tasks(books-vds-stacks-to-portainer): close 🟢 — 6 stacks migrated SSH-compose → Portainer

Phase 2 ladder executed 2026-05-25 (~10min end-to-end, lowest → highest blast radius):
  proxy-chain (id 28) → imgproxy (29) → minio (30) → mongo (31) → books-db (32) → elasticsearch (33)

All 6 smoked green. books-api + books-task-runner reconnected transparently through
mongo + books-db recreate windows. ES snapshot repo `kreknin` preserved through bind.

Phase 3:
- created .wiki/concepts/portainer-stack-management-books-vds.md (pattern application + diffs from vds-kzntsv)
- entity books-vds.md: 6 stacks flipped SSH-managed → Portainer-managed
- index.md: new concept entry

Pre-flight quirks documented (CentOS 7 yum dead, no jq, no docker login).

Acceptance: 4/5 verified, backup pipeline (#5) verified by inspection (bind paths
preserved) — full pipeline run pending next 06:00 MSK.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.tasks/NEXT_SESSION.md

@@ -1,5 +1,5 @@
 ---
-_last_updated_: 2026-05-25T11:15:00+03:00
+_last_updated_: 2026-05-25T12:00:00+03:00
 session_id: 2026-05-25-books-vds-stacks-to-portainer
 ---
 
@@ -7,8 +7,9 @@ session_id: 2026-05-25-books-vds-stacks-to-portainer
 
 ## Recent commits
 
-- `tasks(books-vds-stacks-to-portainer): Phase 0 probe complete, +imgproxy scope` (`bfb942cd`) — Phase 0 done, scope expanded 5→6 stacks.
-- `tasks(NEXT_SESSION): refresh handoff after this session's commits` (`3769e836`) — prior session handoff.
+- (about to commit) `tasks(books-vds-stacks-to-portainer): close 🟢 — 6 stacks migrated, wiki + entity updated` — final session commit.
+- `scripts(books-vds-portainer-migration): Phase 1 adapter ready` (`141efe97`)
+- `tasks(books-vds-stacks-to-portainer): Phase 0 probe complete, +imgproxy scope` (`bfb942cd`)
 - `tasks: add ⚪ books-vds-stacks-to-portainer` (`439da3ce`)
 - `backup(books-vds): daily 06:00 MSK pipeline to kreknin live 🟢` (`fe41ee44`)
 
@@ -16,38 +17,32 @@ session_id: 2026-05-25-books-vds-stacks-to-portainer
 
 | Трек | Готовность | Entry-point |
 |---|---|---|
-| `books-vds-stacks-to-portainer` 🔴 | **Phase 0 done, Phase 1 next** — write adapter script `scripts/books-vds-portainer-migrate.sh` | `.tasks/books-vds-stacks-to-portainer.md` |
-| `stateful-split-volume-copy` ⚪ | not started; playbook fits real books VDS (89.253.255.133) | `.tasks/stateful-split-volume-copy.md` |
+| `stateful-split-volume-copy` ⚪ | not started; lean playbook готов, fits real books VDS (89.253.255.133) | `.tasks/stateful-split-volume-copy.md` |
 | `iis-migration-to-ruvds` 🟡 | soak (kupimknigi + emspb DNS flipped 2026-05-24, 22 pending) | `.tasks/iis-migration-to-ruvds.md` |
-| `infra-inventory` ⚪ | ready, не начат — books VDS должен попасть в admin-detailed runbook | `.tasks/infra-inventory.md` |
-| `books-bookva-user-whitelist-gathering` ⚪ | ready, long-lead gathering | `.tasks/books-bookva-user-whitelist-gathering.md` |
+| `infra-inventory` ⚪ | ready, не начат — **обновлён factsheet `books-vds` после Portainer migration**, готов к ingest в admin-detailed runbook | `.tasks/infra-inventory.md` |
+| `books-bookva-user-whitelist-gathering` ⚪ | ready, long-lead gathering (email-based) | `.tasks/books-bookva-user-whitelist-gathering.md` |
 | `books-vds-bookva-bootstrap` 🔵 | blocked on tenant-split Phase 4 | `.tasks/books-vds-bookva-bootstrap.md` |
 | `books-dns-cutover-bookva` 🔵 | blocked on books-vds-bookva-bootstrap | `.tasks/books-dns-cutover-bookva.md` |
-
-## Mid-task capture
-
-**left mid-task:** `books-vds-stacks-to-portainer` (Phase 1 entry)
-
-**where_stopped:** Phase 0 closed — все 6 compose probed (`books-db`, `mongo`, `minio`, `elasticsearch`, `proxy-chain`, `imgproxy`), Portainer PAT verified, endpoint 6 stostayer = not ours.
-
-**next concrete:** Write `scripts/books-vds-portainer-migrate.sh` (clone-adapt из `.wiki/concepts/portainer-stack-management-vds.md` § Migration script). Diffs: `PORTAINER_URL=https://portainer.kzntsv.site`, endpointId=1, dir prefix `/usr/docker/`, auth `X-API-Key` (PAT works, no JWT fallback). Then Phase 2 ladder: proxy-chain → imgproxy → minio → mongo → books-db → elasticsearch.
+| `books-stateful-split-execution` 🔵 | blocked on dev-prep + per-tenant-backup-and-observability в victor/books | `.tasks/STATUS.md` |
 
