Skip to content

Reddit Pipeline browser configuration — 2026-11-03

TL;DR

Prepared source wiring for the browser-owned Pipeline supervisor, with Start explicitly off by default and existing roles preserved. Work is isolated from the dirty primary checkout on a branch from freshly fetched main 21f68651; no live inspection, image build, merge, deployment, migration or canary was performed. Follow-up source preparation now pins the qualified Pipeline release and includes the explicit web-only migration hold overlay; neither has been applied.

Scope and status

Workstream Status
Web retrieval environment and read-only existing key/trust mounts Implemented in source
Protected Start setting: absent defaults to 0, explicit 0/1 preserved Implemented with fail-closed validation
Regression coverage: mapping, mounts, roles, render/Compose precedence Added; local results recorded in PR
README operational gates Documented; not executed
Qualified main image pin and versioned schema22 web hold overlay Prepared in source; exact-main CI verified successful
Host image build/verification, actual drift, schema22 and canary Pending future authorized rollout; SSH blocked

References: app rollout tracking #148, Pipeline runtime #168, corrective rollout docs #170. The supplied #170 worktree runbook was read in full; it describes bounded web children, not extra Compose services or a supported retrieval-worker server role.

Configuration decision

The service README contains the complete operational gates. Ansible's existing whrrr-reddit-explorer/defaults/main.yml verifies the mapping: /volume9/Prawns/4. Reddit/_reddit-explorer → /mnt/whrrr-reddit-library → /library. Retrieval uses the existing approved SSH target someone@192.168.6.215, port 65222, and NAS Python /var/services/homes/someone/bin/python3.

Web gains the same existing host key and pinned trust as Property, mounted as read-only individual files with missing-source refusal. No key/trust bytes, new credential, broader NFS export, ACL change or root runtime is introduced. This intentionally expands web's credential access for its Retrieval children; media/init remain without credential mounts. UID/GID 10001, supplementary GID 100, external Property jobs, gallery ownership and role commands stay intact. Web and Property now share the full-SHA local Pipeline release tag; other roles stay stopped.

Outside the explicit migration override, Start comes from generated compose.env: absent encrypted input defaults to 0; explicit 0 / 1 is preserved; invalid/duplicate values fail before replacing the existing output. No Compose environment override or shell interpolation shadows an approved enable. A durable change requires the protected SOPS input, render, private validation and targeted recreation; editing the generated file is not persistent. Runner enablement remains child/individual-command-only.

flowchart TD
    A[Protected config: starts0] --> B[Drain and verified recovery set]
    B --> C[Qualified image and reviewed hold1 web config]
    C --> D[Web-only migration: schema22 and held health]
    D --> E[Approve starts1 and hold0 web recreation]
    E --> F[Browser Start: bounded supervisor in web]
    F --> G[Discovery and Retrieval children]
    G --> H[One limit5 canary: readable file and settled liability]
    H --> I[Separate approval to reintroduce legacy roles]

Known gaps and drift

  • Main runtime CI 41701696683 is verified completed/success for 438ff367abce0fbe8967959d8c74aef9d5a91665. Web/Property now pin reddit-explorer:release-438ff367abce0fbe8967959d8c74aef9d5a91665-pipeline, retaining pull_policy: never. It has not been built or verified on the host. Exact-commit Git archive build, label/static-content/ID verification and no-tag- replacement requirements are documented in the service README. No implicit build.
  • compose.pipeline-schema22-hold.yml explicitly overrides only web to hold1 / starts0. Effective Compose tests require the same web/Property image, all other service configs unchanged, and held starts0 even with protected starts1. The normal base config still preserves protected Start values without interpolation.
  • README historical live observations are not today's production evidence. Private override files, stopped roles and effective runtime config need reconciliation in memory, without exposing DSNs, cookies, key or trust contents.
  • Compose explicitly overrides hold to 0 on web/Property; env-file hold 1 alone is not a migration hold. The versioned overlay and explicit web-only recreation are mandatory; a general/unconditional stack deploy is not this gate.
  • Source checks cannot prove UID/GID traversal/read/write permissions, SSH trust persistence/login, NAS watchdog/native publication or current DB/WAL capacity.
  • Schema22 is not safely downgraded by reverting an image. Preserve uncertain evidence, fences and reservations; recovery must reconcile DB/files/journals.

Remaining operator work

These are gates for a future approved rollout, not actions performed here:

  • [ ] Release owner, before merge/deploy: verify app #170 runbook availability, review the qualified full-SHA pin/hold overlay, build and verify the image using recorded provenance/ID; hold automatic/independent deployment writers and reconcile private/live drift. Public SSH is blocked by an unknown host key; owner ping was already sent. Independently verify trust before any host command, never bypass strict host checking. No production command was attempted here.
  • [ ] Operator/DB owner, before migration: prove native drain and backup restore into a disposable DB, record baseline liabilities and headroom, validate actual NFS/NAS/key/trust access privately as the app identity; preserve #132 evidence.
  • [ ] Release operator, during the approved window: use web-only hold 1 / starts 0 migration startup, verify schema22/held health and preserved evidence, then deliberately render starts 1 and recreate web with hold 0 for one limit-5 canary.
  • [ ] Release owner, before wider work: record safe-reader result, settled successful reservation, Pause/Resume, resource checks and go/stop in #148; approve legacy role reintroduction separately. No cleanup or irreversible evidence repair.