open-platform/mitosis

Fork 0

/goal /ultracode-workflows [HYB-1] harden the bare-k3s VPS germination path (two-step registries + tunnel cutover + public-edge-aware germinate) #25

New issue

Closed

opened 2026-07-01 02:03:42 +00:00 by plat · 1 comment

plat commented

2026-07-01 02:03:42 +00:00

Owner

Track/Wave: HYB-1 · Wave M3 · Size L
Repos: mitosis
Depends on: DOM-1a

Why

The first client deploys to a single VPS. README documents the bare-k3s two-step but nothing hardens or validates it. Recommended edge = Cloudflare Tunnel (finishes the half-built CUTOVER_TUNNEL seam): outbound-only, no inbound 80/443, no cloud LB. The tunnel alone does NOT give trusted origin TLS — DOM-1a is a hard dependency.

Scope

Make the README two-step real and safe: (a) recipe/registries.yaml.tmpl → /etc/rancher/k3s/registries.yaml BEFORE k3s starts; k3s installed with --disable=traefik --disable=servicelb --tls-san <domain> --write-kubeconfig-mode 644, behind a default-deny firewall (SSH only; no 80/443) baked into cloud-init. (b) wire the cloudflared tunnel cutover cleanly (CUTOVER_TUNNEL=1). (c) FIX germinate's success card — bin/germinate:535-536 prints 127.0.0.1 /etc/hosts guidance silently wrong on a VPS; branch on CUTOVER_TUNNEL to print tunnel/DNS guidance and drop the self-signed-CA-trust step when DOM-1a's public issuer is active. (d) fold an optional remote/bare-k3s mode into CI-1.

Acceptance

A platform germinated on a real non-localhost VPS with a real domain + tunnel is reachable over the public internet, serves the Forgejo admin UI over browser-trusted HTTPS, and builds+ships an app to a public URL — captured as a client-followable runbook (Hetzner CX-class worked example).

Notes

Seam A (bin/up) — after SPINE-3. Persistent storage = k3s local-path; backup = documented off-box cron (see SEC-1 for the key half).

Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `HYB-1` · Wave **M3** · Size **L** **Repos:** `mitosis` **Depends on:** DOM-1a ## Why The first client deploys to a single VPS. README documents the bare-k3s two-step but nothing hardens or validates it. Recommended edge = Cloudflare Tunnel (finishes the half-built CUTOVER_TUNNEL seam): outbound-only, no inbound 80/443, no cloud LB. The tunnel alone does NOT give trusted origin TLS — DOM-1a is a hard dependency. ## Scope Make the README two-step real and safe: (a) recipe/registries.yaml.tmpl → /etc/rancher/k3s/registries.yaml BEFORE k3s starts; k3s installed with `--disable=traefik --disable=servicelb --tls-san <domain> --write-kubeconfig-mode 644`, behind a default-deny firewall (SSH only; no 80/443) baked into cloud-init. (b) wire the cloudflared tunnel cutover cleanly (CUTOVER_TUNNEL=1). (c) FIX germinate's success card — bin/germinate:535-536 prints 127.0.0.1 /etc/hosts guidance silently wrong on a VPS; branch on CUTOVER_TUNNEL to print tunnel/DNS guidance and drop the self-signed-CA-trust step when DOM-1a's public issuer is active. (d) fold an optional remote/bare-k3s mode into CI-1. ## Acceptance A platform germinated on a real non-localhost VPS with a real domain + tunnel is reachable over the public internet, serves the Forgejo admin UI over browser-trusted HTTPS, and builds+ships an app to a public URL — captured as a client-followable runbook (Hetzner CX-class worked example). ## Notes **Seam A (bin/up) — after SPINE-3.** Persistent storage = k3s local-path; backup = documented off-box cron (see SEC-1 for the key half). --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:03:42 +00:00

plat added the

roadmap

goal

horizon:mvp

labels

2026-07-01 02:03:42 +00:00

plat added a new dependency

2026-07-01 02:04:42 +00:00

#24 /goal /ultracode-workflows [DOM-1a] public ACME TLS for the platform domain (letsencrypt-dns01 ClusterIssuer + public wildcard cert)

