tasks(NEXT_SESSION): refresh after 7/7+minio closure
Forward-looking: bookva-tenant-cutover ready (4 infra stacks active — db/mongo/es/minio с данными, 6 stopped — restart at cutover signal), books-api shutdown ~2026-05-27/28, bookva-ozon-mcp image build, optional bookva-minio HTTPS DNS, slovo-overlay parity audit, bookva-minio creds rotation. Memory updates: separate-container vs bucket-split decision, DNS wildcard на 94.19.247.14 (Windows IIS), port-bind pattern для external. External admin endpoints: - bookva-db: 89.253.255.133:33306 (MariaDB 10.6.26) - bookva-minio: http://89.253.255.133:9001 (S3 API) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -1,65 +1,75 @@
|
||||
---
|
||||
_last_updated_: 2026-05-26T22:00:00+03:00
|
||||
session_id: 2026-05-26-bookva-tenant-cutover-prep-closed-6of7
|
||||
_last_updated_: 2026-05-26T23:00:00+03:00
|
||||
session_id: 2026-05-26-bookva-tenant-cutover-prep-closed-7of7-plus-minio
|
||||
---
|
||||
|
||||
# Next session handoff
|
||||
|
||||
## Recent commits
|
||||
|
||||
- `.admin f91e51d9` — tasks(bookva-tenant-cutover-prep): 🟢 closed 6/7 (Step 6 delayed by design)
|
||||
- `.admin b430bce1` — tasks(NEXT_SESSION): refresh after 4/7 progress
|
||||
- `.admin ce8bf8a6` — tasks(bookva-tenant-cutover-prep): 🟡 progress 4/7
|
||||
- `victor/books 75ea320` — feat(deploy): web.compose.yml embed-api env switch (pushed; Portainer stack 24 already PUT, smoke green)
|
||||
- `victor/books 2f7b539` — fix(ci): rename secrets.GITEA_TOKEN → BOOKVA_OVERLAY_TOKEN
|
||||
- `.admin 744c384b` — tasks(bookva-tenant-cutover-prep): post-closure — bookva-minio + external (this commit)
|
||||
- `.admin b7696aac` — tasks(NEXT_SESSION): refresh after 6/7 closure
|
||||
- `.admin f91e51d9` — tasks(bookva-tenant-cutover-prep): 🟢 closed 6/7
|
||||
- `victor/bookva-overlay b324e12` — add bookva-minio + external port-bind для bookva-db (separate MinIO instance, не bucket-split; bookva-db external 33306; bookva-minio external 9001)
|
||||
- `victor/bookva-overlay 8bffd68` — *.compose.yml: drop depends_on (per-stack Portainer model)
|
||||
- `victor/bookva-overlay 2b20a3e` — api.compose.yml: remove traefik (internal-only per design v3)
|
||||
- `victor/bookva-overlay 93c2ea2` — mongo.compose.yml: pin mongo:4.2 (WiredTiger format compat)
|
||||
- `victor/bookva-overlay 23eb374` — db.compose.yml: pin mariadb:10.6 (cp -a parity с books-db)
|
||||
- `victor/bookva-overlay 23eb374` — db.compose.yml: pin mariadb:10.6 (cp -a parity)
|
||||
- `victor/bookva-overlay 264373d` — .env.example: design v3 hostnames
|
||||
- `victor/bookva-overlay 5b173de` — config-templates align to prod shape + design v3 hostname
|
||||
- `victor/books 75ea320` — feat(deploy): web.compose.yml embed-api env switch
|
||||
- `victor/books 2f7b539` — fix(ci): rename secrets.GITEA_TOKEN → BOOKVA_OVERLAY_TOKEN
|
||||
|
||||
## Open треки
|
||||
|
||||
| Трек | Готовность | Entry-point |
|
||||
|---|---|---|
|
||||
| `bookva-tenant-cutover` (NEW, not yet created) | ready после user signal — re-start 6 stopped Portainer stacks + MinIO `mc cp books bookva` + ES snapshot/restore Phase 2 + smoke с двух сетей | TBD `.tasks/bookva-tenant-cutover.md` |
