admin/.tasks/NEXT_SESSION.md

_last_updated_, session_id

_last_updated_	session_id
2026-05-26T23:00:00+03:00	2026-05-26-bookva-tenant-cutover-prep-closed-7of7-plus-minio

Next session handoff

Recent commits

• .admin 744c384b — tasks(bookva-tenant-cutover-prep): post-closure — bookva-minio + external (this commit)
• .admin b7696aac — tasks(NEXT_SESSION): refresh after 6/7 closure
• .admin f91e51d9 — tasks(bookva-tenant-cutover-prep): 🟢 closed 6/7
• victor/bookva-overlay b324e12 — add bookva-minio + external port-bind для bookva-db (separate MinIO instance, не bucket-split; bookva-db external 33306; bookva-minio external 9001)
• victor/bookva-overlay 8bffd68 — *.compose.yml: drop depends_on (per-stack Portainer model)
• victor/bookva-overlay 2b20a3e — api.compose.yml: remove traefik (internal-only per design v3)
• victor/bookva-overlay 93c2ea2 — mongo.compose.yml: pin mongo:4.2 (WiredTiger format compat)
• victor/bookva-overlay 23eb374 — db.compose.yml: pin mariadb:10.6 (cp -a parity)
• victor/bookva-overlay 264373d — .env.example: design v3 hostnames
• victor/bookva-overlay 5b173de — config-templates align to prod shape + design v3 hostname
• victor/books 75ea320 — feat(deploy): web.compose.yml embed-api env switch
• victor/books 2f7b539 — fix(ci): rename secrets.GITEA_TOKEN → BOOKVA_OVERLAY_TOKEN

Open треки

Трек	Готовность	Entry-point
bookva-tenant-cutover (NEW, not yet created)	ready после user signal — re-start 6 stopped Portainer stacks + ES snapshot/restore Phase 2 + smoke с двух сетей. Bookva-minio + bookva-db уже готовы с данными	TBD .tasks/bookva-tenant-cutover.md
books-api-shutdown (NEW micro-task)	24-48h soak started ~07:00 MSK 2026-05-26, ends ~2026-05-27/28. docker stop books-api через Portainer	TBD .tasks/books-api-shutdown.md
bookva-ozon-mcp-image-build (NEW micro-task)	image registry.kzntsv.site/books-ozon-mcp:master не в registry — нужен build pipeline в victor/books	TBD .tasks/bookva-ozon-mcp-image-build.md
bookva-minio-dns (optional)	HTTPS на bookva-minio.kzntsv.site через traefik (labels уже добавлены) — нужен только если хочется HTTPS endpoint вместо HTTP port-bind. Сейчас работает на http://89.253.255.133:9001	reg.ru — добавить A bookva-minio.kzntsv.site → 89.253.255.133
stateful-split-volume-copy ⚪	bookva-side done; slovo-side ⚪ (отдельный slovo-cutover-prep)	.tasks/stateful-split-volume-copy.md
infra-inventory ⚪	ready, books VDS теперь 14 stacks (12 + bookva-minio + bookva stacks 9 of 10)	.tasks/infra-inventory.md
books-bookva-user-whitelist-gathering ⚪	long-lead — list уже applied (id=1+2 only)	.tasks/books-bookva-user-whitelist-gathering.md
books-vds-bookva-bootstrap 🔵	blocked on Phase 4 — long-term billing split	.tasks/books-vds-bookva-bootstrap.md
books-dns-cutover-bookva 🔵	blocked on books-vds-bookva-bootstrap	.tasks/books-dns-cutover-bookva.md

Спроси user'а

• bookva-tenant-cutover — когда «поднимаем Bookva»? Стартует cutover: re-start 6 stopped Portainer stacks (api/web/scheduler/task-runner/ops-mcp/ntfy), ES snapshot from shared kzntsv → bookva-es restore (Phase 2 spec), smoke с двух сетей. Bookva-minio + bookva-db уже с данными. Login-gate active (id=1+2 only). Bookva goes LIVE на bookseller.kzntsv.site.
• books-api-shutdown — soak ends ~2026-05-27/28. Ad-hoc через Portainer stop, или tracker task'у?
• bookva-ozon-mcp-image-build — image не в registry. Создать tracker?
• Slovo-overlay parity audit — .env.example с slovo.kzntsv.site, possible config-templates stale, ntfy volumes naming inconsistent с bookva. Audit перед slovo-cutover task?
• bookva-minio creds rotation — сейчас MINIO_ACCESS_KEY/SECRET те же что у books-minio (zero-config-change). Rotate в отдельную task'у? Или не критично пока external port-bind active (creds читаются вместе с config).
• iis-migration descoped items (carried over 3 sessions) — отверг 3-way split. Закрыто финально или оставить open?

