docs: import canonical RS2000 compose candidate #241

Merged

pdurlej merged 1 commit from codex/auto-deploy/canonical-compose into main

2026-05-12 08:07:47 +02:00

codex commented

2026-05-12 08:02:28 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

Piotr needs RS2000 to become git-controlled. This PR adds the repo-side canonical compose candidate, but keeps runtime cutover separate so merge is not secretly a production change.

What changed

Added compose/ with candidate canonical RS2000 compose files imported from the live read-only RS2000 compose inventory:

compose/apps/compose.yaml
compose/base/compose.yaml
compose/core/compose.yaml
compose/edge/compose.yaml
compose/README.md

Secret-like CHANGE_ME_* defaults from live compose were converted to required environment substitutions where the variable name was identifiable.

Why it changed

Auto Deploy cannot become the normal path until the desired compose state exists in pdurlej/platform. This PR creates that repo-side desired-state candidate without changing RS2000 yet.

Files touched

compose/README.md
compose/apps/compose.yaml
compose/base/compose.yaml
compose/core/compose.yaml
compose/edge/compose.yaml

Relevant context

#239 is the inventory PR this canonical import is derived from.
Legacy live root remains /opt/vps-home-platform-infra.
Target future root remains /opt/pdurlej-platform/current.

Runtime evidence

No RS2000 runtime mutation.

Checks run:

for f in compose/base/compose.yaml compose/core/compose.yaml compose/edge/compose.yaml compose/apps/compose.yaml; do
  docker compose -f "$f" config --no-interpolate >/tmp/compose-config-check.out

done
# docker compose config --no-interpolate OK

python3 - <<'PY'
from pathlib import Path
import yaml
for path in sorted(Path('compose').rglob('*.yaml')):
    yaml.safe_load(path.read_text())
print('canonical compose YAML parse OK')
PY

git diff --check

Secret-safety check: no CHANGE_ME defaults remain in compose YAML. Remaining secret-like strings are environment variable names/substitutions, not raw values.

Known constraints

These files are not live until a later cutover creates/syncs /opt/pdurlej-platform/current and points auto-apply at it. This PR intentionally avoids touching RS2000.

Explicit out-of-scope

No deploy root creation.
No RS2000 file writes.
No service restart.
No MOVED.md on RS2000 yet.
No runtime compose cutover.

Requested decision

Approve the canonical compose candidate as repo-side desired state, then do a separate cutover/setup PR/runbook before any runtime mutation uses it.

Merge blockers

Any real secret value in compose/**.
Any reviewer finding that this PR would be mistaken for a live cutover.
Any compose parse/config failure.

Operator Merge Checklist

Prefer merging #239 inventory first, then this PR.
Merge does not deploy. Do not SSH/run compose because of this PR alone.
After merge, ask Codex for the deploy-root setup/cutover PR/runbook.

Spec sources read

#239 inventory artifacts — source snapshot for canonical import.
Live RS2000 read-only files under /opt/vps-home-platform-infra/compose/**/compose.yaml — import source.
compose/README.md added in this PR — operator safety boundary.

Refs #142
Refs #220

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Piotr needs RS2000 to become git-controlled. This PR adds the repo-side canonical compose candidate, but keeps runtime cutover separate so merge is not secretly a production change. ### What changed Added `compose/` with candidate canonical RS2000 compose files imported from the live read-only RS2000 compose inventory: - `compose/apps/compose.yaml` - `compose/base/compose.yaml` - `compose/core/compose.yaml` - `compose/edge/compose.yaml` - `compose/README.md` Secret-like `CHANGE_ME_*` defaults from live compose were converted to required environment substitutions where the variable name was identifiable. ### Why it changed Auto Deploy cannot become the normal path until the desired compose state exists in `pdurlej/platform`. This PR creates that repo-side desired-state candidate without changing RS2000 yet. ### Files touched - `compose/README.md` - `compose/apps/compose.yaml` - `compose/base/compose.yaml` - `compose/core/compose.yaml` - `compose/edge/compose.yaml` ### Relevant context - #239 is the inventory PR this canonical import is derived from. - Legacy live root remains `/opt/vps-home-platform-infra`. - Target future root remains `/opt/pdurlej-platform/current`. ### Runtime evidence No RS2000 runtime mutation. Checks run: ```bash for f in compose/base/compose.yaml compose/core/compose.yaml compose/edge/compose.yaml compose/apps/compose.yaml; do docker compose -f "$f" config --no-interpolate >/tmp/compose-config-check.out done # docker compose config --no-interpolate OK python3 - <<'PY' from pathlib import Path import yaml for path in sorted(Path('compose').rglob('*.yaml')): yaml.safe_load(path.read_text()) print('canonical compose YAML parse OK') PY git diff --check ``` Secret-safety check: no `CHANGE_ME` defaults remain in compose YAML. Remaining secret-like strings are environment variable names/substitutions, not raw values. ### Known constraints These files are not live until a later cutover creates/syncs `/opt/pdurlej-platform/current` and points auto-apply at it. This PR intentionally avoids touching RS2000. ### Explicit out-of-scope - No deploy root creation. - No RS2000 file writes. - No service restart. - No `MOVED.md` on RS2000 yet. - No runtime compose cutover. ### Requested decision Approve the canonical compose candidate as repo-side desired state, then do a separate cutover/setup PR/runbook before any runtime mutation uses it. ### Merge blockers - Any real secret value in `compose/**`. - Any reviewer finding that this PR would be mistaken for a live cutover. - Any compose parse/config failure. ## Operator Merge Checklist 1. Prefer merging #239 inventory first, then this PR. 2. Merge does not deploy. Do not SSH/run compose because of this PR alone. 3. After merge, ask Codex for the deploy-root setup/cutover PR/runbook. ## Spec sources read - #239 inventory artifacts — source snapshot for canonical import. - Live RS2000 read-only files under `/opt/vps-home-platform-infra/compose/**/compose.yaml` — import source. - `compose/README.md` added in this PR — operator safety boundary. Refs #142 Refs #220

codex added 1 commit

2026-05-12 08:02:28 +02:00

docs: import canonical RS2000 compose candidate

canary-required / collect-diff (pull_request) Failing after 3s

Details

canary-required / canary (pull_request) Has been skipped

Details

base-is-main / guard (pull_request) Successful in 1s

Details

67fc427925

codex added the

class/security-sensitive