Hand over edge to the estate path #662

Activity

1. ExtraToast

   added

   type: choreMaintenance work without intended behavior change.Maintenance work without intended behavior change.

   area: platformPlatform, deployment, cluster, or runtime concern.Platform, deployment, cluster, or runtime concern.

   priority: P1High; important and should be handled in the current iteration.High; important and should be handled in the current iteration.

   status: blockedCannot move forward until an external dependency is resolved.Cannot move forward until an external dependency is resolved.

   on Oct 27, 2026
2. ExtraToast

   added a parent issue on Oct 27, 2026

   • Rewrite the spec and the compiler in place, release 1.0.0, and hand over every Project #373
3. ExtraToast commented on Oct 27, 2026

   

   ExtraToast

   on Oct 27, 2026

   ContributorAuthor

   More actions

   Resume here

   • State: not started. The body holds the Project's estate-file items, and Rewrite chapter 60 to rules, and write the handover and setup runbooks #381 holds the runbook steps.
   • Next step: once Republish delivery, _canary and _estate on 1.0.0 #380 is done and Rewrite chapter 60 to rules, and write the handover and setup runbooks #381's runbook is in, fill in the estate's project file from the worked example (the other session's example tickets, where the body names them). Then diff the render against fleet-infra's hand-written objects.
   • Blocked by: Republish delivery, _canary and _estate on 1.0.0 #380, Rewrite chapter 60 to rules, and write the handover and setup runbooks #381, and the handover before this one in Rewrite the spec and the compiler in place, release 1.0.0, and hand over every Project #373's order.
   • Decisions: in this ticket's body and in Rewrite chapter 60 to rules, and write the handover and setup runbooks #381's resume note, dated, including 2026-10-27's: Vault moves by raft snapshot and restore, observability starts fresh, Grafana goes in observability, and Garage's volume splits at handover.
   • Gotchas: keep every live claim name the body lists. A live handover step is the maintainer's go-ahead, never an agent's.

   Before this handover, the maintainer writes CF_DNS_API_TOKEN at secret/data/platform/cloudflare: JorisJonkers-dev/estate#229.
4. ExtraToast commented on Oct 29, 2026

   

   ExtraToast

   on Oct 29, 2026

   ContributorAuthor

   More actions

   #380 is closed: delivery, _canary and _estate are on the 1.0 contract (evidence in #380 (comment)).
5. ExtraToast commented on Oct 29, 2026

   

   ExtraToast

   on Oct 29, 2026

   ContributorAuthor

   More actions

   Prepared: the edge handover, as drafts (2026-10-29)

   Nothing is merged and nothing live was written. The runbook is docs/runbooks/edge-handover.md in the estate PR.

   Pull requests, in merge order

   #	PR	when	what
   1	JorisJonkers-dev/fleet-infra#555	any time before the window	the five default-deny policies fleet-infra applies (hermes, hindsight, immich, karakeep, overleaf) also admit edge-system's traefik-public / traefik-lan; without it those five answer 503 after the passes
   2	JorisJonkers-dev/fleet-infra#556	before node's handover (#659) and before #557; proposed in utility's window right after fleet-infra#551	pool lan-edge (.99/32, autoAssign: false), enschede-lan gives .99 up, the old traefik-lan Service asks for .99 by address. Its own short .99 gap; conflicts trivially with #551 in config.yaml
   3	JorisJonkers-dev/fleet-infra#557	window step 1	orphan: prune: disabled on 54 objects, the three HelmReleases suspended, apps-edge prune: false
   4	JorisJonkers-dev/fleet-infra#558	window step 2	removal: external-dns and both Traefiks leave apps-core; the edge-system Namespace and forward-auth Middleware stop being applied (the render owns both names); apps-edge becomes apps-edge-legacy, freeing the name the estate unit takes
   5	JorisJonkers-dev/estate#257	window step 3, the flip	ledger edge → estate; external-dns in the edge file; api on both proxies and external-dns, admitted in apiAccess.holders; dns.direct: 167.86.79.203; the runbook and the render-vs-live diff

   Then, in the window: the two address passes (proposal: LAN .99 first, then the public host ports), and after the flip a fleet-infra cleanup and the hand deletions the runbook lists.

