Scott KarpandClaude Fable 5.1
354e223384
From a reading of the gate's documents (2026-10-21): - AGENTS.md: Steps 14 and 15 shown Pending while the Port and both sockets have carried live traffic since the gate was built → Done, with what carries them; "next build task" now points at the open items, the phase tables being complete. - README.md: the repository tree omitted azazel_processor, kushya_generator, mesorah, src/tools and scripts → listed, each in a line. - deploy/ARCHITECTURE.md: the judgment path holds no model, said in writing — the examination is Python patterns and Prolog rules, the judges consult that Prolog; kushya_generator (a fine-tuned model in this repo, not deployed, not wired) is an OFFERER whose output is examined, never a component the bedikah, the engine or a judge consults. The kohen is not the offerer. azazel_processor listed. - The map: the repository is public; eleven files named the ingress NLB's literal address and five the kohen's kubeconfig path. Docs now use the domains (git.bikoret.ch, bikoret.ch) or "<NLB-IP>" with the kubectl query that answers it; the kubeconfig is "$KUBECONFIG" / "$HOME/.kube/<your-cluster>.yaml". gitea-public-apply.sh takes NLB from the environment. None of it was a secret; all of it was a map. - OTP pin: checked, not changed — the segfault in the build log was a source-built OTP 26.2.1 on macOS; the image is hexpm's 26.2.1 with ERL_FLAGS +JMsingle. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
41 lines
2.1 KiB
Bash
Executable File
41 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Move Gitea and its MCP server to public HTTPS on bikoret.ch and switch
|
|
# the MCP server to MCP OAuth (2026-10-19). Run by the transmitter:
|
|
# ! bash ~/.local/bin/gitea-public-apply
|
|
# Idempotent. Needs DNS first: git.bikoret.ch and mcp.bikoret.ch → <NLB-IP>.
|
|
#
|
|
# Rollback (static-token mode on mcp.shorashim.ch, as before 2026-10-19):
|
|
# kubectl -n temple-council set env deploy/gitea \
|
|
# GITEA__server__ROOT_URL=http://gitea.temple-council.ch/ \
|
|
# GITEA__server__DOMAIN=gitea.temple-council.ch GITEA__server__SSH_DOMAIN-
|
|
# then restore deploy/k8s/gitea-mcp-*.yaml from commit 861cd4e6 and apply them.
|
|
set -euo pipefail
|
|
REPO="${REPO:-$HOME/bikoret}"
|
|
cd "$REPO"
|
|
NLB="${NLB:?set NLB to the ingress address: kubectl get svc -n ingress-nginx ingress-nginx-controller}"
|
|
for h in git.bikoret.ch mcp.bikoret.ch; do
|
|
ip=$(dig +short "$h" | tail -1 || true)
|
|
if [ "$ip" != "$NLB" ]; then
|
|
echo "DNS: $h → '${ip:-nothing}' (need $NLB). Add the A record at Infomaniak first." >&2
|
|
exit 2
|
|
fi
|
|
done
|
|
echo "== 1/4 ingresses (certificates issue once DNS resolves)"
|
|
kubectl apply -f deploy/k8s/gitea-ingress.yaml
|
|
kubectl apply -f deploy/k8s/gitea-mcp-ingress.yaml
|
|
echo "== 2/4 Gitea ROOT_URL → https://git.bikoret.ch/ (one restart)"
|
|
kubectl -n temple-council patch deploy gitea --patch-file deploy/k8s/gitea-public-patch.yaml
|
|
kubectl -n temple-council rollout status deploy/gitea --timeout=180s
|
|
echo "== 3/4 gitea-mcp in OAuth mode at https://mcp.bikoret.ch"
|
|
kubectl apply -f deploy/k8s/gitea-mcp-deployment.yaml
|
|
kubectl -n shorashim rollout status deploy/gitea-mcp --timeout=120s
|
|
echo "== 4/4 certificates"
|
|
for i in $(seq 1 24); do
|
|
ready=$(kubectl get certificate -A -o jsonpath='{range .items[?(@.metadata.name=="gitea-bikoret-tls")]}{.status.conditions[?(@.type=="Ready")].status}{end}{range .items[?(@.metadata.name=="gitea-mcp-bikoret-tls")]}{.status.conditions[?(@.type=="Ready")].status}{end}' 2>/dev/null || true)
|
|
[ "$ready" = "TrueTrue" ] && break
|
|
sleep 5
|
|
done
|
|
kubectl get certificate -A | grep -E "NAME|bikoret"
|
|
echo "== verify"
|
|
bash "$REPO/deploy/k8s/gitea-public-verify.sh"
|