server key at /work/.cache/server.key "inside the repo's gitignored cache". .cache/ is NOT gitignored -- the file was ignored only incidentally by `*.key` (.gitignore:11). So the path was safe for a reason I had not identified, and renaming it (server.pem, wg-server) would have left a committable WireGuard private key in the checkout, which no-plaintext-secrets does not recognise. The step now names the real rule, marks the suffix as the load-bearing part, and gives a check-ignore verification to run before trusting it. Docs only -- no manifest and no behaviour change. Touches no sensitive path. Also records the post-merge measurements for #55, whose own entry predates the merge: Flux applied `ad3f56e` by the real path, all 18 Kustomizations Ready, hostNetwork confirmed (pod IPs are the node IPs), and the designed fail-closed state (Init:0/1 on the missing wg-server-key Secret). Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>	2026-10-05 23:08:19 -05:00

jakman85andClaude Opus 5

18f741d744

fix(runbooks): vpn-remote-access step 1 named a nonexistent script; step 2 cited the wrong gitignore rule

gate / gate (pull_request) Successful in 1m47s

Details

gate / conformance (pull_request) Has been skipped

Details

Both reported by the operator on first use of the runbook merged in #55.

Step 1 said `cd infra/ansible && ./site.sh --tags system --limit k3s_prod`.
There is no site.sh anywhere in this repo. It was wrong four ways at once:
this repo drives Ansible with `ansible-playbook <playbook>` and never a
wrapper (playbooks/site.yml is the full bring-up chain, not this); the module
work is in playbooks/node-baseline.yml; targeting here is `-e k3s_hosts=...`,
not `--limit`; and Ansible exists only in the pinned toolbox, with ansible.cfg
read only from infra/ansible. Replaced with the real command plus why
`-e k3s_hosts=k3s_prod` matters (the default group is decommissioned dev) and
why `--tags system` must never be dropped (an untagged run also executes the
`disks` tasks, which assert on prod's deliberate placeholder devices).

Step 2 told the operator to stage the server key at /work/.cache/server.key
"inside the repo's gitignored cache". .cache/ is NOT gitignored -- the file was
ignored only incidentally by `*.key` (.gitignore:11). So the path was safe for
a reason I had not identified, and renaming it (server.pem, wg-server) would
have left a committable WireGuard private key in the checkout, which
no-plaintext-secrets does not recognise. The step now names the real rule,
marks the suffix as the load-bearing part, and gives a check-ignore
verification to run before trusting it.

Docs only -- no manifest and no behaviour change. Touches no sensitive path.
Also records the post-merge measurements for #55, whose own entry predates the
merge: Flux applied ad3f56e by the real path, all 18 Kustomizations Ready,
hostNetwork confirmed (pod IPs are the node IPs), and the designed fail-closed
state (Init:0/1 on the missing wg-server-key Secret).

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

2026-10-05 23:08:19 -05:00

fix(runbooks): vpn-remote-access step 1 named a nonexistent script; step 2 cited the wrong gitignore rule #58