|
||||
| `books-api-shutdown` (NEW micro-task) | 24-48h soak window ends ≈2026-05-27/28 — `docker stop books-api` через Portainer | TBD `.tasks/books-api-shutdown.md` |
|
||||
| `bookva-ozon-mcp-image-build` (NEW micro-task) | image `registry.kzntsv.site/books-ozon-mcp:master` отсутствует — нужен build в victor/books CI | TBD `.tasks/bookva-ozon-mcp-image-build.md` |
|
||||
| `stateful-split-volume-copy` ⚪ | bookva-side done (db+mongo cp в bookva-tenant-cutover-prep); slovo-side ещё ⚪ (отдельный slovo-cutover-prep когда понадобится) | `.tasks/stateful-split-volume-copy.md` (нужен scope update) |
|
||||
| `infra-inventory` ⚪ | ready, books VDS factsheet более свежий (теперь 9 bookva stacks дополнительно) | `.tasks/infra-inventory.md` |
|
||||
| `books-bookva-user-whitelist-gathering` ⚪ | long-lead — list для bookva-db login-gate уже applied (id 1+2 only) | `.tasks/books-bookva-user-whitelist-gathering.md` |
|
||||
| `books-vds-bookva-bootstrap` 🔵 | blocked on Phase 4 (новый VDS для Bookva billing) — long-term | `.tasks/books-vds-bookva-bootstrap.md` |
|
||||
| `bookva-tenant-cutover` (NEW, not yet created) | ready после user signal — re-start 6 stopped Portainer stacks + ES snapshot/restore Phase 2 + smoke с двух сетей. Bookva-minio + bookva-db уже готовы с данными | TBD `.tasks/bookva-tenant-cutover.md` |
|
||||
| `books-api-shutdown` (NEW micro-task) | 24-48h soak started ~07:00 MSK 2026-05-26, ends ~2026-05-27/28. `docker stop books-api` через Portainer | TBD `.tasks/books-api-shutdown.md` |
|
||||
| `bookva-ozon-mcp-image-build` (NEW micro-task) | image `registry.kzntsv.site/books-ozon-mcp:master` не в registry — нужен build pipeline в victor/books | TBD `.tasks/bookva-ozon-mcp-image-build.md` |
|
||||
| `bookva-minio-dns` (optional) | HTTPS на `bookva-minio.kzntsv.site` через traefik (labels уже добавлены) — нужен только если хочется HTTPS endpoint вместо HTTP port-bind. Сейчас работает на `http://89.253.255.133:9001` | reg.ru — добавить A bookva-minio.kzntsv.site → 89.253.255.133 |
|
||||
| `stateful-split-volume-copy` ⚪ | bookva-side done; slovo-side ⚪ (отдельный slovo-cutover-prep) | `.tasks/stateful-split-volume-copy.md` |
|
||||
| `infra-inventory` ⚪ | ready, books VDS теперь 14 stacks (12 + bookva-minio + bookva stacks 9 of 10) | `.tasks/infra-inventory.md` |
|
||||
| `books-bookva-user-whitelist-gathering` ⚪ | long-lead — list уже applied (id=1+2 only) | `.tasks/books-bookva-user-whitelist-gathering.md` |
|
||||
| `books-vds-bookva-bootstrap` 🔵 | blocked on Phase 4 — long-term billing split | `.tasks/books-vds-bookva-bootstrap.md` |
|
||||
| `books-dns-cutover-bookva` 🔵 | blocked on books-vds-bookva-bootstrap | `.tasks/books-dns-cutover-bookva.md` |
|
||||
|
||||
## Спроси user'а
|
||||
|
||||
- **`bookva-tenant-cutover` — когда «поднимаем Bookva»?** Этот заход стартует cutover task: re-start 6 stopped Portainer stacks (api/web/scheduler/task-runner/ops-mcp/ntfy), `mc cp --recursive m/books m/bookva` для MinIO, ES snapshot from shared kzntsv → bookva-es restore (Phase 2 spec), smoke с двух сетей. Bookva goes LIVE на `bookseller.kzntsv.site` с login-gate (id=1+2 only).
