makearmy/le-app
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add Phase 2A host maintenance procedure

Browse source
This commit is contained in:
makearmy 2026-07-12 16:10:24 -04:00
parent 13ec935e87
commit 2cf249d6f2
9 changed files with 1119 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/le-app-database-migration/host-runtime-plan.md
View file

@ -52,11 +52,13 @@ pacman -Syu --needed rootlesskit slirp4netns openai-codex
was a 221-package full host upgrade affecting both installed kernels and OpenSSH. It is a host-maintenance operation requiring a fresh exact transaction preview, reboot planning, service-health checks, `.pacnew` review, and separate operator approval. A partial Arch upgrade is not acceptable.
The unresolved package paths are:
The package paths are:
1. schedule and approve the complete refreshed host upgrade; or
2. investigate clean-chroot, checksum-pinned packages compatible with the current system, without partially upgrading repository packages.
The operator provisionally selected Path A on 2026-07-12 as the preferred Phase 2 package path because it is the shortest safe route consistent with Arch's complete-upgrade model. This records planning direction only: the transaction, maintenance window, package execution, and reboot remain separately approval-gated. The uncommitted review package is under `docs/le-app-database-migration/phase2a-host-maintenance/`.
Do not install the unmodified AUR `docker-rootless-extras` package. Its install hook reloads global sysctls, which exceeds this project's boundary. Do not curl an installer into a shell.
Install only a reviewed Moby `contrib/dockerd-rootless.sh` matching the Docker engine actually installed after the chosen package path. At the current checkpoint Docker is `29.6.1`; the candidate is:
@ -311,7 +313,7 @@ Never recursively copy or `rsync` the nonproduction workspace into production. C
## Unresolved decisions checklist
- Phase 2 package path: scheduled full host maintenance or clean-chroot/current-system-compatible investigation.
- Phase 2 package path: Path A is provisionally preferred; package execution and reboot are not approved.
- Approved DNS resolver IPv4 addresses; `192.168.10.1` is currently observed but not approved.
- Complete current host, public/NAT, LAN, management, VPN, WireGuard, Docker bridge, and other container-network inventory.
- Codex authentication: device authentication or dedicated API key.