sneak/upaas
1
0
Fork 1
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

Rehearse the fsn1app1 deploy on the build host with homoicon as the app #213

New Issue
Closed
opened 2026-09-23 10:12:20 +02:00 by clawbot · 1 comment
clawbot commented 2026-09-23 10:12:20 +02:00
Collaborator
Copy Link
Copy Source

Before sneak deploys upaas to fsn1app1 (#181), rehearse that deploy on the build host with homoicon as the app. The end-to-end test of 2026-09-10 (#193) deployed only an app with no data volume, no settings and no health check. homoicon is the first real app, and it needs all three.

homoicon's requirements are in its README section "Running under upaas" (https://git.eeqj.de/sneak/homoicon/src/branch/next2/README.md) and sneak/homoicon#1377 (comment). Deploy homoicon's prod branch, which is e377067 (v0.7) at the time of filing.

Definition of done

  • upaas: built from its current next and run on the build host as its README describes: Docker Compose, an absolute HOST_DATA_DIR, plain HTTP with UPAAS_PLAINTEXT_HTTP. Every published port is bound to 127.0.0.1 on a free high port.
  • homoicon app in upaas:
    • Container port 8080.
    • One volume at /var/lib/homoicon that uid 1000 can write.
    • BASE_DOMAIN set.
    • The image's own health check.
    • Deploys homoicon's prod branch.
    • If clawbot cannot add a deploy key to sneak/homoicon, push prod to a temporary clawbot-owned repo and deploy from that, as #193 did. Remove temporary keys and repos afterwards.
  • Verified:
    • The first deploy succeeds and the health check turns healthy.
    • The one-time root password appears in the first start's log. Confirm that it appears and never copy it anywhere. Using it in memory to sign in is fine; writing it to a file, log, comment or commit is not.
    • A page created after the first start survives a redeploy triggered by a push, and also survives a container restart.
    • A setting changed in upaas's UI takes effect on the next deploy.
  • Recorded on this issue: the upaas commit, the homoicon commit, and each step's result.
  • Problems filed, each as its own issue: upaas problems on upaas, homoicon problems on homoicon. They are filed only and not fixed by this unit. upaas fixes go through the usual reviewed PRs to next2, cut from next; next stays frozen in #207.
  • One short comment on #181: in plain words, anything the rehearsal shows sneak must do differently on fsn1app1. If there is nothing, say so in one line.
  • Cleanup: every container, volume, network and image the rehearsal created is removed. Touch nothing it did not create; the routewatch-verify-3898daa container stays running. Never touch fsn1app1 or any other server; build host only.

Model: opus-5-5

Before sneak deploys upaas to fsn1app1 (https://git.eeqj.de/sneak/upaas/issues/181), rehearse that deploy on the build host with homoicon as the app. The end-to-end test of 2026-09-10 (https://git.eeqj.de/sneak/upaas/pulls/193) deployed only an app with no data volume, no settings and no health check. homoicon is the first real app, and it needs all three. homoicon's requirements are in its README section "Running under upaas" (https://git.eeqj.de/sneak/homoicon/src/branch/next2/README.md) and https://git.eeqj.de/sneak/homoicon/issues/1377#issuecomment-102334. Deploy homoicon's `prod` branch, which is `e377067` (v0.7) at the time of filing. ## Definition of done - **upaas:** built from its current `next` and run on the build host as its README describes: Docker Compose, an absolute `HOST_DATA_DIR`, plain HTTP with `UPAAS_PLAINTEXT_HTTP`. Every published port is bound to `127.0.0.1` on a free high port. - **homoicon app in upaas:** - Container port `8080`. - One volume at `/var/lib/homoicon` that uid `1000` can write. - `BASE_DOMAIN` set. - The image's own health check. - Deploys homoicon's `prod` branch. - If clawbot cannot add a deploy key to `sneak/homoicon`, push `prod` to a temporary clawbot-owned repo and deploy from that, as https://git.eeqj.de/sneak/upaas/pulls/193 did. Remove temporary keys and repos afterwards. - **Verified:** - The first deploy succeeds and the health check turns healthy. - The one-time root password appears in the first start's log. Confirm that it appears and never copy it anywhere. Using it in memory to sign in is fine; writing it to a file, log, comment or commit is not. - A page created after the first start survives a redeploy triggered by a push, and also survives a container restart. - A setting changed in upaas's UI takes effect on the next deploy. - **Recorded on this issue:** the upaas commit, the homoicon commit, and each step's result. - **Problems filed, each as its own issue:** upaas problems on upaas, homoicon problems on homoicon. They are filed only and not fixed by this unit. upaas fixes go through the usual reviewed PRs to `next2`, cut from `next`; `next` stays frozen in https://git.eeqj.de/sneak/upaas/pulls/207. - **One short comment on https://git.eeqj.de/sneak/upaas/issues/181:** in plain words, anything the rehearsal shows sneak must do differently on fsn1app1. If there is nothing, say so in one line. - **Cleanup:** every container, volume, network and image the rehearsal created is removed. Touch nothing it did not create; the `routewatch-verify-3898daa` container stays running. Never touch fsn1app1 or any other server; build host only. Model: opus-5-5
clawbot commented 2026-09-23 11:01:18 +02:00
Author
Collaborator
Copy Link
Copy Source

Rehearsal done on the build host. Every step passed.

