makearmy/le-app
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

harden Phase 2B Stage 1 installation state

Browse source
This commit is contained in:
makearmy 2026-07-12 22:34:04 -04:00
parent 82e64cec43
commit df6b53e639
10 changed files with 1062 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/le-app-database-migration/phase2b-contained-runtime/INSTALL-ORDER.md
View file

@ -2,11 +2,11 @@
Every numbered boundary requires review and explicit approval. Nothing here authorizes execution.
1. From this directory, run only `tests/00-root-preinstall-validate.sh` as root and require zero failures. It atomically checks both manifests, staged nftables/systemd/shell/JSON, exact Phase 1 ownership/modes, absent approval marker/installed payload/manager/process/socket/linger, and public/NAT address drift. Save output outside production.
1. Review the passing non-mutating `tests/32-stage1-state-tests.sh` results and the shared state implementation in `tests/stage1-state-lib.sh`. Then, from this directory, run only `tests/30-install-stage1.sh` as root and require zero failures. It invokes `tests/00-root-preinstall-validate.sh`, checks both manifests, requires all 16 destination files absent, validates shared parents, installs only static Stage 1 files, and atomically advances immutable checksummed state generations from `IN_PROGRESS` to `COMPLETE`. It does not create the approval marker or perform any reload/start/network action.
2. Preserve the approved Quad9 DNS pair `9.9.9.9` and `149.112.112.112`, observed public/NAT address denial `74.67.173.56`, and verified root inventory. Quad9 requires no LAN exception; `192.168.10.1` remains denied. Any different value or public/NAT drift requires artifact edits, a new manifest, and another review.
3. Copy only the manifest-listed launcher to `/usr/local/libexec`, mode `0755`, `root:root`; rehash the installed file.
4. Copy only the slice and `user@1200.service` drop-ins, resolver file, namespace helper/unit, and nftables fragment to their manifest paths with `root:root`, directories/files `0755/0644`, helper `0755`. After exact-value approval, create root-owned mode `0644` `/etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED` containing the artifact-manifest checksum and approval timestamp. Do not start anything. Run `systemd-analyze verify` and `nft --check -f`; inspect the merged `systemctl cat`/properties.
5. Copy the Docker user unit/config/context and tests below `/srv/le-app-codex`; set directories `0750`, config/unit/tests `0640` except tests `0750`, all owned `1200:1200`. Do not create credentials, checkout, or source copies.
3. Resolve `/var/lib/le-app-codex-phase2b/stage1/current` as a strict local generation name and review that generation's `manifest` and `manifest.sha256`; require `COMPLETE`, source commit, artifact-manifest digest, hostname, timestamp, 16 completed file records, no pending records, and every reached directory disposition to match the installer output.
4. Do not create `/etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED` during Stage 1. Do not run `systemctl daemon-reload`, load nftables, create the namespace, or start/enable anything.
5. Review installed owner/mode/size/hash evidence. Docker user configuration and the five acceptance/preflight scripts must be owned by `1200:1200`; tests are `0750`, configs/unit `0640`. No credentials, checkout, or source copies are installed.
6. Run `systemctl daemon-reload`. Confirm the user manager remains inactive, lingering absent, and socket/process absent.
7. Start only `le-app-codex-netns.service`. Inspect namespace identity, IPv4-only addresses/routes, nftables counters/rules, host routing, and production Docker health. Stop on any drift.
8. Run `tests/run-inert-without-user-manager.sh`. This starts only a finite transient test process, never `user@1200.service`, Docker, or Codex. Require every filesystem/process/cgroup/device/socket/network assertion to pass.