fix(f3): prepare minio stateful smoke #315

Merged

pdurlej merged 1 commit from codex/f3/minio-prep into main

2026-05-17 03:06:35 +02:00

codex commented

2026-05-17 03:05:20 +02:00

Collaborator

Canary status: missing — F3 MinIO prep; rely on required Forgejo checks before merge

Canary Context Pack

Product story

MinIO is the local S3-compatible object store. Before F3 can smoke it safely, the manifest needs to reflect the actual Tailnet exposure, live image, volume, and health endpoint.

What changed

Populated strict-v2 metadata for minio from live RS2000 runtime evidence.
Corrected the live volume name to home-platform_minio_data.
Changed health probe to tailnet-https://minio.pdurlej.com/minio/health/ready.
Corrected exposure metadata from public/no-auth to Tailnet-only with ts-allowlist@file.
Recorded the first-F3 backup strategy: direct volume archive now, future mc mirror restore drill when object-store growth warrants it.

Why it changed

The existing manifest failed strict-v2 and pointed at a public health URL that returns 403 through the allowlist. Runtime evidence shows MinIO is healthy and reachable over Tailnet.

Files touched

modules/minio/module.yaml

Runtime evidence

home-platform-minio-1: running healthy, image minio/minio:RELEASE.2025-09-07T16-13-09Z.
Image digest: minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e.
Volume: home-platform_minio_data mounted at /data.
Live volume size: 168K.
Public https://minio.pdurlej.com/minio/health/ready returns HTTP 403.
Tailnet-resolved https://minio.pdurlej.com/minio/health/ready returns HTTP 200.
Container-local http://127.0.0.1:9000/minio/health/live returns HTTP 200.

Known constraints

This PR does not run backup/smoke. After merge, F3 still requires backup-before and manual workflow_dispatch with allow_stateful=true.

Explicit out-of-scope

No compose changes.
No MinIO restart.
No MinIO credentials or bucket contents printed.
No minio-init fix; that remains tracked separately (#310 for the blocked sidecar pattern).

Requested decision

Merge to unblock MinIO backup-before and F3 no-op smoke.

Merge blockers

strict-v2 validation failure
evidence that Tailnet health does not return HTTP 200
evidence that exposure metadata no longer matches Traefik middleware

BMADX

Gear: X3
Gate: execution_allowed=true, bmad_status=ok
Reason: stateful object storage with private data and restore blast radius.

Spec sources read

modules/minio/module.yaml — target manifest
modules/minio/runbook.md — container/runbook name
compose/core/compose.yaml — MinIO service, healthcheck, Traefik middleware
compose/base/compose.yaml — live volume naming pattern
scripts/cutover/README.md — F3 backup class guidance

Verification

python3 "$HOME/.codex/skills/bmadx/scripts/sync_bmadx.py" check --gear X3 --compact
control-plane/.venv/bin/python -m platformctl.cli validate --strict-v2 modules/minio/module.yaml
control-plane/.venv/bin/pytest control-plane/platformctl/tests/test_validate.py control-plane/platformctl/tests/test_health_phase3.py -q
git diff --check

Refs: #142

Canary status: missing — F3 MinIO prep; rely on required Forgejo checks before merge ## Canary Context Pack ### Product story MinIO is the local S3-compatible object store. Before F3 can smoke it safely, the manifest needs to reflect the actual Tailnet exposure, live image, volume, and health endpoint. ### What changed - Populated strict-v2 metadata for `minio` from live RS2000 runtime evidence. - Corrected the live volume name to `home-platform_minio_data`. - Changed health probe to `tailnet-https://minio.pdurlej.com/minio/health/ready`. - Corrected exposure metadata from public/no-auth to Tailnet-only with `ts-allowlist@file`. - Recorded the first-F3 backup strategy: direct volume archive now, future `mc mirror` restore drill when object-store growth warrants it. ### Why it changed The existing manifest failed strict-v2 and pointed at a public health URL that returns 403 through the allowlist. Runtime evidence shows MinIO is healthy and reachable over Tailnet. ### Files touched - `modules/minio/module.yaml` ### Runtime evidence - `home-platform-minio-1`: `running healthy`, image `minio/minio:RELEASE.2025-09-07T16-13-09Z`. - Image digest: `minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e`. - Volume: `home-platform_minio_data` mounted at `/data`. - Live volume size: `168K`. - Public `https://minio.pdurlej.com/minio/health/ready` returns HTTP 403. - Tailnet-resolved `https://minio.pdurlej.com/minio/health/ready` returns HTTP 200. - Container-local `http://127.0.0.1:9000/minio/health/live` returns HTTP 200. ### Known constraints This PR does not run backup/smoke. After merge, F3 still requires backup-before and manual `workflow_dispatch` with `allow_stateful=true`. ### Explicit out-of-scope - No compose changes. - No MinIO restart. - No MinIO credentials or bucket contents printed. - No `minio-init` fix; that remains tracked separately (#310 for the blocked sidecar pattern). ### Requested decision Merge to unblock MinIO backup-before and F3 no-op smoke. ### Merge blockers - strict-v2 validation failure - evidence that Tailnet health does not return HTTP 200 - evidence that exposure metadata no longer matches Traefik middleware ## BMADX - Gear: X3 - Gate: `execution_allowed=true`, `bmad_status=ok` - Reason: stateful object storage with private data and restore blast radius. ## Spec sources read - `modules/minio/module.yaml` — target manifest - `modules/minio/runbook.md` — container/runbook name - `compose/core/compose.yaml` — MinIO service, healthcheck, Traefik middleware - `compose/base/compose.yaml` — live volume naming pattern - `scripts/cutover/README.md` — F3 backup class guidance ## Verification ```bash python3 "$HOME/.codex/skills/bmadx/scripts/sync_bmadx.py" check --gear X3 --compact control-plane/.venv/bin/python -m platformctl.cli validate --strict-v2 modules/minio/module.yaml control-plane/.venv/bin/pytest control-plane/platformctl/tests/test_validate.py control-plane/platformctl/tests/test_health_phase3.py -q git diff --check ``` Refs: #142

codex added 1 commit

2026-05-17 03:05:20 +02:00

fix(f3): prepare minio stateful smoke

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 18s

Details

canary-required / canary (pull_request) Successful in 13s