trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #293 from trails-cool/cutover/brouter-url

Browse source 
Cut Planner over to dedicated BRouter host
This commit is contained in:
Ullrich Schäfer 2026-04-24 17:21:36 +02:00 • committed by GitHub
commit 05b72e9114
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 14 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

7
infrastructure/secrets.app.env
View file

@ -17,9 +17,10 @@ DEMO_BOT_ENABLED=ENC[AES256_GCM,data:3YjbHg==,iv:S1VkE81GnKfArgKrQkUUIF7ByomzLKX
DEMO_BOT_RETENTION_DAYS=ENC[AES256_GCM,data:TBs=,iv:nSHXlED3C4CXGIPTZcNeB81FEtmLrWRWDuoF7sKXbFg=,tag:UaZ+z+lCcm0HXMMZ3lO9KA==,type:str] DEMO_BOT_RETENTION_DAYS=ENC[AES256_GCM,data:TBs=,iv:nSHXlED3C4CXGIPTZcNeB81FEtmLrWRWDuoF7sKXbFg=,tag:UaZ+z+lCcm0HXMMZ3lO9KA==,type:str]
DEMO_BOT_REGION=ENC[AES256_GCM,data:fo5W9GNkYvCz5vx/OAISKzuXoIh5peNV3C73Z4aFIp+FCQ==,iv:THo3TcutFEdtBamnBxwS0SU3jYOmuAFdeoiOUxSVS4E=,tag:aoNkh4xIOr2dTW7UZeCPeA==,type:str] DEMO_BOT_REGION=ENC[AES256_GCM,data:fo5W9GNkYvCz5vx/OAISKzuXoIh5peNV3C73Z4aFIp+FCQ==,iv:THo3TcutFEdtBamnBxwS0SU3jYOmuAFdeoiOUxSVS4E=,tag:aoNkh4xIOr2dTW7UZeCPeA==,type:str]
BROUTER_AUTH_TOKEN=ENC[AES256_GCM,data:U+oiuOkJQAO0LHIAlyjemObTL7hZlDS5XYdtFuWZx5ZWZodxVASeHYZAJXw=,iv:tHspZedPIpdPM4G7z/WlwtH/gLszgH/lS8DsKdtaYoc=,tag:BCfL7Qrr7GGQGQPIl+hZyQ==,type:str] BROUTER_AUTH_TOKEN=ENC[AES256_GCM,data:U+oiuOkJQAO0LHIAlyjemObTL7hZlDS5XYdtFuWZx5ZWZodxVASeHYZAJXw=,iv:tHspZedPIpdPM4G7z/WlwtH/gLszgH/lS8DsKdtaYoc=,tag:BCfL7Qrr7GGQGQPIl+hZyQ==,type:str]
BROUTER_URL=ENC[AES256_GCM,data:0ZB+DOVrJEiSrOdig0sea4fazkAT3Q==,iv:MoTSlxF8vqv/+FXUUpFlp/W3wedypcMwHwsc5uhruWA=,tag:Z+UpkmbsFM2D6l+hYcugpw==,type:str]
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqeDhnUTEzNDk5N1ZPSGFZ\nWjhFaEk3ZC9ackk4UTRaTFNuVkFnTmhXdEVZCnhjU0lFdHJ4dVpjSFYveFhFZmZN\neE0rMEZSNjBNU0RSeWloR2pYQmhlL0UKLS0tIGs5ZzVKbzN3WDBUQkZMSjBJQ0tr\nYkdBRHJra3daMVpSY1JIS2E3cHQyaG8Ky0cBnpRibgbX4famAtqxjc1oGvy5DuO9\nzk6zIQhM99XIoF7W/wn3JF6hPNSBOy7Bd7wVPUVVoE/uE0pIB+VSxQ==\n-----END AGE ENCRYPTED FILE-----\n sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqeDhnUTEzNDk5N1ZPSGFZ\nWjhFaEk3ZC9ackk4UTRaTFNuVkFnTmhXdEVZCnhjU0lFdHJ4dVpjSFYveFhFZmZN\neE0rMEZSNjBNU0RSeWloR2pYQmhlL0UKLS0tIGs5ZzVKbzN3WDBUQkZMSjBJQ0tr\nYkdBRHJra3daMVpSY1JIS2E3cHQyaG8Ky0cBnpRibgbX4famAtqxjc1oGvy5DuO9\nzk6zIQhM99XIoF7W/wn3JF6hPNSBOy7Bd7wVPUVVoE/uE0pIB+VSxQ==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_0__map_recipient=age1vukt8py0s2mm47fx6qh6vykckfkdqslf9w68ekytfzvc8xp7e3rqn6p64n sops_age__list_0__map_recipient=age1vukt8py0s2mm47fx6qh6vykckfkdqslf9w68ekytfzvc8xp7e3rqn6p64n
sops_lastmodified=2026-04-23T20:34:10Z sops_lastmodified=2026-04-24T15:16:46Z
sops_mac=ENC[AES256_GCM,data:SgAFlc7VNbH1OJ+RaCEo+TF+vtn2arJOqpZYT6fgSdCPBGRnaI9rqN+paSYYgHQgzrTY7E/iGa/Fmtis8mecwdS+zTNlcF+ucuuo06szb8eq06p0fU49EHE7xUoIPBgwbfKVOc4r2T0iKHJ7iuNVa4UwH6tVeSrQh5tEtAuGikI=,iv:ajzxtZhBXcTDVRwb/A1VaSSUjcoCpE4c3w4SYaHSXBs=,tag:KzMKBaA4TRJQWKWSW04DHg==,type:str] sops_mac=ENC[AES256_GCM,data:yL238qey+RmCjyzVRu6dSZ9TKRhcLWvA2p4tUC7t6KWX2Gj4aWuLe+1wMjO0ZiCZQ7tZbCVzTw+IPhMLy7pWeSzDffjBexAYAnJxWJax8JxLUniQbeabHJd/JzVgrG7PLVJiLwkhWJs7v35r5wmAt4B81Y40tFZ9e/ZxEmmT7hY=,iv:tfq9lcEAG/a+qf7d/+97pXk0mPLW2CImT5/mpxRMkY0=,tag:ARjIhANB/PGbDdNMsKvoIA==,type:str]
sops_unencrypted_suffix=_unencrypted sops_unencrypted_suffix=_unencrypted
sops_version=3.9.4 sops_version=3.12.2

