pdurlej/platform

Fork 0

ops(rs2000-legacy): remove legacy env fallback after bind mounts migrate #555

New issue

Closed

opened 2026-05-28 01:37:57 +02:00 by codex · 2 comments

codex commented

2026-05-28 01:37:57 +02:00

Collaborator

Scope

Remove dependence on /opt/vps-home-platform-infra/env only after service bind mounts and runtime imports are proven safe.

Observed legacy path

/opt/vps-home-platform-infra/env: exists, 356K
Prior status notes legacy env fallback/import paths under /opt/pdurlej-platform/runtime/legacy-import/env.

Acceptance criteria

Confirm which runtime/runner paths still read /opt/vps-home-platform-infra/env.
Confirm canonical runtime env import path exists and is used.
PR removes or documents any remaining fallback references.
No env values are printed.
Runtime changes require explicit operator approval.

Out of scope

Editing secrets.
Rotating tokens.
Removing Infisical fallbacks unrelated to legacy env path.

Common safety rules

Recommended executor: Gemini 3.5 Flash local for repo/doc/plan work.
Do not delete, rename, prune, or edit /opt/vps-home-platform-infra in this issue.
Do not print secrets, env values, private messages, emails, or Iskra memory.
Runtime execution requires a separate explicit operator approval in the PR/issue thread.
First step is always read-only evidence refresh.
Preserve ownership, modes, symlinks, and timestamps when copying data/config.
Update compose/module docs through a PR before recreating affected services.
Recreate only affected service(s), never the whole platform, unless a later operator gate says otherwise.

## Scope Remove dependence on `/opt/vps-home-platform-infra/env` only after service bind mounts and runtime imports are proven safe. ## Observed legacy path - `/opt/vps-home-platform-infra/env`: exists, 356K - Prior status notes legacy env fallback/import paths under `/opt/pdurlej-platform/runtime/legacy-import/env`. ## Acceptance criteria - Confirm which runtime/runner paths still read `/opt/vps-home-platform-infra/env`. - Confirm canonical runtime env import path exists and is used. - PR removes or documents any remaining fallback references. - No env values are printed. - Runtime changes require explicit operator approval. ## Out of scope - Editing secrets. - Rotating tokens. - Removing Infisical fallbacks unrelated to legacy env path. ## Common safety rules - Recommended executor: Gemini 3.5 Flash local for repo/doc/plan work. - Do not delete, rename, prune, or edit `/opt/vps-home-platform-infra` in this issue. - Do not print secrets, env values, private messages, emails, or Iskra memory. - Runtime execution requires a separate explicit operator approval in the PR/issue thread. - First step is always read-only evidence refresh. - Preserve ownership, modes, symlinks, and timestamps when copying data/config. - Update compose/module docs through a PR before recreating affected services. - Recreate only affected service(s), never the whole platform, unless a later operator gate says otherwise.

codex added this to the 01 - RS2000 closeout and legacy cleanup milestone

2026-05-28 01:37:57 +02:00

codex added the

class/security-sensitive

labels

2026-05-28 01:37:57 +02:00

codex referenced this issue

2026-05-29 01:04:22 +02:00

ops(rs2000-legacy): refresh live bind-mount inventory before migration batches #543

codex commented

2026-05-29 01:05:26 +02:00

Author

Collaborator

Current evidence after PR #593:

running Vault config mount is fixed and issue #553 is closed.
remaining legacy env/script mounts are from exited container home-platform-vault-bootstrap-1 only:
- /opt/vps-home-platform-infra/env -> /vault-bootstrap
- /opt/vps-home-platform-infra/scripts/vault -> /vault/scripts
vault-bootstrap lifecycle is archived/exited. Do not rerun it as part of routine cleanup.

This issue should decide whether to remove the exited container metadata after evidence capture, or leave it until the broader Vault sunset gate. No secret values should be printed.

Current evidence after PR #593: - running Vault config mount is fixed and issue #553 is closed. - remaining legacy env/script mounts are from exited container `home-platform-vault-bootstrap-1` only: - `/opt/vps-home-platform-infra/env` -> `/vault-bootstrap` - `/opt/vps-home-platform-infra/scripts/vault` -> `/vault/scripts` - `vault-bootstrap` lifecycle is archived/exited. Do not rerun it as part of routine cleanup. This issue should decide whether to remove the exited container metadata after evidence capture, or leave it until the broader Vault sunset gate. No secret values should be printed.

codex referenced this issue

2026-05-29 01:05:26 +02:00

ops(rs2000-legacy): validate zero legacy bind mounts and green smokes #556

codex commented

2026-05-29 01:48:39 +02:00

Author

Collaborator

Completed for active dependency purposes.

Runtime evidence:

Running vault config was moved by PR #593 and runtime-applied successfully.
The exited home-platform-vault-bootstrap-1 archived oneshot was snapshotted to /opt/pdurlej-platform/runtime/m01-container-snapshots mode 0600, then removed so no stopped container metadata keeps legacy env/script bind references.
No env values or secret contents were printed.
Current compose definition already points Vault-bootstrap scripts/env at /opt/pdurlej-platform/runtime/legacy-import/... if an operator ever intentionally reruns it.

No env directory, secret, or source data was deleted.

Completed for active dependency purposes. Runtime evidence: - Running `vault` config was moved by PR #593 and runtime-applied successfully. - The exited `home-platform-vault-bootstrap-1` archived oneshot was snapshotted to `/opt/pdurlej-platform/runtime/m01-container-snapshots` mode 0600, then removed so no stopped container metadata keeps legacy env/script bind references. - No env values or secret contents were printed. - Current compose definition already points Vault-bootstrap scripts/env at `/opt/pdurlej-platform/runtime/legacy-import/...` if an operator ever intentionally reruns it. No env directory, secret, or source data was deleted.

codex closed this issue

2026-05-29 01:48:40 +02:00