|
||||
- **`books-api-shutdown` micro-task** — soak start ≈07:00 MSK 2026-05-26, 24h ends ≈2026-05-27, 48h ≈2026-05-28. `docker stop books-api` + `docker rm` через Portainer ad-hoc, или создать tracker task'у?
|
||||
- **`bookva-ozon-mcp-image-build`** — image не существует в registry. Нужно build для bookva-ozon-mcp stack. Service ещё не настроен в `victor/books` build pipeline? Создать tracker task'у с context'ом?
|
||||
- **Slovo-overlay parity (out-of-scope finding)** — `.env.example` имеет `slovo.kzntsv.site` host (ещё не существует), config-templates вероятно similarly stale, README ntfy volumes naming inconsistent с bookva. Защитить slovo-overlay перед slovo-cutover task'ой? Или wait — поправим когда понадобится.
|
||||
- **iis-migration descoped items** (carried over 2 sessions) — нет tracker tasks для 14 plan-to-migrate hostnames + source decommission + LE renewal 2026-07-22 + cleanup. Создать ⚪ или оставить в Closure note? Решение от прошлой сессии — отказался от 3-way split.
|
||||
- **`bookva-tenant-cutover` — когда «поднимаем Bookva»?** Стартует cutover: re-start 6 stopped Portainer stacks (api/web/scheduler/task-runner/ops-mcp/ntfy), ES snapshot from shared kzntsv → bookva-es restore (Phase 2 spec), smoke с двух сетей. Bookva-minio + bookva-db уже с данными. Login-gate active (id=1+2 only). Bookva goes LIVE на `bookseller.kzntsv.site`.
|
||||
- **`books-api-shutdown`** — soak ends ~2026-05-27/28. Ad-hoc через Portainer stop, или tracker task'у?
|
||||
- **`bookva-ozon-mcp-image-build`** — image не в registry. Создать tracker?
|
||||
- **Slovo-overlay parity audit** — `.env.example` с `slovo.kzntsv.site`, possible config-templates stale, ntfy volumes naming inconsistent с bookva. Audit перед slovo-cutover task?
|
||||
- **bookva-minio creds rotation** — сейчас MINIO_ACCESS_KEY/SECRET те же что у books-minio (zero-config-change). Rotate в отдельную task'у? Или не критично пока external port-bind active (creds читаются вместе с config).
|
||||
- **iis-migration descoped items** (carried over 3 sessions) — отверг 3-way split. Закрыто финально или оставить open?
|
||||
|
||||
## Не делать (preemptive guards)
|
||||
|
||||
- **Не trigger workflow_dispatch tenant=bookva svc=all** — PUT восстановит stopped bookva stacks через deploy.yml. bookva-web на bookseller.kzntsv.site опять станет LIVE. Только в рамках реального `bookva-tenant-cutover` решения.
|
||||
- **Не stop bookva-db / bookva-mongo / bookva-es** — они running internal, no exposure, useful для testing connectivity и pre-cutover validation.
|
||||
- **Не trigger workflow_dispatch tenant=bookva svc=all** до cutover signal — PUT восстановит stopped bookva stacks через deploy.yml, bookva-web на bookseller.kzntsv.site опять LIVE.
|
||||
- **Не stop bookva-db / bookva-mongo / bookva-es / bookva-minio** — running infra, no public exposure (кроме external port-bind для db+minio с auth), useful для testing.
|
||||
- **Не редактировать config volumes напрямую через alpine + edit** — source of truth = `bookva-overlay/config-templates/`. Любой config change = commit + push + re-populate volume через alpine cp.
|
||||
- **Не стартовать books-api shutdown** до явного 24-48ч soak end + user sign-off. Stack продолжает обслуживать `https://books.kzntsv.site/*` для external callers (если есть).
|
||||
- **Не push без grant в next session** — auto-push grant был session-only (Rule 4). В этой сессии user grant'нул на «делай авто-push» — следующая session требует нового grant.
|
||||
- **Не restore books-db backup `/backups/books-db-pre-split-20260526-1036.tar.gz`** unless rollback — это pre-cp snapshot, текущий books-db живёт, не нужен restore. Cleanup tar после 7 дней (manual).
