makearmy/le-app
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
le-app/docs/le-app-database-migration/phase2a-host-maintenance/reboot-procedure.md

2.7 KiB
Raw Blame History

Separate reboot procedure

This procedure begins only after successful package execution and review of its unique maintenance record. It never reboots automatically. Maintenance and validation records are atomic unique root-owned mode 0700 directories. They can contain sensitive operational metadata and must not be committed.

Pre-reboot verification

Set the exact record path printed by execute-maintenance.sh:

record=/var/log/le-phase2a-maintenance/maintenance.YYYYMMDDTHHMMSSZ.XXXXXXXX
test -d "$record" || { printf 'STOP: invalid record path\n' >&2; return 1; }

Record the running kernel and review installed kernel packages:

uname -a | tee "$record/running-kernel-immediately-before-reboot.txt"
pacman -Q linux linux-headers linux-zen linux-zen-headers |
  tee "$record/installed-kernels-immediately-before-reboot.txt"

Verify both new module trees, kernel images, and nonempty initramfs files:

find /usr/lib/modules /boot -maxdepth 2 -type f \
  \( -name vmlinuz -o -name 'vmlinuz-*' -o -name 'initramfs*' -o -name 'initrd*' -o -name pkgbase \) \
  -printf '%p size=%s mtime=%TY-%Tm-%TdT%TH:%TM:%TS\n' |
  sort | tee "$record/verified-kernel-initramfs-files.txt"

find /boot -maxdepth 1 -type f \
  \( -name 'vmlinuz-*' -o -name 'initramfs*' -o -name 'initrd*' \) -size 0 -print

Any zero-length artifact is a hard stop. Review DKMS and package hook output:

dkms status | tee "$record/dkms-immediately-before-reboot.txt"
systemctl --failed --no-pager | tee "$record/failed-units-immediately-before-reboot.txt"
sed -n '1,240p' "$record/hook-restart-summary.txt"

Confirm bootloader state without changing it:

bootctl status 2>&1 | tee "$record/bootctl-status-before-reboot.txt"
find /boot/loader/entries -maxdepth 1 -type f -print -exec sed -n '1,160p' {} \; 2>/dev/null |
  tee "$record/systemd-boot-entries-before-reboot.txt"

grub-install --version 2>&1 | tee "$record/grub-version-before-reboot.txt"
test -f /boot/grub/grub.cfg &&
  grep -E "^menuentry |^submenu |linux.*vmlinuz|initrd" /boot/grub/grub.cfg |
  tee "$record/grub-entries-before-reboot.txt"

The operator must identify and record both the intended new-kernel entry and a known-good previous-kernel/fallback entry. Stop if boot entries or initramfs references are missing, DKMS failed, storage is degraded, backups are unavailable, SSH is unstable, or production is unhealthy.

Separately approved reboot command

Only after explicit approval for this exact reboot:

sudo systemctl reboot

Do not embed this command in the maintenance script, a timer, at, a shell trap, or a command chain. Keep independent console access open and proceed to post-reboot-validate.sh after the host returns.