fix(modules): prepare searxng for F3 smoke #302

Merged

pdurlej merged 1 commit from codex/f3/searxng-strict-tailnet into main

2026-05-16 23:22:33 +02:00

codex commented

2026-05-16 23:21:57 +02:00

Collaborator

Canary status: local verification — strict-v2, smoke, auto-apply scope, and health/CI contract tests pass; Forgejo PR checks required before merge.

Summary

Tighten searxng user_facing_outcome so strict-v2 health can pass.
Change the health probe from public https:// to tailnet-https://, matching its tailnet-only exposure model.

Order of operations

Backup was run first, before this PR, per F3 stateful contract:

backup-before-apply.sh searxng
backup ref: /opt/pdurlej-platform/backups/searxng-20260516T212014Z.tar.gz
mode/owner/size: 600 root:root 17166
archive includes home-platform_searxng_data, read-only settings bind, and cache volume.

Evidence

Public route from RS2000: https://searx.pdurlej.com/healthz => HTTP 403
Tailnet-resolved route from RS2000: https://searx.pdurlej.com/healthz with --resolve ...:100.110.188.20 => HTTP 200
uv run --project control-plane python -m platformctl validate --strict-v2 modules/searxng/module.yaml => OK, estimated tokens 385
PLATFORMCTL_SMOKE_REMOTE_MODE=skip ... tests/smoke.sh --json searxng => health-http:PASS-200
uv run --project control-plane python control-plane/platformctl/ci/auto_apply_scope.py --base HEAD~1 --head HEAD --module searxng --allow-stateful --backup-ref /opt/pdurlej-platform/backups/searxng-20260516T212014Z.tar.gz => eligible
uv run --project control-plane pytest control-plane/platformctl/tests/test_health_phase3.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py => 50 passed
git diff --check => clean

Risk

Lite. One stateful module manifest only; no runtime mutation in this PR, no compose change, no secret change. Runtime backup already exists before final F3 smoke.

Spec sources read

modules/searxng/module.yaml — F3 target manifest and health definition
modules/searxng/runbook.md — runtime, state, exposure, backup context
scripts/cutover/README.md — F3 backup class mapping
scripts/cutover/backup-before-apply.sh — backup procedure
tests/smoke.sh — tailnet-https:// probe semantics

Canary status: local verification — strict-v2, smoke, auto-apply scope, and health/CI contract tests pass; Forgejo PR checks required before merge. ## Summary - Tighten `searxng` `user_facing_outcome` so strict-v2 health can pass. - Change the health probe from public `https://` to `tailnet-https://`, matching its `tailnet-only` exposure model. ## Order of operations Backup was run first, before this PR, per F3 stateful contract: - `backup-before-apply.sh searxng` - backup ref: `/opt/pdurlej-platform/backups/searxng-20260516T212014Z.tar.gz` - mode/owner/size: `600 root:root 17166` - archive includes `home-platform_searxng_data`, read-only settings bind, and cache volume. ## Evidence - Public route from RS2000: `https://searx.pdurlej.com/healthz` => HTTP 403 - Tailnet-resolved route from RS2000: `https://searx.pdurlej.com/healthz` with `--resolve ...:100.110.188.20` => HTTP 200 - `uv run --project control-plane python -m platformctl validate --strict-v2 modules/searxng/module.yaml` => OK, estimated tokens 385 - `PLATFORMCTL_SMOKE_REMOTE_MODE=skip ... tests/smoke.sh --json searxng` => `health-http:PASS-200` - `uv run --project control-plane python control-plane/platformctl/ci/auto_apply_scope.py --base HEAD~1 --head HEAD --module searxng --allow-stateful --backup-ref /opt/pdurlej-platform/backups/searxng-20260516T212014Z.tar.gz` => eligible - `uv run --project control-plane pytest control-plane/platformctl/tests/test_health_phase3.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` => 50 passed - `git diff --check` => clean ## Risk Lite. One stateful module manifest only; no runtime mutation in this PR, no compose change, no secret change. Runtime backup already exists before final F3 smoke. ## Spec sources read - `modules/searxng/module.yaml` — F3 target manifest and health definition - `modules/searxng/runbook.md` — runtime, state, exposure, backup context - `scripts/cutover/README.md` — F3 backup class mapping - `scripts/cutover/backup-before-apply.sh` — backup procedure - `tests/smoke.sh` — `tailnet-https://` probe semantics

codex added 1 commit

2026-05-16 23:21:57 +02:00

fix(modules): prepare searxng for F3 smoke

base-is-main / guard (pull_request) Successful in 2s

Details

canary-required / collect-diff (pull_request) Successful in 5s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 21s

Details

canary-required / canary (pull_request) Successful in 13s