|
||||
- **Не stop books-api shutdown** до явного 24-48ч soak end + user sign-off. Stack продолжает обслуживать `https://books.kzntsv.site/*` для external callers (если есть).
|
||||
- **Не push без grant в next session** — auto-push grant был session-only (Rule 4). Следующая session требует нового grant.
|
||||
- **Не restore books-db / mongo backups в `/backups/books-{db,mongo}-pre-split-20260526-*.tar.gz`** — это pre-cp snapshots, текущие books-db / books-job-scheduler-mongo живы. Cleanup tar'ов после 7+ дней (manual).
|
||||
- **Не trust `https://elasticsearch.kzntsv.site/`** без basicAuth — endpoint behind traefik middleware. Pwd в `/opt/books/api/config/default.json`.
|
||||
- **Не exposing books-db / books-minio external** на новые порты — оба уже на 3306 + 9000 host-bound. Audit security separately.
|
||||
|
||||
## Memory updates за сессию
|
||||
|
||||
- **Учить — Portainer stack = own compose project.** Cross-stack `depends_on` references вызывают "undefined service" при deploy. Either remove depends_on, или deploy всё одним мега-stack'ом через docker-compose.yml `include`.
|
||||
- **Учить — Portainer POST + immediate stop pattern.** `POST /api/stacks/create/standalone/string?endpointId=N` deploys+starts. Чтобы получить stack ID без running container — POST + `POST /api/stacks/<id>/stop?endpointId=N` сразу. Stack record persist (Status=2), deploy.yml workflow restarts at PUT.
|
||||
- **Учить — MariaDB / MongoDB versions нужно match для cp -a parity.** WiredTiger format меняется между Mongo major versions (4.x → 5/6/7 incompatible, crash exit 62). MariaDB minor patches transparent внутри 10.x. Upgrade — отдельная chain task, не во время data copy.
|
||||
- **Учить — Mongo data в books-job-scheduler bind-mount.** Volume `books-job-scheduler-mongodb` существует но empty (4K) — real data в `/opt/books/job-scheduler/mongo/db` host bind path. Same pattern с books-db (`/usr/docker/books-db/data`). Always inspect mounts, не trust volume name listing.
|
||||
- **Учить — bookva passwords plaintext в DB.** `users.password` это plaintext (не bcrypt), validate via `user.password !== password` в `packages/web/server/api/auth/login.post.js`. TODO comment в коде "replace with proper bcrypt comparison". Security debt. varchar(45) limit — login-gate UUID() (36 chars) fits.
|
||||
- **Учить — Gitea CI clone via PAT.** `git clone https://oauth2:${PAT}@git.kzntsv.site/...` pattern. PAT scope=`read:repository` достаточно. Secret name НЕ должен начинаться с `GITEA_*` или `GITHUB_*` (reserved).
|
||||
- **Учить — Portainer Env Vars в Stack.** При POST/PUT передаются как `[{"name":..., "value":...}]` массив. Compose может substitute через `${VAR_NAME}`. Persist в stack record (`/api/stacks/<id>` → Env field).
|
||||
- **Учить — embed-api auth gate в books-web identical к books-api.** `/api/healthz`=200 public, любой protected endpoint без auth = 401 "No token provided", invalid token = 401 "Invalid JWT token". Identical behavior — embed = port-of-books-api.
|
||||
- **Reference:** [[bookva-tenant-cutover-prep]] § Closure note — full session trace для 6 closed steps + 8 cross-repo commits.
|
||||
- **Reference:** Pass entries — `books-vds/full-env` (BOOKS_PORTAINER_URL + BOOKS_PORTAINER_API_KEY + BOOKS_DB_ROOT_PASSWORD + MINIO_ACCESS_KEY), `gitea/admin-token`, `gitea/victor-books-ci-bookva-overlay` (PAT scope=read:repository).
|
||||
- **Reference:** Backup artefacts — `/backups/books-db-pre-split-20260526-1036.tar.gz` (483MB) + `/backups/books-mongo-pre-split-20260526-1040.tar.gz` (234MB) on books VDS. Manual cleanup после 7+ дней.
