fix(f3): prepare traefik final smoke #317

Merged

pdurlej merged 1 commit from codex/f3/traefik-prep into main

2026-05-17 03:38:06 +02:00

codex commented

2026-05-17 03:34:14 +02:00

Collaborator

Canary status: missing — final Traefik F3 prep; rely on required Forgejo checks before merge

Canary Context Pack

Product story

Traefik is the final RS2000 edge-router service in the migration wave. Before F3 smoke, its manifest and canonical compose slice must be self-resolving so platformctl-auto-apply can run the same no-op preflight path used for the rest of F3.

What changed

Added include: ../base/compose.yaml to compose/edge/compose.yaml so the proxy network resolves when the edge slice is invoked directly.
Updated modules/traefik/module.yaml to strict-v2:
- user-facing outcome and acceptance criteria;
- observed image digest/audit fields;
- compose_file: compose/edge/compose.yaml;
- compose healthcheck contract;
- acknowledged final-boss routing risk.

Why it changed

The previous manifest pointed at compose/apps/compose.yaml, but traefik lives in compose/edge/compose.yaml. Direct edge compose preflight also failed because proxy was defined in base. Without this PR, F3 apply would fail before reaching the no-op safety path.

Files touched

compose/edge/compose.yaml
modules/traefik/module.yaml

Runtime evidence

Read-only preflight before this PR:

home-platform-traefik-1 is running, Docker health healthy.
Image: traefik:v3.6.8@sha256:90099f8948c828ecf0ababd711a4359a2443eba12261c1df2f548a3b1d815938.
Healthcheck: traefik healthcheck --ping returns OK.
Edge state mounts are small: acme.json ~280K, certs ~20K, dynamic config ~20K.

Known constraints

This does not run the F3 smoke by itself.
Traefik is high blast radius. Backup-before + representative route probes remain required before/after workflow_dispatch.
The health contract intentionally uses Docker/compose health; traefik.pdurlej.com/health is not a reliable public probe.

Explicit out-of-scope

No Traefik config changes beyond compose slice self-resolution.
No route/middleware edits.
No certificate rotation.
No production restart outside the approved F3 workflow path.

Requested decision

Merge so release-root promote can install the edge compose include before the final Traefik F3 smoke.

Merge blockers

Strict-v2 validation failure.
Compose edge preflight failure.
Required Forgejo checks failing.

Spec sources read

modules/traefik/module.yaml — manifest to prepare.
modules/traefik/runbook.md — recovery and runtime context.
compose/edge/compose.yaml — canonical Traefik service definition.
compose/base/compose.yaml — source of shared proxy network.
control-plane/platformctl/health.py — confirmed compose/container health rollup behavior.

Refs: #142

Canary status: missing — final Traefik F3 prep; rely on required Forgejo checks before merge ## Canary Context Pack ### Product story Traefik is the final RS2000 edge-router service in the migration wave. Before F3 smoke, its manifest and canonical compose slice must be self-resolving so `platformctl-auto-apply` can run the same no-op preflight path used for the rest of F3. ### What changed - Added `include: ../base/compose.yaml` to `compose/edge/compose.yaml` so the `proxy` network resolves when the edge slice is invoked directly. - Updated `modules/traefik/module.yaml` to strict-v2: - user-facing outcome and acceptance criteria; - observed image digest/audit fields; - `compose_file: compose/edge/compose.yaml`; - compose healthcheck contract; - acknowledged final-boss routing risk. ### Why it changed The previous manifest pointed at `compose/apps/compose.yaml`, but `traefik` lives in `compose/edge/compose.yaml`. Direct edge compose preflight also failed because `proxy` was defined in `base`. Without this PR, F3 apply would fail before reaching the no-op safety path. ### Files touched - `compose/edge/compose.yaml` - `modules/traefik/module.yaml` ### Runtime evidence Read-only preflight before this PR: - `home-platform-traefik-1` is `running`, Docker health `healthy`. - Image: `traefik:v3.6.8@sha256:90099f8948c828ecf0ababd711a4359a2443eba12261c1df2f548a3b1d815938`. - Healthcheck: `traefik healthcheck --ping` returns OK. - Edge state mounts are small: `acme.json` ~280K, `certs` ~20K, dynamic config ~20K. ### Known constraints - This does not run the F3 smoke by itself. - Traefik is high blast radius. Backup-before + representative route probes remain required before/after workflow_dispatch. - The health contract intentionally uses Docker/compose health; `traefik.pdurlej.com/health` is not a reliable public probe. ### Explicit out-of-scope - No Traefik config changes beyond compose slice self-resolution. - No route/middleware edits. - No certificate rotation. - No production restart outside the approved F3 workflow path. ### Requested decision Merge so release-root promote can install the edge compose include before the final Traefik F3 smoke. ### Merge blockers - Strict-v2 validation failure. - Compose edge preflight failure. - Required Forgejo checks failing. ## Spec sources read - `modules/traefik/module.yaml` — manifest to prepare. - `modules/traefik/runbook.md` — recovery and runtime context. - `compose/edge/compose.yaml` — canonical Traefik service definition. - `compose/base/compose.yaml` — source of shared `proxy` network. - `control-plane/platformctl/health.py` — confirmed compose/container health rollup behavior. Refs: #142

codex added 1 commit

2026-05-17 03:34:14 +02:00

fix(f3): prepare traefik final smoke

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 19s

Details

canary-required / canary (pull_request) Successful in 12s