29 lines
1.7 KiB
Markdown
29 lines
1.7 KiB
Markdown
# Provisioning the release container — method
|
|
|
|
> **The record lives in the operator's infra repo** (`services/flybrain/release-ct-provision.md`), verbatim and dated:
|
|
> which host, which container id, which address and MAC, and what each step actually did.
|
|
|
|
Read `infra/README.md` for the host-side steps and the dev/release split, and
|
|
`infra/docs/runbook.md`'s "Cutting a release" for what happens after.
|
|
|
|
Method, once per container, from the operator's own env file passed by path:
|
|
|
|
1. `infra/provision.sh <release-env>` runs steps 01-07. On a first run there is no
|
|
release artifact yet, so run it without `--release`: it converges every unit, config
|
|
file and `bin/` helper and leaves the app units unstarted.
|
|
`PRERELEASE_UNITS=1` is what lets step 05 converge units from an untagged tree.
|
|
2. Step 06 (secrets) reads `pass` on the **operator box**, not the host, so it refuses
|
|
when run anywhere without the password store — that refusal is not the container's
|
|
fault and does not invalidate steps 01-05.
|
|
3. Step 07 (enable) is deliberately last and deliberately manual: it is what turns the
|
|
units on, and on a release container `flypush.service` stays disabled until the
|
|
operator approves that run.
|
|
4. `infra/verify.sh <release-env>` is the gate. A second `provision.sh` run must
|
|
converge nothing — `verify.sh`'s "no second-run restarts" check depends on the
|
|
per-run log `provision.sh` pushes into the container.
|
|
5. The router-side reservation (DHCP plus a MAC reservation, not an in-guest static
|
|
address) is requested by hand and confirmed free before provisioning. The address and
|
|
the MAC are in the moved record, not here.
|
|
|
|
Claim the container in the host's agent claim log before any of this, and release it after
|
|
(`CLAUDE.md`).
|