|
||||
- **Учить — separate container vs bucket для multi-tenant MinIO.** Separate container (bookva-minio) = zero code change in bookva apps (same MINIO creds + same bucket name `books`, разный endpoint). Bucket-split (`books` + `bookva` в одном MinIO) = requires per-tenant bucket config + creds rotation для isolation. User picked separate container.
|
||||
- **Учить — DNS wildcard kzntsv.site → 94.19.247.14 (Windows IIS, не books-vds 89.253.255.133).** Explicit A-records нужны для каждого нового subdomain на books-vds. Bookseller/bookva/books — explicit. Random subdomains → Windows IIS.
|
||||
- **Учить — port-bind pattern для external access** без traefik / без DNS. Books-db уже 3306 host-bound, bookva-db добавлен 33306. Books-minio уже 9000, bookva-minio добавлен 9001. Direct IP+port access. Альтернатива — traefik TCP entrypoints для SNI routing, но требует static config modification.
|
||||
- **Учить — Portainer stack = own compose project.** Cross-stack `depends_on` references вызывают "undefined service" при deploy. Apps retry до ready.
|
||||
- **Учить — Portainer POST + immediate stop pattern.** POST deploys+starts, чтобы получить stack ID без running container: POST + `POST /api/stacks/<id>/stop?endpointId=N`. Stack record persist (Status=2), deploy.yml workflow restarts at PUT.
|
||||
- **Учить — MariaDB / MongoDB versions нужно match для cp -a parity.** WiredTiger format меняется между Mongo majors (4.x → 5/6/7 incompatible, crash exit 62). MariaDB 10.x.y minor patches transparent.
|
||||
- **Учить — Mongo data в books-job-scheduler bind-mount `/opt/books/job-scheduler/mongo/db`.** Docker volume `books-job-scheduler-mongodb` существует но empty (4K) — real data в host bind path. Same pattern с books-db (`/usr/docker/books-db/data`).
|
||||
- **Учить — bookva passwords plaintext в DB.** `users.password` это plaintext (не bcrypt), validate via direct compare в `packages/web/server/api/auth/login.post.js`. TODO comment в коде "replace with proper bcrypt comparison". varchar(45) limit — login-gate UUID() (36 chars) fits.
|
||||
- **Учить — Gitea reserved prefix.** Repo secrets с именем `GITEA_*` / `GITHUB_*` returns 400 "invalid variable or secret name". Use neutral names like BOOKVA_OVERLAY_TOKEN.
|
||||
- **Учить — Gitea token creation требует basic auth.** Admin token не достаточен для `POST /users/{name}/tokens` — user генерит PAT в UI.
|
||||
- **Учить — embed-api auth gate идентичен books-api.** `/api/healthz`=200 public, любой protected без token = 401.
|
||||
- **Reference:** [[bookva-tenant-cutover-prep]] § Closure note + Post-closure follow-up — full session trace для 7 closed steps + bookva-minio extension + 11 cross-repo commits.
|
||||
- **Reference:** Pass entries — `books-vds/full-env` (BOOKS_PORTAINER_URL+API_KEY, BOOKS_DB_ROOT_PASSWORD, MINIO_ACCESS_KEY), `gitea/admin-token`, `gitea/victor-books-ci-bookva-overlay`.
|
||||
- **Reference:** Backup artefacts на books VDS — `/backups/books-db-pre-split-20260526-1036.tar.gz` (483MB) + `/backups/books-mongo-pre-split-20260526-1040.tar.gz` (234MB). Manual cleanup после 7+ дней.
|
||||
- **Reference:** External admin access:
|
||||
- bookva-db: `mysql -h 89.253.255.133 -P 33306 -uroot -p${BOOKS_DB_ROOT_PASSWORD} books`
|
||||
- bookva-minio: S3 client → `http://89.253.255.133:9001`, AKIA `AKIAJ2YJP72W6ZHCRE6Q`, secret в pass `books-vds/full-env` (MINIO_SECRET_KEY).
|
||||
|
||||
Reference in New Issue
Block a user