 ## Спроси user'а
 
-- **(нет на этом раунде — auto-push grant active, scope decisions made, момент migrate-by-migrate ладдером).**
+- **Verify backup pipeline post-migration:** next scheduled run 06:00 MSK 2026-05-26 (через ~18h от close). Если ntfy/email прийдут с success — acceptance criterion #4 finalized. Если нет — investigate (most likely bind paths intact, low risk).
+- **Какую таску брать следующей?** Active candidates: `stateful-split-volume-copy` (ops, lean playbook готов), `infra-inventory` (книги VDS теперь fully documented — момент удачный), `iis-migration-to-ruvds` (DNS TTL reductions для 22 pending hosts).
 
 ## Не делать (preemptive guards)
 
-- **Не migrate traefik / portainer** — management plane, recreate ломает access (Skip-list).
-- **Не trigger ES recreate без user awareness** — текущая ES «не используется» per user 2026-05-25, но verify before recreate. ES в ладдере **последним** на покое.
-- **Не editit `/usr/docker/<svc>/docker-compose.yml`** напрямую после migration — Portainer-managed working_dir = `/data/compose/<id>/`. Compose files в `/usr/docker/<svc>/` становятся reference only.
-- **Не break backup pipeline** — `books-vds-backup-daily-kreknin` rsync paths = `/usr/docker/<svc>/data` (binds). Bind paths preserved через migration, paths остаются валидны. Verify post-migration rsync прошёл хотя бы 1 раз.
-- **Не push without grant in future sessions** — auto-push грант session-only (Rule 4). Next session start = ask-mode again.
+- **Не editit `/usr/docker/<svc>/docker-compose.yml`** на books VDS — теперь reference-only. Portainer-managed compose state в `/data/compose/<id>/docker-compose.yml`. Edit через Portainer UI или API.
+- **Не `docker compose up -d`** на books VDS для migrated стеков — стартанёт parallel set контейнеров под compose-project `<dirname>`, conflicting names с Portainer-managed. Trust Portainer для lifecycle.
+- **Не push without grant in next session** — auto-push grant был session-only (Rule 4). Next session start = ask-mode again.
+- **Не migrate traefik / portainer на books VDS** — management plane, recreate ломает access. Same exclusion as vds-kzntsv.
+- **Не trust `docker login registry.kzntsv.site`** на books VDS — НЕ настроен. Кэшированные images сейчас спасают, но force-pull для private images → auth fail. Setup login если planned image-rotation.
 
