Tag
#operations
29 pages tagged #operations.
Operations operations/ 29 pages
The ad-hoc command and ansible verbs under the same governance as a play, and tolerating an unreachable roaming host instead of paging.
The handoff mirrored: the ansible play first and then the tofu apply, as one ledger workflow with a manual credential handoff between them.
The image and Quadlet deploy, the six-screen idempotent wizard, node-zero self-management, the separately versioned recovery script, and the adoption runbooks for an existing homelab.
Taking over a replicated store on a standby host, with an optional Litestream fast-forward and a cross-host active lease that keeps a resurrected primary from double-activating.
The base image and what it carries, running it as shipped, inheriting to add system packages or Python dependencies, offline and multi-arch builds, and capturing an operator image for recovery.
The phone companion pairing payload a QR code carries, rendered on the token result page and by the token command, plus setting the public URL.
What is backed up, the three legs, the recovery chain, the runbook for a dead host, the recovery card, failure modes, RPO and RTO, and verification.
Cordoning a running daemon so it fires no schedules and claims no new jobs while in-flight work finishes, then polling whether it is safe to reboot.
Login and the remote flag: certificate pinning, precedence, pinned reads, writes that enqueue on the other box, following a job live, and the inputs that do not cross the wire.
Writing CEL policies over a plan, denying a dangerous plan at seal so its apply refuses, and routing an apply through the approval gate.
The run type for work that is neither ansible nor tofu: an allow-listed binary under the same queue, sandbox, run-secret and approval governance.
Minting bearer tokens and serving the TLS web and phone approval surface, separate from the loopback state backend.
Building the exocomp.dev landing page together with the rendered docs bundle, with podman or with a CI toolchain, and the Cloudflare build that publishes them.
The json output envelope, the error taxonomy, the exit-code table and what of it reaches the process today, and MCP over HTTP as the third face.
Vendoring ansible collections and OpenTofu providers so a run does not depend on Galaxy or the tofu registry being reachable.
The software release narrative of features, fixes and behaviour changes, newest first, kept separate from the knowledge-base evolution log.
The playbook run flags, where extra-var values live, and config drift as a check or schedule outcome.
A source hooks file of ordered pre and post run steps and a declared-probe health gate, composed into one ledger workflow.
One resumable four-step ledger chain of apply, bounded SSH wait, seeded onboarding and configure play, plus the standing inventory a schedule targets by name.
Pointing a monitor at the hooks, sealing the push transport, writing rules, silencing, answering approvals, and asking why a rule did not fire.
The database-backed registry for the deferred container tier: definitions only, with nothing executing them yet.
The serve flags, the signal contract, the single-instance lock, and what the CLI does while a daemon is up.
A sensitive output sealed into the envelope and bound to an env name, so the play receives it without anything copied by hand.
The first-run wizard, the ntfy push transport, the muted versus paused holds, and the metrics staleness gauges.
Registering git, host and volume sources, inventories and the run-secret credential binding, plus the fleet key and host onboarding.
Chaining a tofu apply to an ansible play as one ledger workflow, with the workspace declared non-sensitive outputs becoming the play inventory.
The read and write routes on the LAN listener, the wire envelope, idempotency, and the error-code-to-HTTP-status table.
The single agent MCP surface: connecting an agent, what each scope is advertised, why there is no session id, and what never travels.
Upgrade and rollback as a ledger choreography of snapshot, stage, verify, swap and health-check, rolling back to the snapshot and prior binary on any failed step, with no sudo.