From c84ccf4360bea884273ce0607701abc2b07ab2e3 Mon Sep 17 00:00:00 2001 From: vitya Date: Tue, 26 May 2026 13:26:51 +0300 Subject: [PATCH] =?UTF-8?q?tasks(NEXT=5FSESSION):=20session-close=20?= =?UTF-8?q?=E2=80=94=20bookva=20LIVE=20=D0=BD=D0=B0=20bookseller=20+=20wik?= =?UTF-8?q?i=20ingest?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 7/7+minio+cutover done в одну сессию. bookva tenant LIVE на bookseller.kzntsv.site (10 stacks active, login-gate, ES reindexed 920k docs). Auto-deploy tenant=all активирован. 3 wiki concepts ingested (gitea-reserved-secret-prefix, mongo-wt- format-major-version-incompat, portainer-per-stack-depends-on-pitfall). Open треки: books-api-shutdown (~2026-05-27/28), bookva-ozon-mcp-image-build, optional bookva-minio HTTPS DNS. bookva-tenant-cutover task не понадобилась — de-facto cutover произошёл сегодня. Auto-push grant был session-only — следующая session требует нового grant. Co-Authored-By: Claude Opus 4.7 (1M context) --- .tasks/NEXT_SESSION.md | 108 +++++++++++++++++++++++------------------ 1 file changed, 60 insertions(+), 48 deletions(-) diff --git a/.tasks/NEXT_SESSION.md b/.tasks/NEXT_SESSION.md index 3e8d826..83c57a8 100644 --- a/.tasks/NEXT_SESSION.md +++ b/.tasks/NEXT_SESSION.md @@ -1,75 +1,87 @@ --- -_last_updated_: 2026-05-26T23:00:00+03:00 -session_id: 2026-05-26-bookva-tenant-cutover-prep-closed-7of7-plus-minio +_last_updated_: 2026-05-26T23:30:00+03:00 +session_id: 2026-05-26-bookva-tenant-cutover-prep-LIVE --- # Next session handoff ## Recent commits -- `.admin 744c384b` — tasks(bookva-tenant-cutover-prep): post-closure — bookva-minio + external (this commit) -- `.admin b7696aac` — tasks(NEXT_SESSION): refresh after 6/7 closure -- `.admin f91e51d9` — tasks(bookva-tenant-cutover-prep): 🟢 closed 6/7 -- `victor/bookva-overlay b324e12` — add bookva-minio + external port-bind для bookva-db (separate MinIO instance, не bucket-split; bookva-db external 33306; bookva-minio external 9001) -- `victor/bookva-overlay 8bffd68` — *.compose.yml: drop depends_on (per-stack Portainer model) +- `.wiki b2528fb` — wiki(concepts): ingest 3 generic ops-gotchas from bookva tenant-split (manual write, MCP commitFile bug) +- `victor/books c434230` — deploy.yml: auto-deploy default tenant=slovo → all (symmetric rollout active) +- `victor/bookva-overlay 2862279` — traefik labels: entrypoints=https + certresolver=letsEncrypt (books-VDS instance naming) +- `victor/bookva-overlay 5474b10` — elasticsearch.compose.yml: add reindex.remote.whitelist=elasticsearch:9200 +- `victor/bookva-overlay b324e12` — add bookva-minio + external port-bind для bookva-db +- `victor/bookva-overlay 8bffd68` — *.compose.yml: drop depends_on (per-stack model) - `victor/bookva-overlay 2b20a3e` — api.compose.yml: remove traefik (internal-only per design v3) -- `victor/bookva-overlay 93c2ea2` — mongo.compose.yml: pin mongo:4.2 (WiredTiger format compat) +- `victor/bookva-overlay 93c2ea2` — mongo.compose.yml: pin mongo:4.2 (WT format compat) - `victor/bookva-overlay 23eb374` — db.compose.yml: pin mariadb:10.6 (cp -a parity) - `victor/bookva-overlay 264373d` — .env.example: design v3 hostnames - `victor/bookva-overlay 5b173de` — config-templates align to prod shape + design v3 hostname - `victor/books 