 ## Memory updates за сессию
 
-- **Учить:** Portainer single instance `portainer.kzntsv.site` управляет 2 endpoint'ами — `1` = books VDS local docker daemon, `6` = stostayer (другой клиент, **не наш**, scope не расширять). User-confirmed 2026-05-25.
-- **Учить:** PAT auth через `X-API-Key: ptr_...` header работает (без JWT fallback). Pass entry `books-vds/full-env BOOKS_PORTAINER_API_KEY`.
-- **Учить:** на books VDS все SSH-compose стеки **bind-only** (нет named volumes для них) и **no env_file** (env inline в compose). Migration упрощается: gotcha #1 (env_file strip) не релевантен, gotcha #2 (absolutize) — единственная требуемая transform.
-- **Учить:** `imgproxy` (2 контейнера, `imgproxy.kzntsv.site`, S3→minio) был missing из `entities/books-vds.md` SSH-managed table до 2026-05-25. Fix'нут в этом раунде. Lesson: при entity wiki бутстрапе на legacy host'ах — обязательно `ls /usr/docker/` cross-check vs running `docker ps`, не доверять предположениям.
-- **Reference:** migration pattern source — `.wiki/concepts/portainer-stack-management-vds.md` (VDS-infra 12-stack retro-migration 2026-05-22). Adaptable для books VDS с 3-4 diff'ами.
+- **Учить:** на books VDS **yum dead** (CentOS 7 EOL 2024-06, mirrors retired). Static binary install — единственный путь для package install (e.g. `curl -fsSL https://github.com/jqlang/jq/releases/.../jq-linux-amd64 -o /usr/local/bin/jq`).
+- **Учить:** Portainer single instance `portainer.kzntsv.site` управляет 2 endpoint'ами — `1` = books VDS, `6` = stostayer (другой клиент, не наш, **не расширять scope сюда**).
+- **Учить:** Portainer migration ladder lowest→highest blast radius works на books VDS — `proxy-chain → imgproxy → minio → mongo → books-db → elasticsearch`. Books-api + books-task-runner reconnect transparently через mongo/books-db recreate windows (~13-15s). ES cluster yellow normal для single-node.
+- **Учить:** `imgproxy` (2 containers, serves `imgproxy.kzntsv.site`, S3 backend → minio) был **missing** из entity wiki до Phase 0 probe — lesson: при entity wiki bootstrap на legacy hosts обязательно `ls /usr/docker/` cross-check vs `docker ps`.
+- **Reference:** migration pattern source — [[../wiki/concepts/portainer-stack-management-vds]] (vds-kzntsv); books VDS application + diffs — [[../wiki/concepts/portainer-stack-management-books-vds]].
+- **Reference:** `scripts/books-vds-portainer-migration/{migrate.sh,README.md}` — adapter for future re-use (e.g. если появится ещё SSH-compose стек на books VDS).

.tasks/STATUS.md

@@ -1,14 +1,7 @@
 # Admin Task Board
-_Updated: 2026-05-25 (session start — `books-vds-stacks-to-portainer` поднят 🔴 active. Endpoint 6 = stostayer VDS — НЕ наш, scope не расширяем. Auto-push grant active.)_
+_Updated: 2026-05-25 (`books-vds-stacks-to-portainer` 🟢 closed — 6 стеков (proxy-chain, imgproxy, minio, mongo, books-db, elasticsearch) migrated SSH-compose → Portainer-managed на books VDS. Ids 28-33. Adapter script + wiki concept committed. Все 6 smoke green в одну сессию.)_
 
