From 9b799c5ea2acb33048c38c61ebf2e21e365af281 Mon Sep 17 00:00:00 2001 From: Nik Afiq Date: Mon, 24 Aug 2026 23:00:40 +0900 Subject: [PATCH] docs: drop stale rollback-file references now that rollback/ is removed qbittorrent.yaml and jdownloader.yaml's own header comments still pointed at manifests/media/rollback/*-gluetun.yaml and described the migration as pending approval/preconditions - both are live and validated now, and that directory is being removed (no kept on-disk Gluetun copy). Rewrite both headers as a status note instead, pointing rollback at git history (with the exact pre-migration commit) to match the root README's rollback table, which gets the same exact-commit treatment here instead of the vaguer reference from the previous commit. Co-Authored-By: Claude Sonnet 5 --- README.md | 3 ++- manifests/media/jdownloader.yaml | 34 ++++++++++++-------------- manifests/media/qbittorrent.yaml | 42 +++++++++++--------------------- 3 files changed, 32 insertions(+), 47 deletions(-) diff --git a/README.md b/README.md index e2b9ed0..4fabdf7 100644 --- a/README.md +++ b/README.md @@ -251,7 +251,8 @@ piece's own README for exact commands and rollback: | Minisforum PIA gateway (WireGuard, policy routing, kill switch, health check) | `ansible/roles/pia-gateway/` | that role's README | | nik-debian VLAN 50 parent (`enp1s0.50`) | `ansible/roles/vlan50-parent/` | that role's README | | Multus, VLAN 50 NAD, canary | `manifests/multus/` (manual-sync Argo CD Application) | that directory's README | -| qBittorrent / JDownloader VLAN 50 attachment | `manifests/media/qbittorrent.yaml`, `jdownloader.yaml` | no file-based copy kept — restore the pre-migration Gluetun manifest from git history (`git show :manifests/media/qbittorrent.yaml`, likewise for jdownloader.yaml) and `kubectl apply` it; both migration commits are tagged in their own message | +| qBittorrent VLAN 50 attachment | `manifests/media/qbittorrent.yaml` | no file-based copy kept — `git show 28d0628:manifests/media/qbittorrent.yaml \| kubectl apply -f -` restores the last pre-migration (Gluetun-based) version | +| JDownloader VLAN 50 attachment | `manifests/media/jdownloader.yaml` | same approach — `git show 2f7ec5f:manifests/media/jdownloader.yaml \| kubectl apply -f -` | **Boot ordering** (minisforum): `pia-killswitch.service` seeds the closed routing/firewall state and is ordered `Before=` `wg-quick@pia-wg.service`; diff --git a/manifests/media/jdownloader.yaml b/manifests/media/jdownloader.yaml index 8bb1b62..8826abb 100644 --- a/manifests/media/jdownloader.yaml +++ b/manifests/media/jdownloader.yaml @@ -2,24 +2,22 @@ # Delete: kubectl delete -f manifests/media/jdownloader.yaml # Description: JDownloader deployment with Ingress at jdownloader.home.arpa. # -# *** VLAN 50 MIGRATION — DO NOT PUSH TO main WITHOUT SEPARATE, EXPLICIT -# APPROVAL — AND ONLY AFTER qBittorrent (manifests/media/ -# qbittorrent.yaml) HAS BEEN LIVE, VALIDATED, AND SOAKED. plan.md is -# explicit: migrate qBittorrent first, soak, then JDownloader, -# independently soaked — do not batch them. *** -# Same VLAN 50/Multus design as qbittorrent.yaml (see that file's header -# for the full precondition list — pia-gateway, vlan50-parent, and -# manifests/multus/ all applied and verified first). One difference: -# JDownloader has no reliably-persistent, file-editable interface-bind -# setting the way qBittorrent's qBittorrent.conf does (its own -# preferences aren't a simple INI this repo can safely patch), so this -# migration relies on the network-namespace egress guard alone for -# enforcement, exactly as plan.md anticipates for JDownloader -# specifically ("application-level interface binding may be weaker or -# unavailable... the namespace egress guard is mandatory"). -# `media` has selfHeal+automated sync already configured — pushing this -# file deploys it immediately. Rollback copy, not synced by any -# Application: manifests/media/rollback/jdownloader-gluetun.yaml. +# VLAN 50 MIGRATION — live since 2026-08-24, migrated after qBittorrent +# was live, validated, and soaked (plan.md's explicit ordering — the two +# were deliberately