75ea320` — feat(deploy): web.compose.yml embed-api env switch - `victor/books 2f7b539` — fix(ci): rename secrets.GITEA_TOKEN → BOOKVA_OVERLAY_TOKEN +- `.admin × 5` — task progress, closure, NEXT_SESSION refreshes + +## What's LIVE сейчас + +- **bookseller.kzntsv.site** → bookva-web (embed-api), 200 OK, login-gate active (id=1=pobeda2003, id=2=vitya) +- **bookva.kzntsv.site** → books-web (slovo, embed-api тоже), 200 OK, fallback к books-api stack для legacy paths +- **books.kzntsv.site** → books-api (legacy stack), ещё running 24-48h soak до shutdown micro-task +- **10 bookva Portainer stacks** all ACTIVE (db/mongo/es/minio/api/web/scheduler/task-runner/ops-mcp/ntfy). bookva-ozon-mcp пока не создан (image отсутствует в registry). +- **External admin endpoints:** + - `mysql -h 89.253.255.133 -P 33306 -uroot -p${BOOKS_DB_ROOT_PASSWORD} books` + - S3 client → `http://89.253.255.133:9001`, AKIA same as books (см. pass `books-vds/full-env`) +- **Auto-deploy симметричный** — push в victor/books master → build → deploy.yml tenant=all → PUT slovo (22/23/24/26) + bookva (47/45/46/43) ## Open треки | Трек | Готовность | Entry-point | |---|---|---| -| `bookva-tenant-cutover` (NEW, not yet created) | ready после user signal — re-start 6 stopped Portainer stacks + ES snapshot/restore Phase 2 + smoke с двух сетей. Bookva-minio + bookva-db уже готовы с данными | TBD `.tasks/bookva-tenant-cutover.md` | -| `books-api-shutdown` (NEW micro-task) | 24-48h soak started ~07:00 MSK 2026-05-26, ends ~2026-05-27/28. `docker stop books-api` через Portainer | TBD `.tasks/books-api-shutdown.md` | -| `bookva-ozon-mcp-image-build` (NEW micro-task) | image `registry.kzntsv.site/books-ozon-mcp:master` не в registry — нужен build pipeline в victor/books | TBD `.tasks/bookva-ozon-mcp-image-build.md` | -| `bookva-minio-dns` (optional) | HTTPS на `bookva-minio.kzntsv.site` через traefik (labels уже добавлены) — нужен только если хочется HTTPS endpoint вместо HTTP port-bind. Сейчас работает на `http://89.253.255.133:9001` | reg.ru — добавить A bookva-minio.kzntsv.site → 89.253.255.133 | -| `stateful-split-volume-copy` ⚪ | bookva-side done; slovo-side ⚪ (отдельный slovo-cutover-prep) | `.tasks/stateful-split-volume-copy.md` | -| `infra-inventory` ⚪ | ready, books VDS теперь 14 stacks (12 + bookva-minio + bookva stacks 9 of 10) | `.tasks/infra-inventory.md` | -| `books-bookva-user-whitelist-gathering` ⚪ | long-lead — list уже applied (id=1+2 only) | `.tasks/books-bookva-user-whitelist-gathering.md` | -| `books-vds-bookva-bootstrap` 🔵 | blocked on Phase 4 — long-term billing split | `.tasks/books-vds-bookva-bootstrap.md` | +| `books-api-shutdown` (NEW micro-task) | 24-48h soak ends ~2026-05-27/28. `docker stop books-api` через Portainer | TBD `.tasks/books-api-shutdown.md` | +| `bookva-ozon-mcp-image-build` (NEW micro-task) | image `books-ozon-mcp:master` не в registry — нужен build pipeline в victor/books | TBD `.tasks/bookva-ozon-mcp-image-build.md` | +| `bookva-tenant-cutover` task **не понадобилась** — cutover de-facto произошёл в этой сессии (Step 6 descoped по решению user'а) | n/a — manual heads-up учредителю Bookva | +| `bookva-minio-https-dns` (optional) | reg.ru A `bookva-minio.kzntsv.site` → 89.253.255.133 + `push.bookseller.kzntsv.site` → 