fix(cutover): remount vault runtime imports #593

Merged

pdurlej merged 1 commit from codex/m01-remount-vault-imports into main

2026-05-29 00:57:19 +02:00

codex commented

2026-05-29 00:56:40 +02:00

Collaborator

Canary status: local validation passed; Forgejo canary may remain pending due runner queue.

Summary

Remounts Vault runtime config and Vault-bootstrap scripts/env from the M01 legacy-import runtime tree instead of implicit release-root or legacy /opt/vps-home-platform-infra paths.

This is intentionally narrow. Runtime apply will recreate only vault; it must not run vault-bootstrap because that module is an archived oneshot.

Canary Context Pack

Product story

M01 needs active containers to stop depending on /opt/vps-home-platform-infra before RS2000 legacy paths can be quarantined safely. Vault is sunset, so this PR keeps it stable while removing the live legacy bind mount.

What changed

vault config now mounts ${PLATFORM_RUNTIME_VAULT_CONFIG_FILE:-/opt/pdurlej-platform/runtime/legacy-import/config/vault/vault.hcl}.
vault-bootstrap scripts now mount ${PLATFORM_RUNTIME_VAULT_SCRIPTS_DIR:-/opt/pdurlej-platform/runtime/legacy-import/scripts/vault}.
vault-bootstrap already used ${PLATFORM_RUNTIME_ENV_DIR:-/opt/pdurlej-platform/runtime/legacy-import/env}; runbook now documents it.
Vault and Vault-bootstrap runbooks document rollback env overrides.

Why it changed

The live Vault container still mounted /opt/vps-home-platform-infra/config/vault/vault.hcl. Current release root does not contain config/vault or scripts/vault, so desired-state needed explicit runtime legacy-import paths before any safe recreate.

Files touched

compose/core/compose.yaml
modules/vault/runbook.md
modules/vault-bootstrap/runbook.md

Relevant context

M01 RS2000 closeout plan
Vault lifecycle is sunset; Vault-bootstrap lifecycle is archived

Runtime evidence

Pre-copy completed on RS2000 before this PR:

config/vault/vault.hcl -> legacy-import/config/vault/vault.hcl, mode 644, size 253
scripts/vault -> legacy-import/scripts/vault, directory mode 755
env -> legacy-import/env, directory mode 755

Known constraints

Do not recreate or run vault-bootstrap in routine cutover work. It is an archived oneshot. Runtime apply is limited to vault only.

Explicit out-of-scope

No Vault data migration
No Vault-bootstrap rerun
No secret value printing
No deletion
No quarantine/tombstone
No Infisical/Vault product decision change

Requested decision

Merge after local validation. If Forgejo checks remain queued, admin force-merge is acceptable under the current nondestructive M01 plan.

Merge blockers

Compose config invalid
Missing target config/scripts/env on RS2000
PR not mergeable against main

Validation

git diff --check: passed
PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json: passed

Rollback

Set PLATFORM_RUNTIME_VAULT_CONFIG_FILE=/opt/vps-home-platform-infra/config/vault/vault.hcl for one rollback cycle and recreate only vault.

Canary status: local validation passed; Forgejo canary may remain pending due runner queue. ## Summary Remounts Vault runtime config and Vault-bootstrap scripts/env from the M01 legacy-import runtime tree instead of implicit release-root or legacy `/opt/vps-home-platform-infra` paths. This is intentionally narrow. Runtime apply will recreate only `vault`; it must not run `vault-bootstrap` because that module is an archived oneshot. ## Canary Context Pack ### Product story M01 needs active containers to stop depending on `/opt/vps-home-platform-infra` before RS2000 legacy paths can be quarantined safely. Vault is sunset, so this PR keeps it stable while removing the live legacy bind mount. ### What changed - `vault` config now mounts `${PLATFORM_RUNTIME_VAULT_CONFIG_FILE:-/opt/pdurlej-platform/runtime/legacy-import/config/vault/vault.hcl}`. - `vault-bootstrap` scripts now mount `${PLATFORM_RUNTIME_VAULT_SCRIPTS_DIR:-/opt/pdurlej-platform/runtime/legacy-import/scripts/vault}`. - `vault-bootstrap` already used `${PLATFORM_RUNTIME_ENV_DIR:-/opt/pdurlej-platform/runtime/legacy-import/env}`; runbook now documents it. - Vault and Vault-bootstrap runbooks document rollback env overrides. ### Why it changed The live Vault container still mounted `/opt/vps-home-platform-infra/config/vault/vault.hcl`. Current release root does not contain `config/vault` or `scripts/vault`, so desired-state needed explicit runtime legacy-import paths before any safe recreate. ### Files touched - `compose/core/compose.yaml` - `modules/vault/runbook.md` - `modules/vault-bootstrap/runbook.md` ### Relevant context - M01 RS2000 closeout plan - Vault lifecycle is `sunset`; Vault-bootstrap lifecycle is `archived` ### Runtime evidence Pre-copy completed on RS2000 before this PR: - `config/vault/vault.hcl` -> `legacy-import/config/vault/vault.hcl`, mode `644`, size `253` - `scripts/vault` -> `legacy-import/scripts/vault`, directory mode `755` - `env` -> `legacy-import/env`, directory mode `755` ### Known constraints Do not recreate or run `vault-bootstrap` in routine cutover work. It is an archived oneshot. Runtime apply is limited to `vault` only. ### Explicit out-of-scope - No Vault data migration - No Vault-bootstrap rerun - No secret value printing - No deletion - No quarantine/tombstone - No Infisical/Vault product decision change ### Requested decision Merge after local validation. If Forgejo checks remain queued, admin force-merge is acceptable under the current nondestructive M01 plan. ### Merge blockers - Compose config invalid - Missing target config/scripts/env on RS2000 - PR not mergeable against main ## Validation - `git diff --check`: passed - `PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json`: passed ## Rollback Set `PLATFORM_RUNTIME_VAULT_CONFIG_FILE=/opt/vps-home-platform-infra/config/vault/vault.hcl` for one rollback cycle and recreate only `vault`.

codex added 1 commit

2026-05-29 00:56:40 +02:00

fix(cutover): remount vault runtime imports

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 23s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / canary (pull_request) Has been skipped