-## 🔴 [books-vds-stacks-to-portainer] — migrate SSH-compose стеки на books VDS под Portainer-managed (pattern parallel VDS-infra retro-migration 2026-05-22). Targets: books-db, mongo, minio, elasticsearch, proxy-chain, **imgproxy** (added Phase 0 2026-05-25). Skip traefik + portainer (management plane).
-
-**Status:** active
-**Where I stopped:** Phase 0 done 2026-05-25 — probed 6 compose files + Portainer API. No env_file, all bind volumes, PAT works, endpoint 1 = books VDS (6 Portainer-managed already), endpoint 6 = stostayer (not ours). imgproxy added to scope.
-**Next action:** Phase 1 — adapter migration script `scripts/books-vds-portainer-migrate.sh` (clone-adapt of VDS-infra version в `.wiki/concepts/portainer-stack-management-vds.md`). Diff: URL → `portainer.kzntsv.site`, endpoint=1, dir prefix `/usr/docker/`, auth via `X-API-Key` header (PAT works, no JWT fallback needed).
-**Branch:** master
-<!-- created-by: claude / 2026-05-25 / trigger: user-requested follow-up after books-vds-backup-daily-kreknin -->
-<!-- activated: vitya / 2026-05-25 / session start -->
+## 🟢 [books-vds-stacks-to-portainer] — closed 2026-05-25 — 6 SSH-compose стеков на books VDS (89.253.255.133) мигрированы в Portainer-managed (endpoint 1, https://portainer.kzntsv.site). Skip traefik + portainer (management plane). Adapter `scripts/books-vds-portainer-migration/migrate.sh`. Wiki: [portainer-stack-management-books-vds.md](../.wiki/concepts/portainer-stack-management-books-vds.md). Backup pipeline bind paths preserved (verified by inspection, full run pending next 06:00 MSK).
 
 ## 🟢 [books-vds-backup-daily-kreknin] — closed 2026-05-25 — daily backup books VDS (89.253.255.133, host4g.ru, CentOS 7) → kreknin в 06:00 MSK. DB dumps (mariadb/mongo×2) + ES snapshot via REST → rsync 4.87GB → ntfy/email (phone+inbox ✓). ES path.repo bootstrap + snapshot repo `kreknin` registered. См. [books-vds-backup-daily-kreknin.md](books-vds-backup-daily-kreknin.md).
 

.tasks/books-vds-stacks-to-portainer.md

@@ -40,17 +40,32 @@ Migrate SSH-compose стеки на books VDS (`89.253.255.133`) в Portainer-ma
 - 2026-05-25: pattern reuse — `.wiki/concepts/portainer-stack-management-vds.md` migration script adaptable. Diff for books VDS: PORTAINER_URL, endpoint ID = 1, stack dirs `/usr/docker/<svc>/` instead of `/opt/stacks/<svc>/`. PAT в pass под `books-vds/full-env BOOKS_PORTAINER_API_KEY` (may need fallback to JWT if 401).
 - 2026-05-25 (session start): user confirmed **Endpoint 6 = stostayer VDS, НЕ наш** → scope не расширяем, Q1 closed. Auto-push grant active на сессию.
 - 2026-05-25 (Phase 0): SSH probe 5 target compose. Findings: (1) **no env_file** anywhere — inline env stays в stackFileContent, отдельный API env array не нужен; (2) **no surprise named volumes** — all bind, Q2 close to resolved; (3) mongo container image lost tag (digest-only) — fresh `mongo:4.2` pull при Portainer create acceptable; (4) Portainer API list endpoint 1 = 6 stacks (books-* + chrome), endpoint 6 = stostayer 8 stacks (confirmed not ours); (5) **discovered 6th stack:** `/usr/docker/imgproxy/` — `imgproxy` + `imgproxy-nginx` 2-container compose serving `imgproxy.kzntsv.site`, was missing from entity wiki. User confirmed → added to scope.
+- 2026-05-25 (Phase 1): adapter script `scripts/books-vds-portainer-migration/migrate.sh` clone-adapted from VDS-infra pattern. Auth via `X-API-Key` header (PAT works, JWT fallback not needed). Down step via `docker rm -f` by `com.docker.compose.project` label — bypasses both v1 ContainerConfig bug + any v2 recreate quirks; no compose binary dependency at all.
+- 2026-05-25 (Phase 2): **pre-flight surprises:** (1) no `jq` on books VDS — installed static jq 1.7.1 binary via direct GitHub download (yum dead, CentOS 7 EOL since 2024-06, mirrors retired); (2) no `docker login registry.kzntsv.site` configured — accepted (cached images covered all migrations, no force-pull issue). Both documented в concept doc.
+- 2026-05-25 (Phase 2): migration executed in ladder. Per-stack Portainer Ids + duration: proxy-chain=28 (~10s recreate, HTTP 400 = service responding), imgproxy=29 (~15s, `imgproxy.kzntsv.site` → 200), minio=30 (~10s, `/minio/health/live` → 200), mongo=31 (~13s, ping=1, books-api/task-runner stayed Up через recreate window), books-db=32 (~15s, `SELECT 1` → 1, books-api connection-pool reconnected), elasticsearch=33 (~37s, cluster yellow expected single-node, **snapshot repo `kreknin` preserved** through bind).
+- 2026-05-25 (Phase 3): created `.wiki/concepts/portainer-stack-management-books-vds.md` documenting diffs from vds-kzntsv pattern + per-host inventory + pre-flight quirks (jq install, no registry login). Updated `entities/books-vds.md` table: 6 stacks moved SSH-managed → Portainer-managed.
 