89.253.255.133 для traefik HTTPS вместо port-bind | reg.ru DNS UI | +| `mariadb-mongo-upgrade-chain` (eventual post-cutover) | bookva-db 10.6 → 10.11, bookva-mongo 4.2 → 4.4 → 5 → 6 → 7 chain. Когда usage стабилизируется | TBD | +| `stateful-split-volume-copy` ⚪ | bookva-side done; slovo-side scope deferred (отдельный slovo-cutover) | `.tasks/stateful-split-volume-copy.md` | +| `infra-inventory` ⚪ | books VDS теперь 14 stacks (+ bookva-minio + 9 bookva) — момент удачный для ingest factsheet | `.tasks/infra-inventory.md` | +| `books-bookva-user-whitelist-gathering` ⚪ | login-gate уже applied (id=1+2 only) — таска осталась только для verification списка от учредителя Bookva post-cutover | `.tasks/books-bookva-user-whitelist-gathering.md` | +| `books-vds-bookva-bootstrap` 🔵 | blocked on Phase 4 (Rusonyx или другой VDS для Bookva billing). Long-term — bookva сейчас на shared books VDS | `.tasks/books-vds-bookva-bootstrap.md` | | `books-dns-cutover-bookva` 🔵 | blocked on books-vds-bookva-bootstrap | `.tasks/books-dns-cutover-bookva.md` | ## Спроси user'а -- **`bookva-tenant-cutover` — когда «поднимаем Bookva»?** Стартует cutover: re-start 6 stopped Portainer stacks (api/web/scheduler/task-runner/ops-mcp/ntfy), ES snapshot from shared kzntsv → bookva-es restore (Phase 2 spec), smoke с двух сетей. Bookva-minio + bookva-db уже с данными. Login-gate active (id=1+2 only). Bookva goes LIVE на `bookseller.kzntsv.site`. -- **`books-api-shutdown`** — soak ends ~2026-05-27/28. Ad-hoc через Portainer stop, или tracker task'у? -- **`bookva-ozon-mcp-image-build`** — image не в registry. Создать tracker? -- **Slovo-overlay parity audit** — `.env.example` с `slovo.kzntsv.site`, possible config-templates stale, ntfy volumes naming inconsistent с bookva. Audit перед slovo-cutover task? -- **bookva-minio creds rotation** — сейчас MINIO_ACCESS_KEY/SECRET те же что у books-minio (zero-config-change). Rotate в отдельную task'у? Или не критично пока external port-bind active (creds читаются вместе с config). -- **iis-migration descoped items** (carried over 3 sessions) — отверг 3-way split. Закрыто финально или оставить open? +- **Manual heads-up учредителю Bookva** (Step 6 substitute) — отправить ей сообщение «Bookva теперь на `https://bookseller.kzntsv.site`, login те же». Когда? +- **`books-api-shutdown`** через 24-48ч — ad-hoc через Portainer или tracker task? +- **`bookva-ozon-mcp-image-build`** — нужен build в victor/books CI? Сейчас image отсутствует, bookva-ozon-mcp stack не создан. Если service не используется — skip навсегда? +- **bookva-minio creds rotation** — сейчас AKIA same as books-minio. Rotate в отдельную task'у когда стабилизируется? +- **slovo-overlay parity audit** — `.env.example` и templates вероятно stale similarly to bookva pre-fix. Audit перед slovo-cutover task? ## Не делать (preemptive guards) -- **Не trigger workflow_dispatch tenant=bookva svc=all** до cutover signal — PUT восстановит stopped bookva stacks через deploy.yml, bookva-web на bookseller.kzntsv.site опять LIVE. -- **Не stop bookva-db / bookva-mongo / bookva-es / bookva-minio** — running infra, no public exposure (кроме external port-bind для db+minio с auth), useful для testing. -- **Не редактировать config volumes напрямую