not batched). Same VLAN 50/Multus design as +# qbittorrent.yaml — see the root README's "VPN VLAN 50" section for the +# full status/runbook. One difference: JDownloader has no +# reliably-persistent, file-editable interface-bind setting the way +# qBittorrent's qBittorrent.conf does (its own preferences aren't a +# simple INI this repo can safely patch), so this migration relies on the +# network-namespace egress guard alone for enforcement, exactly as +# plan.md anticipated for JDownloader specifically ("application-level +# interface binding may be weaker or unavailable... the namespace egress +# guard is mandatory") — confirmed live via this workload's own +# fail-closed kill-switch test. `media` has selfHeal+automated sync — any +# future push to this file deploys immediately. No pre-migration Gluetun +# copy is kept on disk; roll back via git history instead — see the root +# README's Rollback table for the exact commit. apiVersion: apps/v1 kind: Deployment metadata: diff --git a/manifests/media/qbittorrent.yaml b/manifests/media/qbittorrent.yaml index 6e8bbd3..722c6fc 100644 --- a/manifests/media/qbittorrent.yaml +++ b/manifests/media/qbittorrent.yaml @@ -2,35 +2,21 @@ # Delete: kubectl delete -f manifests/media/qbittorrent.yaml # Description: qBittorrent deployment with Ingress at qbittorrent.home.arpa. # -# *** VLAN 50 MIGRATION — DO NOT PUSH TO main WITHOUT SEPARATE, EXPLICIT -# APPROVAL, EVEN IF OTHER FILES IN THIS SESSION HAVE ALREADY BEEN -# PUSHED *** -# This Deployment now attaches VLAN 50 (net1, 10.10.50.10) via Multus -# instead of running a per-pod Gluetun/OpenVPN sidecar — PIA egress is now -# minisforum's job (ansible/roles/pia-gateway), reached through +# VLAN 50 MIGRATION — live since 2026-08-24, validated end to end +# (Phase 5 canary matrix plus this workload's own fail-closed kill-switch +# test: stopping wg-quick@pia-wg on minisforum stops its egress, no +# fallback to eth0). This Deployment attaches VLAN 50 (net1, 10.10.50.10) +# via Multus instead of running a per-pod Gluetun/OpenVPN sidecar — PIA +# egress is minisforum's job (ansible/roles/pia-gateway), reached through # nik-debian's enp1s0.50 (ansible/roles/vlan50-parent) and the Multus NAD -# (manifests/multus/10-nad-vlan50.yaml). Preconditions before this can -# ever be pushed live, per plan.md's phasing: -# 1. ansible/roles/pia-gateway and ansible/roles/vlan50-parent applied -# and independently verified live. -# 2. manifests/multus/ synced (00 through 10) and its own health -# confirmed — the initContainer below depends on the -# vlan50-egress-guard-script ConfigMap that lives in that -# Application, not this one; Argo CD does not enforce that -# cross-Application ordering automatically. -# 3. The Phase 5 canary (manifests/multus/20-canary.yaml) has passed -# the full validation/failure-test matrix in plan.md, including -# packet-capture proof of the kill switch and restart behavior. -# `media` (this file's Application) has selfHeal+automated sync already -# configured — pushing this file to main deploys it immediately, with no -# separate "sync" gate. The previous Gluetun-based Deployment is kept, -# unmodified, at manifests/media/rollback/qbittorrent-gluetun.yaml — that -# subdirectory is deliberately NOT synced by this Application (media.yaml -# has no directory.recurse: true, so it only ever looks at files directly -# in manifests/media/, never in manifests/media/rollback/) — for fast -# manual rollback: kubectl apply -f manifests/media/rollback/ -# qbittorrent-gluetun.yaml. See that file's own header for the full -# rollback procedure. +# (manifests/multus/10-nad-vlan50.yaml); see the root README's "VPN VLAN +# 50" section for the full status/runbook. `media` (this file's +# Application) has selfHeal+automated sync — any future push to this file +# deploys immediately, no separate "sync" gate. No pre-migration Gluetun +# copy is kept on disk; roll back via git history instead (`git show +# :manifests/media/qbittorrent.yaml`, then +# `kubectl apply -f -`) — see the root README's Rollback table for the +# exact commit. apiVersion: v1 kind: Namespace metadata: