diff --git a/AGENTS.md b/AGENTS.md index 2833426a..09c99183 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -105,7 +105,7 @@ approve decisions, or supervise work. The specification does all of this. | Service | Location | Access | |---------|----------|--------| | Gitea | `http://185.19.28.170:3000` (SSH :22) — behind the shared ingress NLB | User: heaviness510 | -| Bikoret | `http://185.19.28.170` — behind the same ingress (catch-all; `shorashim.ch` once DNS points there) | keys: KOHEN.md "Issuing a key" | +| Bikoret | `https://bikoret.ch` (also `http://185.19.28.170`, the catch-all; `shorashim.ch` retired 2026-10-20) | keys: KOHEN.md "Issuing a key" | | PostgreSQL | Exoscale DBaaS ch-gva-2 | `temple-council-db` | | Kubernetes | Exoscale SKS ch-gva-2 | `~/.kube/exoscale-temple-council.yaml` | diff --git a/KOHEN.md b/KOHEN.md index ecad5d92..c85a8140 100644 --- a/KOHEN.md +++ b/KOHEN.md @@ -481,11 +481,11 @@ If any day failed: record what broke, fix the cause, restart from Day 1. ```bash # 1. Write today's manna provision (same format as Day 4, new date) # 2. Health check -curl https://shorashim.ch/kodesh/health | jq . +curl https://bikoret.ch/kodesh/health | jq . # 3. Halt status -curl https://shorashim.ch/kodesh/status | jq .halt_status +curl https://bikoret.ch/kodesh/status | jq .halt_status # 4. Refuge list -curl https://shorashim.ch/kodesh/status | jq '.refuge_components' +curl https://bikoret.ch/kodesh/status | jq '.refuge_components' ``` ### Issuing a key — *Mishmeret HaSha'ar* @@ -750,7 +750,7 @@ The halt monitor detected one of three cardinal sins: ```bash # Inspect the halt -curl https://shorashim.ch/kodesh/status | jq .halt_status +curl https://bikoret.ch/kodesh/status | jq .halt_status kubectl logs -n shorashim deploy/bikoret -c vav-pipeline | grep HALT # Investigate. Fix the root cause. Then resolve via the operator API. diff --git a/deploy/ARCHITECTURE.md b/deploy/ARCHITECTURE.md index 3049cf1d..0acf9038 100644 --- a/deploy/ARCHITECTURE.md +++ b/deploy/ARCHITECTURE.md @@ -40,8 +40,9 @@ Kept in `deploy/k8s/`: - `gitea-mcp-ingress.yaml` — TLS ingress `mcp.bikoret.ch` for the MCP server - `gitea-mcp-secret.yaml` — template for a Gitea PAT (static-token mode only; kept for rollback) - `gitea-ingress.yaml` — TLS ingress `git.bikoret.ch` for Gitea itself (namespace temple-council), required by OAuth mode -- `gitea-public-patch.yaml` — patch that sets Gitea's ROOT_URL/DOMAIN/SSH_DOMAIN to `git.bikoret.ch` +- `gitea-public-patch.yaml` — patch that sets Gitea's ROOT_URL/DOMAIN/SSH_DOMAIN to `git.bikoret.ch` and APP_NAME to `Bikoret` - `gitea-public-apply.sh` / `gitea-public-verify.sh` — the operator's apply and read-only check for the four above +- `shorashim-ch-takedown.sh` — 2026-10-20: removes the shorashim.ch ingress rule and the orphan mcp.shorashim.ch secret, applies the Gitea brand patch - `cert-manager-issuer.yaml` — Let's Encrypt ClusterIssuer ## Containers diff --git a/deploy/k8s/gitea-public-patch.yaml b/deploy/k8s/gitea-public-patch.yaml index e39d478a..da1bc328 100644 --- a/deploy/k8s/gitea-public-patch.yaml +++ b/deploy/k8s/gitea-public-patch.yaml @@ -26,3 +26,7 @@ spec: value: "git.bikoret.ch" - name: GITEA__server__SSH_DOMAIN value: "git.bikoret.ch" + # [DEFAULT] APP_NAME — the title and brand on every Gitea page. + # Was "Shorashim"; the system is named Bikoret (PRD §0). + - name: GITEA____APP_NAME + value: "Bikoret" diff --git a/deploy/k8s/service.yaml b/deploy/k8s/service.yaml index d23a6149..b3726dc1 100644 --- a/deploy/k8s/service.yaml +++ b/deploy/k8s/service.yaml @@ -38,8 +38,9 @@ spec: # believes that header only from TRUSTED_PROXIES (configmap.yaml). # # Hosts (2026-10-13, the name): bikoret.ch is the place; www.bikoret.ch -# and the old shorashim.ch are served too; bikoret.org (second Ingress -# below) only redirects. TLS from Let's Encrypt through cert-manager's +# is served too; bikoret.org (second Ingress +# below) only redirects. The old shorashim.ch rule was taken down on +# 2026-10-20 (the domain is retired). TLS from Let's Encrypt through cert-manager's # letsencrypt-prod ClusterIssuer, HTTP-01 — so apply this ONLY after # `dig +short A bikoret.ch` answers 185.19.28.170: a certificate asked # for before the name resolves only burns the failed-validation limit. @@ -98,17 +99,6 @@ spec: name: shorashim port: number: 80 - # The old name, kept until its callers have moved; no certificate asked for it. - - host: shorashim.ch - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: shorashim - port: - number: 80 --- # bikoret.org: the stranger's guess, redirected to the place. No service # of its own; nginx answers the redirect itself. Add its A records too. diff --git a/deploy/k8s/shorashim-ch-takedown.sh b/deploy/k8s/shorashim-ch-takedown.sh new file mode 100755 index 00000000..b9cbbc1a --- /dev/null +++ b/deploy/k8s/shorashim-ch-takedown.sh @@ -0,0 +1,29 @@ +#!/usr/bin/env bash +# Take shorashim.ch down from the cluster and rename Gitea's brand +# (2026-10-20). Run by the transmitter: +# ! bash ~/.local/bin/shorashim-ch-takedown +# Idempotent. +# 1. Ingress `shorashim`: the shorashim.ch host rule is gone (service.yaml). +# The no-host catch-all stays, so http://185.19.28.170/ still answers — +# the name itself dies when its A record is removed at Infomaniak. +# 2. The orphan TLS secret for mcp.shorashim.ch is deleted. +# 3. Gitea APP_NAME "Shorashim" → "Bikoret" (gitea-public-patch.yaml; one restart). +set -euo pipefail +REPO="${REPO:-$HOME/bikoret}" +cd "$REPO" +echo "== 1/3 ingress without the shorashim.ch rule" +kubectl apply -f deploy/k8s/service.yaml +echo "== 2/3 orphan certificate secret for mcp.shorashim.ch" +kubectl -n shorashim delete secret gitea-mcp-tls --ignore-not-found +echo "== 3/3 Gitea brand → Bikoret" +kubectl -n temple-council patch deploy gitea --patch-file deploy/k8s/gitea-public-patch.yaml +kubectl -n temple-council rollout status deploy/gitea --timeout=180s +echo "== verify" +fail=0 +hosts=$(kubectl get ingress -A -o jsonpath='{range .items[*]}{range .spec.rules[*]}{.host}{" "}{end}{end}') +case " $hosts " in *" shorashim.ch "*) echo "FAIL ingress still lists shorashim.ch"; fail=1;; *) echo "ok no ingress rule for shorashim.ch";; esac +case "$(kubectl get secret -A -o name | grep -c 'gitea-mcp-tls$' || true)" in 0) echo "ok gitea-mcp-tls secret gone";; *) echo "FAIL gitea-mcp-tls secret remains"; fail=1;; esac +title=$(curl -sS -m 15 https://git.bikoret.ch/ | grep -o -m1 '[^<]*' || echo none) +case "$title" in *Bikoret*) echo "ok gitea title: $title";; *) echo "FAIL gitea title: $title"; fail=1;; esac +case "$(curl -sS -m 15 -o /dev/null -w '%{http_code}' https://bikoret.ch/kodesh/health || echo err)" in 200) echo "ok bikoret.ch still healthy";; *) echo "FAIL bikoret.ch health"; fail=1;; esac +exit $fail