через alpine + edit** — source of truth = `bookva-overlay/config-templates/`. Любой config change = commit + push + re-populate volume через alpine cp. -- **Не stop books-api shutdown** до явного 24-48ч soak end + user sign-off. Stack продолжает обслуживать `https://books.kzntsv.site/*` для external callers (если есть). -- **Не push без grant в next session** — auto-push grant был session-only (Rule 4). Следующая session требует нового grant. -- **Не restore books-db / mongo backups в `/backups/books-{db,mongo}-pre-split-20260526-*.tar.gz`** — это pre-cp snapshots, текущие books-db / books-job-scheduler-mongo живы. Cleanup tar'ов после 7+ дней (manual). -- **Не trust `https://elasticsearch.kzntsv.site/`** без basicAuth — endpoint behind traefik middleware. Pwd в `/opt/books/api/config/default.json`. -- **Не exposing books-db / books-minio external** на новые порты — оба уже на 3306 + 9000 host-bound. Audit security separately. +- **Не stop bookva-{db,mongo,es,minio,api,web,scheduler,task-runner,ops-mcp,ntfy}** — все LIVE на bookseller.kzntsv.site, любой stop = production outage Bookva tenant'а. +- **Не editing config volumes через alpine** — source of truth = `bookva-overlay/config-templates/`. Edit → commit → push → re-populate. +- **Не stop books-api** до явного soak end (~2026-05-27/28) + user sign-off. Внешние callers всё ещё на `https://books.kzntsv.site/*`. +- **Не push без grant в next session** — auto-push grant был session-only per Rule 4. В этой сессии user grant'нул на «делай авто-push» — следующая session требует нового grant. +- **Не trust DNS wildcard kzntsv.site** — wildcard → 94.19.247.14 (Windows IIS), НЕ books VDS 89.253.255.133. Новые subdomains требуют explicit A-records в reg.ru. +- **Не restore /backups/books-{db,mongo}-pre-split-20260526-*.tar.gz** unless rollback. Manual cleanup после 7+ дней. -## Memory updates за сессию +## Memory updates / wiki ingests -- **Учить — separate container vs bucket для multi-tenant MinIO.** Separate container (bookva-minio) = zero code change in bookva apps (same MINIO creds + same bucket name `books`, разный endpoint). Bucket-split (`books` + `bookva` в одном MinIO) = requires per-tenant bucket config + creds rotation для isolation. User picked separate container. -- **Учить — DNS wildcard kzntsv.site → 94.19.247.14 (Windows IIS, не books-vds 89.253.255.133).** Explicit A-records нужны для каждого нового subdomain на books-vds. Bookseller/bookva/books — explicit. Random subdomains → Windows IIS. -- **Учить — port-bind pattern для external access** без traefik / без DNS. Books-db уже 3306 host-bound, bookva-db добавлен 33306. Books-minio уже 9000, bookva-minio добавлен 9001. Direct IP+port access. Альтернатива — traefik TCP entrypoints для SNI routing, но требует static config modification. -- **Учить — Portainer stack = own compose project.** Cross-stack `depends_on` references вызывают "undefined service" при deploy. Apps retry до ready. -- **Учить — Portainer POST + immediate stop pattern.** POST deploys+starts, чтобы получить stack ID без running container: POST + `POST /api/stacks//stop?endpointId=N`. Stack record persist (Status=2), deploy.yml workflow restarts at PUT. -- **Учить — MariaDB / MongoDB versions нужно match для cp -a parity.** WiredTiger format меняется между Mongo majors (4.x → 5/6/7 incompatible, crash exit 62). MariaDB 10.x.y minor patches transparent. -- **Учить — Mongo data в books-job-scheduler bind-mount `/opt/books/job-scheduler/mongo/db`.** Docker volume `books-job-scheduler-mongodb` существует но empty (4K) — real data в host bind path. Same pattern с books-db (`/usr/docker/books-db/data`). -- **Учить — bookva passwords plaintext в DB.** `users.password` это plaintext (не bcrypt), validate via direct compare в `packages/web/server/api/auth/login.post.js`. TODO comment в коде "replace with proper bcrypt comparison". varchar(45) limit — login-gate UUID() (36 chars) fits. -- **Учить — Gitea reserved prefix.** Repo secrets с именем `GITEA_*` / `GITHUB_*` returns 400 "invalid variable or secret name". Use neutral names like BOOKVA_OVERLAY_TOKEN. -- **Учить — Gitea token creation требует basic auth.** Admin token не достаточен для `POST /users/{name}/tokens` — user генерит PAT в UI. -- **Учить — embed-api auth gate идентичен books-api.** `/api/healthz`=200 public, любой protected без token = 401. -- **Reference:** [[bookva-tenant-cutover-prep]] § Closure note + Post-closure follow-up — full session trace для 7 closed steps + bookva-minio extension + 11 cross-repo commits. -- **Reference:** Pass entries — `books-vds/full-env` (BOOKS_PORTAINER_URL+API_KEY, BOOKS_DB_ROOT_PASSWORD, MINIO_ACCESS_KEY), `gitea/admin-token`, `gitea/victor-books-ci-bookva-overlay`. -- **Reference:** Backup artefacts на books VDS — `/backups/books-db-pre-split-20260526-1036.tar.gz` (483MB) + `/backups/books-mongo-pre-split-20260526-1040.tar.gz` (234MB). Manual cleanup после 7+ дней. -- **Reference:** External admin access: - - bookva-db: `mysql -h 89.253.255.133 -P 33306 -uroot -p${BOOKS_DB_ROOT_PASSWORD} books` - - bookva-minio: S3 client → `http://89.253.255.133:9001`, AKIA `AKIAJ2YJP72W6ZHCRE6Q`, secret в pass `books-vds/full-env` (MINIO_SECRET_KEY). +Ingested в shared wiki `~/projects/.wiki/concepts/`: +- `gitea-reserved-secret-prefix` — GITEA_* / GITHUB_* prefix reserved (PUT → 400) +- `mongo-wt-format-major-version-incompat` — Mongo 4→7 crash exit 62, chain upgrade FCV +- `portainer-per-stack-depends-on-pitfall` — cross-stack depends_on "undefined service" + +Local memory updates за сессию (не ingested, books-specific): +- DNS wildcard kzntsv.site → 94.19.247.14 (Windows IIS, не books-vds) +- bookva passwords plaintext в DB (varchar(45), TODO bcrypt в login.post.js) +- books-vds traefik instance naming: `entrypoints=https` + `certresolver=letsEncrypt` (case-sensitive) +- Embed-api auth gate в books-web identical к books-api (401 без token, 401 invalid JWT) +- Multi-tenant MinIO design: separate container vs bucket-split. User выбрал separate container (zero-config-change в apps). + +## Pass / Reference + +- pass entry `gitea/victor-books-ci-bookva-overlay` (PAT scope=read:repository) — backup для BOOKVA_OVERLAY_TOKEN secret в victor/books. +- pass entry `books-vds/full-env` — BOOKS_PORTAINER_URL+API_KEY, BOOKS_DB_ROOT_PASSWORD, MINIO_ACCESS_KEY. +- Backups на books VDS — `/backups/books-{db,mongo}-pre-split-20260526-*.tar.gz`. +- **Reference:** [[bookva-tenant-cutover-prep]] § Closure note + Post-closure follow-up — full session trace.