Не делать (preemptive guards)

• Не trigger workflow_dispatch tenant=bookva svc=all до cutover signal — PUT восстановит stopped bookva stacks через deploy.yml, bookva-web на bookseller.kzntsv.site опять LIVE.
• Не stop bookva-db / bookva-mongo / bookva-es / bookva-minio — running infra, no public exposure (кроме external port-bind для db+minio с auth), useful для testing.
• Не редактировать config volumes напрямую через alpine + edit — source of truth = bookva-overlay/config-templates/. Любой config change = commit + push + re-populate volume через alpine cp.
• Не stop books-api shutdown до явного 24-48ч soak end + user sign-off. Stack продолжает обслуживать https://books.kzntsv.site/* для external callers (если есть).
• Не push без grant в next session — auto-push grant был session-only (Rule 4). Следующая session требует нового grant.
• Не restore books-db / mongo backups в /backups/books-{db,mongo}-pre-split-20260526-*.tar.gz — это pre-cp snapshots, текущие books-db / books-job-scheduler-mongo живы. Cleanup tar'ов после 7+ дней (manual).
• Не trust https://elasticsearch.kzntsv.site/ без basicAuth — endpoint behind traefik middleware. Pwd в /opt/books/api/config/default.json.
• Не exposing books-db / books-minio external на новые порты — оба уже на 3306 + 9000 host-bound. Audit security separately.

Memory updates за сессию

• Учить — separate container vs bucket для multi-tenant MinIO. Separate container (bookva-minio) = zero code change in bookva apps (same MINIO creds + same bucket name books, разный endpoint). Bucket-split (books + bookva в одном MinIO) = requires per-tenant bucket config + creds rotation для isolation. User picked separate container.
• Учить — DNS wildcard kzntsv.site → 94.19.247.14 (Windows IIS, не books-vds 89.253.255.133). Explicit A-records нужны для каждого нового subdomain на books-vds. Bookseller/bookva/books — explicit. Random subdomains → Windows IIS.
• Учить — port-bind pattern для external access без traefik / без DNS. Books-db уже 3306 host-bound, bookva-db добавлен 33306. Books-minio уже 9000, bookva-minio добавлен 9001. Direct IP+port access. Альтернатива — traefik TCP entrypoints для SNI routing, но требует static config modification.
• Учить — Portainer stack = own compose project. Cross-stack depends_on references вызывают "undefined service" при deploy. Apps retry до ready.
• Учить — Portainer POST + immediate stop pattern. POST deploys+starts, чтобы получить stack ID без running container: POST + POST /api/stacks/<id>/stop?endpointId=N. Stack record persist (Status=2), deploy.yml workflow restarts at PUT.
• Учить — MariaDB / MongoDB versions нужно match для cp -a parity. WiredTiger format меняется между Mongo majors (4.x → 5/6/7 incompatible, crash exit 62). MariaDB 10.x.y minor patches transparent.
• Учить — Mongo data в books-job-scheduler bind-mount /opt/books/job-scheduler/mongo/db. Docker volume books-job-scheduler-mongodb существует но empty (4K) — real data в host bind path. Same pattern с books-db (/usr/docker/books-db/data).
• Учить — bookva passwords plaintext в DB. users.password это plaintext (не bcrypt), validate via direct compare в packages/web/server/api/auth/login.post.js. TODO comment в коде "replace with proper bcrypt comparison". varchar(45) limit — login-gate UUID() (36 chars) fits.
• Учить — Gitea reserved prefix. Repo secrets с именем GITEA_* / GITHUB_* returns 400 "invalid variable or secret name". Use neutral names like BOOKVA_OVERLAY_TOKEN.
• Учить — Gitea token creation требует basic auth. Admin token не достаточен для POST /users/{name}/tokens — user генерит PAT в UI.
• Учить — embed-api auth gate идентичен books-api. /api/healthz=200 public, любой protected без token = 401.
• Reference: bookva-tenant-cutover-prep § Closure note + Post-closure follow-up — full session trace для 7 closed steps + bookva-minio extension + 11 cross-repo commits.
• Reference: Pass entries — books-vds/full-env (BOOKS_PORTAINER_URL+API_KEY, BOOKS_DB_ROOT_PASSWORD, MINIO_ACCESS_KEY), gitea/admin-token, gitea/victor-books-ci-bookva-overlay.
• Reference: Backup artefacts на books VDS — /backups/books-db-pre-split-20260526-1036.tar.gz (483MB) + /backups/books-mongo-pre-split-20260526-1040.tar.gz (234MB). Manual cleanup после 7+ дней.
• Reference: External admin access:
  • bookva-db: mysql -h 89.253.255.133 -P 33306 -uroot -p${BOOKS_DB_ROOT_PASSWORD} books
  • bookva-minio: S3 client → http://89.253.255.133:9001, AKIA AKIAJ2YJP72W6ZHCRE6Q, secret в pass books-vds/full-env (MINIO_SECRET_KEY).