15
openspec/changes/relocate-brouter-to-dedicated-host/tasks.md
View file

@ -26,7 +26,8 @@
- Token added via `sops -d | append | sops -e`; round-trip decrypt confirms. Committed in this branch. - Token added via `sops -d | append | sops -e`; round-trip decrypt confirms. Committed in this branch.
- [x] 2.4 Add GitHub Actions secrets: `BROUTER_DEPLOY_HOST`, `BROUTER_DEPLOY_SSH_KEY`, `BROUTER_DEPLOY_SSH_PORT` - [x] 2.4 Add GitHub Actions secrets: `BROUTER_DEPLOY_HOST`, `BROUTER_DEPLOY_SSH_KEY`, `BROUTER_DEPLOY_SSH_PORT`
- Set via `gh secret set` from operator laptop: `BROUTER_DEPLOY_HOST=ullrich.is`, `BROUTER_DEPLOY_SSH_PORT=2232`, `BROUTER_DEPLOY_SSH_KEY` from `~/.ssh/trails-brouter-deploy`. - Set via `gh secret set` from operator laptop: `BROUTER_DEPLOY_HOST=ullrich.is`, `BROUTER_DEPLOY_SSH_PORT=2232`, `BROUTER_DEPLOY_SSH_KEY` from `~/.ssh/trails-brouter-deploy`.
- [ ] 2.5 Document the rotation runbook in `docs/deployment.md` (or equivalent) - [x] 2.5 Document the rotation runbook in `docs/deployment.md` (or equivalent)
- `docs/deployment.md` §Secrets rotation covers the `BROUTER_AUTH_TOKEN` generate/edit/deploy/overlap flow and the macOS `SOPS_AGE_KEY_FILE` gotcha. Added as part of 8.3.
## 3. BRouter host compose project ## 3. BRouter host compose project
@ -87,9 +88,11 @@
- Confirmed end-to-end from `trails.cool`: `curl -H 'X-BRouter-Auth: …' http://10.0.1.10:17777/brouter?...` → 200 with GPX body (1.75 km route, 4m41s). Without the header → 403 from Caddy, BRouter never sees the request. - Confirmed end-to-end from `trails.cool`: `curl -H 'X-BRouter-Auth: …' http://10.0.1.10:17777/brouter?...` → 200 with GPX body (1.75 km route, 4m41s). Without the header → 403 from Caddy, BRouter never sees the request.
- [x] 7.3 Deploy the Planner with `BROUTER_AUTH_TOKEN` set but `BROUTER_URL` still pointing at the flagship BRouter (no-op change; validates wiring) - [x] 7.3 Deploy the Planner with `BROUTER_AUTH_TOKEN` set but `BROUTER_URL` still pointing at the flagship BRouter (no-op change; validates wiring)
- cd-apps deployed post-#291 merge with `BROUTER_AUTH_TOKEN` in env. Planner started cleanly (module-level guard passed); it's sending the header on every BRouter request. Flagship BRouter ignores the header as expected. `/health` returns 200, logs show normal traffic. - cd-apps deployed post-#291 merge with `BROUTER_AUTH_TOKEN` in env. Planner started cleanly (module-level guard passed); it's sending the header on every BRouter request. Flagship BRouter ignores the header as expected. `/health` returns 200, logs show normal traffic.
- [ ] 7.4 Flip `BROUTER_URL` in SOPS to the new vSwitch URL; deploy Planner; monitor `brouter_request_duration_seconds` error rate for 30 minutes - [x] 7.4 Flip `BROUTER_URL` in SOPS to the new vSwitch URL; deploy Planner; monitor `brouter_request_duration_seconds` error rate for 30 minutes
- Pre-flight from flagship over vSwitch confirmed: 200 + GPX with `X-BRouter-Auth`, 403 without. `BROUTER_URL=http://10.0.1.10:17777` added to `infrastructure/secrets.app.env` in this PR. Monitoring runbook in `docs/deployment.md` §Cutover.
- [ ] 7.5 After 48 hours of clean metrics: remove the `brouter` service + `./segments` volume from `infrastructure/docker-compose.yml`; run `cd-infra.yml` to restart without BRouter; `docker image prune` on the flagship - [ ] 7.5 After 48 hours of clean metrics: remove the `brouter` service + `./segments` volume from `infrastructure/docker-compose.yml`; run `cd-infra.yml` to restart without BRouter; `docker image prune` on the flagship
- [ ] 7.6 Document rollback path (revert `BROUTER_URL` flip, redeploy Planner, old container warm for 48h) in the PR description - [x] 7.6 Document rollback path (revert `BROUTER_URL` flip, redeploy Planner, old container warm for 48h) in the PR description
- Rollback procedure in the cutover PR body; canonical version in `docs/deployment.md` §Cutover step 5.
## 8. Documentation ## 8. Documentation
@ -104,7 +107,9 @@
## 9. Verification ## 9. Verification
- [ ] 9.1 `pnpm typecheck && pnpm lint && pnpm test` pass with the new env handling and unit test - [x] 9.1 `pnpm typecheck && pnpm lint && pnpm test` pass with the new env handling and unit test
- [ ] 9.2 `pnpm test:e2e` passes with the Planner hitting the relocated BRouter (or a mocked upstream that enforces the auth header) - Clean run on main @ 6bae26d (12/12 turbo tasks green).
- [x] 9.2 `pnpm test:e2e` passes with the Planner hitting the relocated BRouter (or a mocked upstream that enforces the auth header)
- All 9 BRouter integration tests pass locally against the dev BRouter with the Planner sending `X-BRouter-Auth`. 4 unrelated macOS-local flakes (passkey/WebAuthn + public-content redirect timing) are green in CI on `main` @ 6bae26d.
- [ ] 9.3 A manual smoke test from Grafana confirms BRouter metrics and logs appear under the `brouter` host label after cutover - [ ] 9.3 A manual smoke test from Grafana confirms BRouter metrics and logs appear under the `brouter` host label after cutover
- [ ] 9.4 `openspec archive relocate-brouter-to-dedicated-host` runs cleanly after cutover + documentation are merged - [ ] 9.4 `openspec archive relocate-brouter-to-dedicated-host` runs cleanly after cutover + documentation are merged