fix(cutover): remount coredns config imports #585

Merged

pdurlej merged 1 commit from codex/m01-remount-coredns-config into main

2026-05-29 00:11:15 +02:00

codex commented

2026-05-29 00:10:17 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Summary

M01 config-only remount batch for coredns.

This PR moves CoreDNS config defaults to prepared legacy-import paths:

Corefile: /opt/pdurlej-platform/runtime/legacy-import/config/coredns/Corefile
zones dir: /opt/pdurlej-platform/runtime/legacy-import/config/coredns/zones

The old legacy paths remain available as explicit rollback env vars for one rollback cycle.

Canary Context Pack

Product story

M01 needs active services to stop depending on /opt/vps-home-platform-infra before quarantine/destructive cleanup. CoreDNS is a small config-only move, but it is infrastructure-sensitive because it serves Tailnet-bound DNS.

What changed

compose/core/compose.yaml: CoreDNS config mounts now default to copied legacy-import paths.
modules/coredns/runbook.md: documents config sources and rollback env vars.

Why it changed

The legacy root must stop being the default runtime source. This keeps old paths as rollback material while making the canonical release root independent of the legacy project tree.

Files touched

compose/core/compose.yaml
modules/coredns/runbook.md

Relevant context

M01 RS2000 closeout critical path
Prior remount batches for ntfy, dashboard, and searxng applied cleanly at runtime
CoreDNS is handled as its own PR because DNS blast radius is higher than app config

Runtime evidence

Prep copy already run on RS2000 before this PR:

scripts/cutover/prepare-legacy-import.sh --dry-run --path config/coredns/Corefile
scripts/cutover/prepare-legacy-import.sh --yes --path config/coredns/Corefile
target_mode=644 target_size=81 /opt/pdurlej-platform/runtime/legacy-import/config/coredns/Corefile

scripts/cutover/prepare-legacy-import.sh --dry-run --path config/coredns/zones
scripts/cutover/prepare-legacy-import.sh --yes --path config/coredns/zones
target_size 8.0K /opt/pdurlej-platform/runtime/legacy-import/config/coredns/zones

No service restart was performed for this PR.

Known constraints

This does not delete or quarantine legacy paths.
This does not change CoreDNS zone contents.
This does not recreate the container before merge.

Explicit out-of-scope

data migration
service restart before merge
destructive cleanup
quarantine/tombstone
Traefik, Matrix, NP, Vault, and stateful data remounts

Requested decision

Approve this as the CoreDNS config-only remount if checks are green.

Merge blockers

copied CoreDNS config targets missing on RS2000
compose syntax failure
reviewer finds a DNS rollback risk not covered by rollback env vars

Validation

git diff --check: passed
PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json: passed, exit 0

Spec sources read

compose/core/compose.yaml — mount declarations
modules/coredns/runbook.md — operator rollback/runbook update

Non-goals

No DB, no service, no webhooks, no issue/comment mutation, no destructive cleanup.

Canary status: missing — fire canary 3+3 manually before merge ## Summary M01 config-only remount batch for `coredns`. This PR moves CoreDNS config defaults to prepared `legacy-import` paths: - `Corefile`: `/opt/pdurlej-platform/runtime/legacy-import/config/coredns/Corefile` - zones dir: `/opt/pdurlej-platform/runtime/legacy-import/config/coredns/zones` The old legacy paths remain available as explicit rollback env vars for one rollback cycle. ## Canary Context Pack ### Product story M01 needs active services to stop depending on `/opt/vps-home-platform-infra` before quarantine/destructive cleanup. CoreDNS is a small config-only move, but it is infrastructure-sensitive because it serves Tailnet-bound DNS. ### What changed - `compose/core/compose.yaml`: CoreDNS config mounts now default to copied `legacy-import` paths. - `modules/coredns/runbook.md`: documents config sources and rollback env vars. ### Why it changed The legacy root must stop being the default runtime source. This keeps old paths as rollback material while making the canonical release root independent of the legacy project tree. ### Files touched - `compose/core/compose.yaml` - `modules/coredns/runbook.md` ### Relevant context - M01 RS2000 closeout critical path - Prior remount batches for `ntfy`, `dashboard`, and `searxng` applied cleanly at runtime - CoreDNS is handled as its own PR because DNS blast radius is higher than app config ### Runtime evidence Prep copy already run on RS2000 before this PR: ```text scripts/cutover/prepare-legacy-import.sh --dry-run --path config/coredns/Corefile scripts/cutover/prepare-legacy-import.sh --yes --path config/coredns/Corefile target_mode=644 target_size=81 /opt/pdurlej-platform/runtime/legacy-import/config/coredns/Corefile scripts/cutover/prepare-legacy-import.sh --dry-run --path config/coredns/zones scripts/cutover/prepare-legacy-import.sh --yes --path config/coredns/zones target_size 8.0K /opt/pdurlej-platform/runtime/legacy-import/config/coredns/zones ``` No service restart was performed for this PR. ### Known constraints - This does not delete or quarantine legacy paths. - This does not change CoreDNS zone contents. - This does not recreate the container before merge. ### Explicit out-of-scope - data migration - service restart before merge - destructive cleanup - quarantine/tombstone - Traefik, Matrix, NP, Vault, and stateful data remounts ### Requested decision Approve this as the CoreDNS config-only remount if checks are green. ### Merge blockers - copied CoreDNS config targets missing on RS2000 - compose syntax failure - reviewer finds a DNS rollback risk not covered by rollback env vars ## Validation - `git diff --check`: passed - `PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json`: passed, exit 0 ## Spec sources read - `compose/core/compose.yaml` — mount declarations - `modules/coredns/runbook.md` — operator rollback/runbook update ## Non-goals No DB, no service, no webhooks, no issue/comment mutation, no destructive cleanup.

codex added this to the 01 - RS2000 closeout and legacy cleanup milestone

2026-05-29 00:10:17 +02:00

codex added the

risk/runtime

cutover-gate

phase/03

class/security-sensitive

labels