plat added a new dependency

2026-07-01 02:04:42 +00:00

#26 /goal /ultracode-workflows [SEC-1] sovereign age-key backup, escrow verification, and rotation runbook + tooling

plat added a new dependency

2026-07-01 02:04:43 +00:00

#27 /goal /ultracode-workflows [SPINE-4] re-establish a known-good baseline — germinate a fresh long-lived reference/staging platform from post-SPINE-2/3 main

plat added a new dependency

2026-07-01 02:04:46 +00:00

#35 /goal /ultracode-workflows [HYB-2] validate a granddaughter on a real VPS over the public internet (production TLS + edge)

plat added a new dependency

2026-07-01 02:04:47 +00:00

#37 /goal /ultracode-workflows [DOM-2] swap CNI to Cilium + replace blanket app egress with domain/identity-defined CiliumNetworkPolicy (closes #13)

plat referenced this issue

2026-07-01 02:05:20 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat referenced this issue

2026-07-01 02:15:27 +00:00

HYB-3: OpenTofu multi-cloud substrate contract (design) — plat/mitosis#36 #48

plat referenced this issue from a commit

2026-07-01 04:27:55 +00:00

HYB-1: harden bare-k3s single-VPS germination + Cloudflare-tunnel edge

plat referenced this issue from a pull request that will close it,

2026-07-01 04:28:12 +00:00

HYB-1: harden bare-k3s single-VPS germination + Cloudflare-tunnel edge #51

plat removed a dependency

2026-07-01 04:47:10 +00:00

#26 /goal /ultracode-workflows [SEC-1] sovereign age-key backup, escrow verification, and rotation runbook + tooling

plat referenced this issue from a commit

2026-07-01 04:53:25 +00:00

HYB-1: harden bare-k3s single-VPS germination + Cloudflare-tunnel edge

plat commented

2026-07-01 05:10:33 +00:00

Author

Owner

Done in #51 (merged to main as 6725c32). Bare-k3s two-step recipe in bin/up is copy-paste-correct (registries.yaml before k3s + --disable=traefik,servicelb --tls-san --write-kubeconfig-mode 644, SSH-only firewall note); bin/germinate success card forks on CUTOVER_TUNNEL to print tunnel/DNS guidance (traefik.kube-system.svc) instead of /etc/hosts and drops CA-import; docs/deploy/hetzner-vps.md is the Hetzner + Cloudflare-tunnel runbook (honest about the DOM-1a public-TLS dependency, plat/gitops#3). Validated on the vxrail: fresh valid8d germinated healthy (mcp+agents Available) and the card printed tunnel guidance under CUTOVER_TUNNEL=1. HYB-2 (real public tunnel + Hetzner box) remains.

Done in #51 (merged to `main` as `6725c32`). Bare-k3s two-step recipe in `bin/up` is copy-paste-correct (registries.yaml before k3s + `--disable=traefik,servicelb --tls-san --write-kubeconfig-mode 644`, SSH-only firewall note); `bin/germinate` success card forks on `CUTOVER_TUNNEL` to print tunnel/DNS guidance (traefik.kube-system.svc) instead of /etc/hosts and drops CA-import; `docs/deploy/hetzner-vps.md` is the Hetzner + Cloudflare-tunnel runbook (honest about the DOM-1a public-TLS dependency, plat/gitops#3). Validated on the vxrail: fresh `valid8d` germinated healthy (mcp+agents Available) and the card printed tunnel guidance under CUTOVER_TUNNEL=1. HYB-2 (real public tunnel + Hetzner box) remains.

plat removed a dependency

2026-07-01 05:13:28 +00:00

#24 /goal /ultracode-workflows [DOM-1a] public ACME TLS for the platform domain (letsencrypt-dns01 ClusterIssuer + public wildcard cert)

plat closed this issue

2026-07-01 05:13:29 +00:00

plat referenced this issue

2026-07-02 02:21:34 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47