kami
118ac9fbcb
Not my work. These nine files sat uncommitted in the shared checkout while another session worked on them, and the UI redesign that follows rewrites web/src/main.tsx and web/src/style.css. Committing first means that work is recoverable rather than overwritten. Contents, by inspection rather than by authorship: whitespace normalisation and edits across main.tsx, 568 added lines of style.css, client and client test changes, the orchestra-user line in build.sh, and docs updates to AGENTS.md, AUDIT.md, DEPLOYMENT.md and the env example. Committed at the operator's explicit instruction.
99 lines
4.1 KiB
Markdown
99 lines
4.1 KiB
Markdown
# Deployment verification
|
|
|
|
Both binaries embed their Git revision, UTC build time, and dirty flag. The
|
|
coordinator is deployed as a Docker Compose image — see "For the Docker
|
|
coordinator deployment" below for the build that carries provenance. (The old
|
|
`deploy/redeploy.sh` + `orchestra.service` path was deleted on 2026-07-31;
|
|
`orchestra-worker.service` is a different, still-current unit.)
|
|
|
|
## Browser operator login
|
|
|
|
Browser operators now live in the embedded `${ORCHESTRA_DATA}/auth.db`
|
|
database. Passwords are bcrypt-hashed inside that database; no password hash
|
|
belongs in `.env`.
|
|
|
|
For a new local data directory, create the first account while Orchestra is
|
|
stopped. The command reads and confirms the password from the terminal:
|
|
|
|
```sh
|
|
go run ./cmd/orchestra-user set -data ./data -username kami
|
|
```
|
|
|
|
For the Docker Compose deployment, the API image includes the same helper.
|
|
Keep the API stopped while it opens the database, then use the existing data
|
|
volume through Compose:
|
|
|
|
```sh
|
|
docker compose stop orchestra-api
|
|
docker compose run --rm --entrypoint /app/orchestra-user \
|
|
orchestra-api set -data /data -username kami
|
|
docker compose up -d orchestra-api
|
|
```
|
|
|
|
After signing in, the Settings screen can change the username or password.
|
|
Every browser session for that account is revoked after a credential change.
|
|
To recover a forgotten password, stop the API and run `orchestra-user set`
|
|
again for the same username. `orchestra-user list -data /data` lists usernames
|
|
without exposing password hashes.
|
|
|
|
On the first start after upgrading, an empty auth database automatically
|
|
imports the existing `ORCHESTRA_WEB_USERNAME` and
|
|
`ORCHESTRA_WEB_PASSWORD_HASH` pair. Once the startup log confirms the import,
|
|
remove both legacy values from `.env`; they are ignored whenever the database
|
|
already contains an account. `ORCHESTRA_WEB_TOKEN` remains unused by the
|
|
browser UI.
|
|
|
|
Build a worker for staging on workpc with:
|
|
|
|
```sh
|
|
revision=$(git rev-parse HEAD)
|
|
build_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
|
dirty=false; test -z "$(git status --porcelain)" || dirty=true
|
|
go build -ldflags "-X orchestra/internal/buildinfo.Revision=$revision -X orchestra/internal/buildinfo.Time=$build_time -X orchestra/internal/buildinfo.Dirty=$dirty" -o orchestra-worker ./cmd/orchestra-worker
|
|
scp orchestra-worker workpc:~/orchestra-deploy/orchestra-worker
|
|
ssh workpc 'sha256sum ~/orchestra-deploy/orchestra-worker'
|
|
```
|
|
|
|
The worker receives only the path to a normal project configuration file:
|
|
`ORCHESTRA_WORKER_PROJECT_CONFIG_FILE=/etc/orchestra/worker-projects.json`.
|
|
That file contains a JSON object whose project entries contain `repo`,
|
|
`worktree_root`, and `remote`; mount or provision it like any other worker
|
|
configuration. The legacy single-checkout `ORCHESTRA_WORKER_PROJECTS` comma
|
|
list remains supported for one existing checkout. An absent project is
|
|
ineligible for routing.
|
|
|
|
Verify the coordinator at `GET /v1/admin/diagnostics` with the normal admin
|
|
credential: its `build` object is the coordinator provenance. `GET
|
|
/v1/federation/workers` shows every worker's `build`, supported projects, and
|
|
worker-local health without SSH.
|
|
|
|
Build the coordinator and worker with `deploy/build.sh`, which stamps them from one commit
|
|
and refuses a dirty tree. A burn-in run must never pair a new coordinator with
|
|
an old worker, and matching revisions are how that is checked rather than
|
|
assumed.
|
|
|
|
For the Docker coordinator deployment, provide the same provenance as build
|
|
arguments (the Dockerfile intentionally cannot read `.git` from its build
|
|
context):
|
|
|
|
```sh
|
|
revision=$(git rev-parse HEAD)
|
|
build_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
|
dirty=false; test -z "$(git status --porcelain)" || dirty=true
|
|
docker compose build \
|
|
--build-arg BUILD_REVISION="$revision" \
|
|
--build-arg BUILD_TIME="$build_time" \
|
|
--build-arg BUILD_DIRTY="$dirty" \
|
|
orchestra-api
|
|
docker compose up -d --no-deps orchestra-api
|
|
```
|
|
|
|
If a pre-v2 event log has the historical repeated-`seq=1` prefix, the current
|
|
coordinator intentionally refuses to replay it. Stop every coordinator using
|
|
the data directory and run the explicit, backup-preserving migration before
|
|
deploying the current image:
|
|
|
|
```sh
|
|
orchestra-migrate -data /var/lib/orchestra/data -confirm
|
|
```
|