kavi/kua-deploy
1
0
Fork 0
Code Issues 4 Pull requests 1 Projects Releases Packages Wiki Activity

fix: retire retired-host drift in engine ALLOWED_NODES + port binding #10

Closed
kavi wants to merge 0 commits from fix/node-ip-drift into main
pull from: fix/node-ip-drift
merge into: kavi:main
Conversation 1 Commits - Files changed -
kavi commented 2026-07-14 23:06:17 +00:00
Owner
Copy link

What

Two stale references to decommissioned hosts in the deploy engine source:

  1. Port binding — docker-compose.yml published the API on 100.74.17.6 (Bruno's dead Tailscale IP). The live sol-prod deployment was already hand-fixed to 100.64.148.46 as an uncommitted edit, so a redeploy from git would revert the correct binding. This commits the correct sol-prod IP.
  2. KUA_ALLOWED_NODES default — was gal,bruno,genesis in both the compose fallback and server.js:69. All three are retired/never-existed (Bruno retired, Gal decommissioned, Genesis never provisioned). A stale authorized-node name is a latent foothold if that tailnet hostname is ever re-registered. Default is now sol-prod (the engine host itself); the deployed .env explicitly sets the real set sol-prod,sol-dev.

Runtime already reconciled

On sol-prod I removed the dead nodes from the untracked /root/apps/kua-deploy/.env (gal,bruno,genesis,sol-prod,sol-dev → sol-prod,sol-dev), recreated the engine, and verified it healthy ({"status":"ok","apps":24}). This PR makes the source durable so the drift doesn't return on the next engine redeploy.

Not in this PR (flagged, needs its own verified fix)

  • docker-compose.yml:21 still sets HOSTNAME=bruno, which feeds the engine's isLocal() host match — same Bruno-drift class, but it changes runtime host-resolution logic so it wants separate verification.
  • origin/production is 4 commits ahead of origin/main — do not release main→production naively; reconcile first (see the in-flight fix/1-reconcile-prod-to-main work).
  • The engine is deployed manually; releasing this is a deliberate step, not an auto-deploy.

🤖 Generated with Claude Code

## What Two stale references to decommissioned hosts in the deploy engine source: 1. **Port binding** — `docker-compose.yml` published the API on `100.74.17.6` (Bruno's dead Tailscale IP). The live sol-prod deployment was already hand-fixed to `100.64.148.46` as an **uncommitted** edit, so a redeploy from git would revert the correct binding. This commits the correct sol-prod IP. 2. **`KUA_ALLOWED_NODES` default** — was `gal,bruno,genesis` in both the compose fallback and `server.js:69`. All three are retired/never-existed (Bruno retired, Gal decommissioned, Genesis never provisioned). A stale authorized-node name is a latent foothold if that tailnet hostname is ever re-registered. Default is now `sol-prod` (the engine host itself); the deployed `.env` explicitly sets the real set `sol-prod,sol-dev`. ## Runtime already reconciled On sol-prod I removed the dead nodes from the untracked `/root/apps/kua-deploy/.env` (`gal,bruno,genesis,sol-prod,sol-dev` → `sol-prod,sol-dev`), recreated the engine, and verified it healthy (`{"status":"ok","apps":24}`). This PR makes the **source** durable so the drift doesn't return on the next engine redeploy. ## Not in this PR (flagged, needs its own verified fix) - `docker-compose.yml:21` still sets `HOSTNAME=bruno`, which feeds the engine's `isLocal()` host match — same Bruno-drift class, but it changes runtime host-resolution logic so it wants separate verification. - **`origin/production` is 4 commits ahead of `origin/main`** — do not release main→production naively; reconcile first (see the in-flight `fix/1-reconcile-prod-to-main` work). - The engine is deployed manually; releasing this is a deliberate step, not an auto-deploy. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Two stale references to decommissioned hosts in the deploy engine:

1. docker-compose.yml published the API on 100.74.17.6 (Bruno's dead
   Tailscale IP). The live sol-prod deployment was already hand-fixed to
   100.64.148.46 as an UNCOMMITTED edit, so a redeploy from git would
   revert the correct binding. This commits the correct sol-prod IP.

2. KUA_ALLOWED_NODES default was `gal,bruno,genesis` in both the compose
   fallback and server.js:69 — all three hosts are retired/never-existed
   (Bruno retired, Gal decommissioned, Genesis never provisioned). A stale
   authorized-node name is a latent foothold if the tailnet hostname is
   ever re-registered. Default now `sol-prod` (the engine host itself);
   the deployed .env explicitly sets the real set (sol-prod,sol-dev).

Runtime already reconciled on sol-prod (.env dead nodes removed, engine
recreated + verified healthy). This PR makes the source durable so the
drift does not return on the next engine redeploy.

Not changed here (flagged for a separate, verified fix): compose line 21
still sets HOSTNAME=bruno, which feeds the engine's isLocal() host match.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Extends the retired-host drift cleanup after the 2026-07-15 SOL audit found the
sibling of the KUA_ALLOWED_NODES gap:

- REGISTRY_SERVERS default was `bruno,gal,genesis,eva`, and validateEntry rejects
  any production.server not in that set (server.js:189,202). Compose never
  injected KUA_REGISTRY_SERVERS, so on a default the engine would 400 every
  app_register/PATCH with production.server=sol-prod (the MCP's default). Default
  is now `sol-prod` and compose injects `KUA_REGISTRY_SERVERS=${...:-sol-prod}`.
- Two `|| 'bruno'` runtime fallbacks (recreate helper server param; runtime-status
  server resolution) now fall back to `sol-prod`.

NOT changed (coupled to the isLocal execution path — deferred to a tested
rollout): compose HOSTNAME=bruno and kua-deploy's own kua.json deploy server.
Changing HOSTNAME without migrating every app's production.server, or vice versa,
would flip isLocal and break deploy execution. Tracked as a follow-up needing a
canary.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
kavi commented 2026-07-15 04:35:22 +00:00
Author
Owner
Copy link

Closing as already-in-main. This branch's content (compose IP → 100.64.148.46, KUA_ALLOWED_NODES/REGISTRY_SERVERS defaults → sol-prod, bruno fallbacks) was folded into main as part of the engine fix (main is now at the deployed 808544d, which includes it). The HOSTNAME=bruno→sol-prod change flagged here was also completed in that engine fix. Nothing left to merge. Follow-up hardening continues in #11 (Phase 0.5 capabilities).

Closing as already-in-`main`. This branch's content (compose IP → 100.64.148.46, KUA_ALLOWED_NODES/REGISTRY_SERVERS defaults → sol-prod, bruno fallbacks) was folded into `main` as part of the engine fix (`main` is now at the deployed `808544d`, which includes it). The `HOSTNAME=bruno`→`sol-prod` change flagged here was also completed in that engine fix. Nothing left to merge. Follow-up hardening continues in #11 (Phase 0.5 capabilities).
kavi closed this pull request 2026-07-15 04:35:24 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
kavi/kua-deploy!10
No description provided.