 ## Open questions
 
 - [x] ~~**Endpoint 6** в books Portainer — stostayer VDS?~~ Resolved 2026-05-25: stostayer **не наш**, scope не расширяем.
 - [x] ~~**Volume preservation strategy**~~ Resolved 2026-05-25 (Phase 0 probe): все 6 target стеков — bind-only, no named volumes. `docker compose down` без `-v` preserves binds (paths остаются на disk).
-- [ ] **CI implications** — деплой books-* stacks уже Portainer-managed. After migration of mongo/minio/etc — никаких изменений в CI не нужно (deploy.yml только books-api/web/scheduler, не infra). Confirm.
-- [ ] **ES snapshot path.repo edit preservation** — текущий `/usr/docker/elasticsearch/docker-compose.yml` имеет path.repo + snapshots bind (added 2026-05-25). Migration must preserve. Backup в `docker-compose.yml.bak-pre-snapshots-2026-05-25` есть для reference.
+- [x] ~~**CI implications**~~ Resolved 2026-05-25: books-* stacks (CI-deployed) уже Portainer-managed pre-migration. Migrated stacks (mongo/minio/etc) — infra, не в CI flow. Никаких изменений в `victor/books/.gitea/workflows/deploy.yml` не нужно.
+- [x] ~~**ES snapshot path.repo edit preservation**~~ Verified 2026-05-25 (Phase 2 stack 6 smoke): `curl localhost:9200/_snapshot` returned `kreknin` repo intact post-migration. `path.repo=/snapshots` env preserved через `stackFileContent`, bind `/snapshots` → `/usr/docker/elasticsearch/snapshots` preserved.
 
 ## Completed steps
 
-- (not started)
+- [x] Phase 0 — SSH probe 6 compose dirs (5 original + imgproxy discovered), Portainer API auth verified, surprise imgproxy stack added to scope.
+- [x] Phase 1 — adapter script `scripts/books-vds-portainer-migration/migrate.sh` written + committed (`141efe97`). Pre-flight: jq 1.7.1 static binary installed on books VDS.
+- [x] Phase 2 — 6 stacks migrated in ladder, all smoked green. Books-api + books-task-runner reconnected transparently through mongo + books-db recreate windows.
+- [x] Phase 3 — wiki concept created (`portainer-stack-management-books-vds.md`), entity updated (`books-vds.md` SSH-managed → Portainer-managed table flipped).
+
+## Acceptance verification
+
+- ✓ 6 стеков (proxy-chain, imgproxy, minio, mongo, books-db, elasticsearch) появляются в `GET /api/stacks` под endpoint 1 — Ids 28-33 confirmed via API response after each migration.
+- ✓ Контейнеры работают, бинды смонтированы — `docker ps` Up для каждого post-recreate. Data preserved: mongo ping=1, books-db SELECT 1=1, ES cluster yellow with active shards (data intact).
+- ✓ Smoke per stack type — все 6 commands green (см. concept doc § Smoke commands).
+- ⚠ Backup pipeline продолжает работать — **verified by inspection** (bind paths `/usr/docker/<stack>/data` + `.../snapshots` preserved, backup script paths unchanged). Full pipeline run pending next scheduled 06:00 MSK.
+- ✓ Wiki documented — `.wiki/concepts/portainer-stack-management-books-vds.md` + index updated + entity flipped.
 
 ## Plan (sketch)