  • upaas: next at 19619b1cd29c6585c773e41d48da32683cc4a96f, built and run with Docker Compose, absolute HOST_DATA_DIR, UPAAS_PLAINTEXT_HTTP=true, published on 127.0.0.1 only.
  • homoicon: prod at e377067336e23ed8ac747bbf2137de3f873c1096 (v0.7), pushed to a temporary clawbot repo because clawbot cannot add deploy keys to sneak/homoicon. The push-triggered redeploy ran 519f4f74abf0d546b6c0662cdfa368d28172fe9a, an empty commit on top of it in that repo.

Results:

  • First deploy with port 8080, a volume at /var/lib/homoicon owned by uid 1000, BASE_DOMAIN and the image's own health check: pass. upaas reported the container healthy after 60 seconds.
  • Root password appears in the first start's log: pass. It was used only in memory to sign in.
  • Page created after the first start survives a redeploy triggered by a push: pass.
  • The same page survives a container restart from the upaas UI: pass.
  • A setting changed in the upaas UI takes effect on the next deploy: pass. DEBUG=true switched on debug logging. A changed BASE_DOMAIN reached the container but homoicon ignores it after the first start: sneak/homoicon#1380
  • Also checked: the app kept running when the upaas container was recreated, and with the app's Docker network set in upaas, another container reached it by name at upaas-homoicon:8080.

Filed:

  • #214 (deployment log downloads return 404 after the upaas container is recreated)
  • #215 (each deploy leaves an anonymous Docker volume behind)
  • #216 (images from earlier deploys are never removed)
  • sneak/homoicon#1380
  • sneak/homoicon#1381 (found by reading the Dockerfile, not run)

Disclosures:

  • Gitea cannot reach a 127.0.0.1 port on the build host, so the push webhook was sent to upaas with curl, carrying Gitea's push format and the real pushed commit.
  • No port mapping was added for the app: upaas binds mapped ports to all interfaces (#113, closed WONTFIX). The app was reached through its container address and then through a Docker network.
  • homoicon's sign-in cookies are marked HTTPS-only, so over plain HTTP they were sent back by hand, the way a browser behind a TLS proxy would send them.
  • The Compose file is the README's example with the port bound to 127.0.0.1:28213 and the build context set to the clone.
  • homoicon built by upaas reports its version as dev, because upaas passes no build arguments.
  • Temporary repo, deploy key, containers, network, volumes and images removed afterwards.

Model: opus-5-5

Rehearsal done on the build host. Every step passed. - upaas: `next` at `19619b1cd29c6585c773e41d48da32683cc4a96f`, built and run with Docker Compose, absolute `HOST_DATA_DIR`, `UPAAS_PLAINTEXT_HTTP=true`, published on `127.0.0.1` only. - homoicon: `prod` at `e377067336e23ed8ac747bbf2137de3f873c1096` (v0.7), pushed to a temporary clawbot repo because clawbot cannot add deploy keys to `sneak/homoicon`. The push-triggered redeploy ran `519f4f74abf0d546b6c0662cdfa368d28172fe9a`, an empty commit on top of it in that repo. Results: - First deploy with port `8080`, a volume at `/var/lib/homoicon` owned by uid `1000`, `BASE_DOMAIN` and the image's own health check: pass. upaas reported the container healthy after 60 seconds. - Root password appears in the first start's log: pass. It was used only in memory to sign in. - Page created after the first start survives a redeploy triggered by a push: pass. - The same page survives a container restart from the upaas UI: pass. - A setting changed in the upaas UI takes effect on the next deploy: pass. `DEBUG=true` switched on debug logging. A changed `BASE_DOMAIN` reached the container but homoicon ignores it after the first start: https://git.eeqj.de/sneak/homoicon/issues/1380 - Also checked: the app kept running when the upaas container was recreated, and with the app's Docker network set in upaas, another container reached it by name at `upaas-homoicon:8080`. Filed: - https://git.eeqj.de/sneak/upaas/issues/214 (deployment log downloads return 404 after the upaas container is recreated) - https://git.eeqj.de/sneak/upaas/issues/215 (each deploy leaves an anonymous Docker volume behind) - https://git.eeqj.de/sneak/upaas/issues/216 (images from earlier deploys are never removed) - https://git.eeqj.de/sneak/homoicon/issues/1380 - https://git.eeqj.de/sneak/homoicon/issues/1381 (found by reading the Dockerfile, not run) Disclosures: - Gitea cannot reach a `127.0.0.1` port on the build host, so the push webhook was sent to upaas with curl, carrying Gitea's push format and the real pushed commit. - No port mapping was added for the app: upaas binds mapped ports to all interfaces (https://git.eeqj.de/sneak/upaas/issues/113, closed WONTFIX). The app was reached through its container address and then through a Docker network. - homoicon's sign-in cookies are marked HTTPS-only, so over plain HTTP they were sent back by hand, the way a browser behind a TLS proxy would send them. - The Compose file is the README's example with the port bound to `127.0.0.1:28213` and the build context set to the clone. - homoicon built by upaas reports its version as `dev`, because upaas passes no build arguments. - Temporary repo, deploy key, containers, network, volumes and images removed afterwards. Model: opus-5-5
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 merge-ready
All checks pass, reviewed, rebased, ready for merge
 needs-checks
make check does not pass cleanly
 needs-rebase
PR has merge conflicts or is behind main
 needs-review
Code review not yet done
 needs-rework
Code review found issues to fix
 notplanned
question
More information is needed
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/upaas#213