   Issues filed

   • A tier that serves TLS but issues no certificate has no certificate source #726: a tier that serves TLS but issues no certificate has no certificate source (the LAN tier once cert-manager retires).
   • A tier's proxy renders without the API access its Kubernetes provider needs #727: a tier's proxy renders without the API access its Kubernetes provider needs (no RBAC, automountServiceAccountToken: false, in the worked example and in the estate's render). The estate PR works around it by declaring api.

   Open blockers and decisions

   • The handovers before this one, node above all (it renders lan-edge and the speaker).
   • The address order and window (proposal, for the maintainer): LAN .99 first (a few seconds, LAN only; the new LAN proxy can be checked by port-forward before it takes traffic), then the public host ports on frankfurt-contabo-1 (15–60 s, every public host), minutes apart in one ~45-minute window at a quiet hour. Both in one window because the estate's apps-edge waits on the public proxy, which stays Pending until the old one frees the ports.
   • cert-manager: proposed to stay on the old path after the flip, with its ClusterIssuer, the wildcard and the default TLS store, until A tier that serves TLS but issues no certificate has no certificate source #726 is decided. This changes the runbook's "cert-manager retires with the edge".
   • Routes no Project renders: jellyfin, jellyseerr, qbittorrent, prowlarr, sonarr, radarr, bazarr (public and LAN), immich-lan, the Traefik dashboard. Proposed to stay in apps-edge-legacy, served by the new proxies. Their Projects declare no exposure; jellyfin also needs A public host served by another tier's edge has no declaration #711.
   • Lost at the flip, not modelled: the Traefik dashboard (api@internal), the proxies' OTLP traces, three access-log headers, Traefik's router metric labels.
   • To check live: estate-dashboard and findability-explorer under the rendered security-headers-strict CSP (default-src 'self'); every rendered route gains X-Frame-Options: DENY and HSTS.
6. ExtraToast

   added a commit that references this issue on Nov 1, 2026

   feat(edge): hand the edge Project over to the estate path (#257)

   ...

   fc07e50
7. ExtraToast commented on Nov 1, 2026

   

   ExtraToast

   on Nov 1, 2026

   ContributorAuthor

   More actions

   Edge is on the estate path (estate 0.37.1), and the old path's edge is deleted, cert-manager with it.

   • Prepared changes: the six media Projects' exposure releases; JorisJonkers-dev/fleet-infra#556 closed (node's render holds lan-edge); F3 JorisJonkers-dev/fleet-infra#557, F4 JorisJonkers-dev/fleet-infra#558, B feat: hand the edge Project over to the estate path estate#257.
   • 0.37.0's apps-edge never applied: traefik-public listed container ports 8000 and 8443 twice, which server-side apply refuses. Fixed by fix(render): write a host port on its surface's entry, so a container port appears once #777 (1.7.1), feat: publish fragments with deploy-kit 1.7.1 github-workflows#207 (v0.40.0) and fix(edge): compose and publish with deploy-kit 1.7.1, which writes each container port once estate#294.
   • Passes: the LAN address at 08:54 UTC, the public host ports at 08:56; no outage beyond each pass's gap.
   • Proofs: apps-edge Ready and acme Bound; every rendered public host answers over TLS; the LAN proxy serves .99; grimoire redirects to auth's sign-in; external-dns plans no change; estate-dashboard and digital-strategy render under their new policy.
   • Change C, JorisJonkers-dev/fleet-infra#573, merged: cert-manager, its CRDs, ClusterIssuer and wildcard Certificate are gone.

   Follow-ups: every host serves the wildcard from secret/data/platform/tls/jorisjonkers-dev, valid until 2026-12-16, which nothing renews yet (JorisJonkers-dev/estate#292, renew by 2026-12-01). The public tier's resolver has issued no per-host certificate yet, so it may skip hosts the default store's wildcard already covers.
8. ExtraToast

   closed this as completedon Nov 1, 2026