CluPilotCloud

Commit Graph

Author	SHA1	Message	Date
nexxo	9f8659da32	fix(hosts): a failed DNS deletion must not orphan the record Swallowing it and carrying on deleted the row that held the only reference to that record, publishing the machine's management address for good. The purge now fails instead — and is retried, since it re-reads the host and its other steps are idempotent — so a broken DNS provider becomes a visible failed job rather than a silent leak. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-25 23:53:14 +02:00
nexxo	5db2f7fda7	feat(hosts): give each host a DNS name under the public zone fsn-01.node.clupilot.com, numbered per datacenter and never reused — removing a host must not renumber its neighbours onto its name, so the number is stored rather than derived. The record points at the host's WireGuard address, not its public IP: the name exists so an operator can reach a host by name over the VPN, and publishing a Proxmox host's public address would hand every scanner a target, which is the one thing this network design avoids. DNS is convenience, not a prerequisite: a failure logs an event and lets the onboarding finish rather than stranding a host that is otherwise ready. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-25 23:49:18 +02:00
nexxo	446da58061	feat(engine-b): 15-step customer pipeline + DNS/Traefik services validate->reserve(placement)->clone->cloudinit->start->guestagent->network-> deploy->nextcloud->admin->dns/tls->backup->monitoring->acceptance->complete. HetznerDnsClient + TraefikWriter (interface+fake+real), CloudReady notification, hosts.node (set by RegisterCapacity). Secrets transient/encrypted, never plaintext. 21 tests incl. mocked end-to-end + crash idempotency. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-25 11:50:26 +02:00

Author

SHA1

Message

Date

nexxo

9f8659da32

fix(hosts): a failed DNS deletion must not orphan the record

Swallowing it and carrying on deleted the row that held the only reference to
that record, publishing the machine's management address for good. The purge now
fails instead — and is retried, since it re-reads the host and its other steps
are idempotent — so a broken DNS provider becomes a visible failed job rather
than a silent leak.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-25 23:53:14 +02:00

nexxo

5db2f7fda7

feat(hosts): give each host a DNS name under the public zone

fsn-01.node.clupilot.com, numbered per datacenter and never reused — removing a
host must not renumber its neighbours onto its name, so the number is stored
rather than derived.

The record points at the host's WireGuard address, not its public IP: the name
exists so an operator can reach a host by name over the VPN, and publishing a
Proxmox host's public address would hand every scanner a target, which is the
one thing this network design avoids.

DNS is convenience, not a prerequisite: a failure logs an event and lets the
onboarding finish rather than stranding a host that is otherwise ready.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-25 23:49:18 +02:00

nexxo

446da58061

feat(engine-b): 15-step customer pipeline + DNS/Traefik services

validate->reserve(placement)->clone->cloudinit->start->guestagent->network->
deploy->nextcloud->admin->dns/tls->backup->monitoring->acceptance->complete.
HetznerDnsClient + TraefikWriter (interface+fake+real), CloudReady notification,
hosts.node (set by RegisterCapacity). Secrets transient/encrypted, never
plaintext. 21 tests incl. mocked end-to-end + crash idempotency.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-25 11:50:26 +02:00

3 Commits (9f8659da326fb8a0d20f740ba7ed44d9f4865c87)