docs: publish Preview 19 dogfood evidence
Export the reviewed allowlisted snapshot from private source commit 05928cebd01b586cf9e9d4b8c8537a7605a6068c. This records the exact candidate, bounded capacity result, stateful migration scratch requirement, authenticated batch identity proof, and immediate live acceptance evidence. AI-Assisted: OpenAI Codex Signed-off-by: Cole Speelman <crspeelman@gmail.com>
This commit is contained in:
@@ -0,0 +1,26 @@
|
||||
# SPDX-License-Identifier: AGPL-3.0-only
|
||||
observatory.gamertan.com {
|
||||
@responseBody method GET
|
||||
encode @responseBody zstd gzip
|
||||
header Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
||||
log observatory_access {
|
||||
output file /var/log/caddy/observatory-access.jsonl {
|
||||
mode 0640
|
||||
roll_size 100mb
|
||||
roll_keep 10
|
||||
roll_keep_for 720h
|
||||
}
|
||||
format filter {
|
||||
request>uri regexp \?.*$ ""
|
||||
request>remote_ip delete
|
||||
request>remote_port delete
|
||||
request>client_ip delete
|
||||
request>headers delete
|
||||
resp_headers delete
|
||||
user_id delete
|
||||
wrap json
|
||||
}
|
||||
}
|
||||
log_append request_id {http.response.header.X-Request-ID}
|
||||
reverse_proxy 127.0.0.1:8093
|
||||
}
|
||||
@@ -0,0 +1,57 @@
|
||||
{
|
||||
"schema": 1,
|
||||
"server_url": "https://observatory.gamertan.com",
|
||||
"credential_file": "/etc/gamertan-observatory/agent-credential.json",
|
||||
"spool_dir": "/var/lib/gamertan-observatory-agent",
|
||||
"state_file": "/var/lib/gamertan-observatory-agent/state.json",
|
||||
"max_spool_bytes": 5368709120,
|
||||
"max_spool_age": "72h",
|
||||
"batch_records": 5000,
|
||||
"flush_interval": "1s",
|
||||
"sources": [
|
||||
{
|
||||
"kind": "caddy_json",
|
||||
"path": "/var/log/caddy/eqlwiki-edge.jsonl",
|
||||
"stream_id": "eql-edge"
|
||||
},
|
||||
{
|
||||
"kind": "requestlog_jsonl",
|
||||
"path": "/var/log/eqlwiki/access.jsonl",
|
||||
"stream_id": "eql-application"
|
||||
},
|
||||
{
|
||||
"kind": "tend_events_jsonl",
|
||||
"path": "/opt/gamertancom/deployment-events.jsonl",
|
||||
"stream_id": "tend-gamertancom"
|
||||
},
|
||||
{
|
||||
"kind": "tend_events_jsonl",
|
||||
"path": "/opt/sandwich-hime-site/deployment-events.jsonl",
|
||||
"stream_id": "tend-sandwich-hime-site"
|
||||
},
|
||||
{
|
||||
"kind": "tend_events_jsonl",
|
||||
"path": "/opt/gamertan-observatory/deployment-events.jsonl",
|
||||
"stream_id": "tend-observatory"
|
||||
},
|
||||
{
|
||||
"kind": "linux_metrics",
|
||||
"stream_id": "public-node-host-metrics",
|
||||
"linux_metrics": {
|
||||
"proc_root": "/proc",
|
||||
"cgroup_root": "/sys/fs/cgroup",
|
||||
"filesystems": [
|
||||
{ "name": "root", "path": "/" }
|
||||
],
|
||||
"cgroups": [
|
||||
{ "name": "caddy", "path": "system.slice/caddy.service" },
|
||||
{ "name": "eql", "path": "system.slice/system-eqlwiki.slice" },
|
||||
{ "name": "gamertan", "path": "system.slice/system-gamertancom.slice" },
|
||||
{ "name": "sandwich-hime", "path": "system.slice/sandwich-hime-site.service" },
|
||||
{ "name": "observatory", "path": "system.slice/gamertan-observatory.service" },
|
||||
{ "name": "observatory-agent", "path": "system.slice/gamertan-observatory-agent.service" }
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
SPDX-License-Identifier: AGPL-3.0-only
|
||||
@@ -0,0 +1,53 @@
|
||||
# SPDX-License-Identifier: AGPL-3.0-only
|
||||
[Unit]
|
||||
Description=Gamertan Observatory production agent
|
||||
After=network-online.target gamertan-observatory.service
|
||||
Wants=network-online.target
|
||||
PartOf=gamertan-observatory.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=observatory-agent
|
||||
Group=observatory-agent
|
||||
SupplementaryGroups=caddy eqlwiki gamertancom
|
||||
LoadCredential=agent.json:/etc/gamertan-observatory/agent.json
|
||||
LoadCredential=agent-credential.json:/etc/gamertan-observatory/agent-credential.json
|
||||
ExecStart=/opt/gamertan-observatory/current/observatory agent --systemd-credentials --config %d/agent.json --credential-file %d/agent-credential.json
|
||||
Restart=on-failure
|
||||
RestartSec=5s
|
||||
TimeoutStartSec=20s
|
||||
TimeoutStopSec=20s
|
||||
KillMode=mixed
|
||||
UMask=0077
|
||||
|
||||
StateDirectory=gamertan-observatory-agent
|
||||
StateDirectoryMode=0700
|
||||
NoNewPrivileges=yes
|
||||
PrivateDevices=yes
|
||||
PrivateTmp=yes
|
||||
ProtectClock=yes
|
||||
ProtectControlGroups=yes
|
||||
ProtectHome=yes
|
||||
ProtectHostname=yes
|
||||
ProtectKernelLogs=yes
|
||||
ProtectKernelModules=yes
|
||||
ProtectKernelTunables=yes
|
||||
ProtectProc=invisible
|
||||
ProtectSystem=strict
|
||||
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
||||
RestrictNamespaces=yes
|
||||
RestrictRealtime=yes
|
||||
RestrictSUIDSGID=yes
|
||||
LockPersonality=yes
|
||||
MemoryDenyWriteExecute=yes
|
||||
SystemCallArchitectures=native
|
||||
CapabilityBoundingSet=
|
||||
AmbientCapabilities=
|
||||
ReadOnlyPaths=/proc /sys/fs/cgroup /var/log/caddy /var/log/eqlwiki /opt/gamertancom/deployment-events.jsonl /opt/sandwich-hime-site/deployment-events.jsonl /opt/gamertan-observatory/deployment-events.jsonl
|
||||
ReadWritePaths=/var/lib/gamertan-observatory-agent
|
||||
TasksMax=64
|
||||
MemoryMax=256M
|
||||
LimitNOFILE=1024
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,3 @@
|
||||
# SPDX-License-Identifier: AGPL-3.0-only
|
||||
# Intentionally empty. Secrets use systemd credentials. Tend supplies the
|
||||
# candidate-only OBSERVATORY_TEND_CANDIDATE_LISTEN value itself.
|
||||
@@ -0,0 +1,50 @@
|
||||
# SPDX-License-Identifier: AGPL-3.0-only
|
||||
[Unit]
|
||||
Description=Gamertan Observatory
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=gamertan-observatory
|
||||
Group=gamertan-observatory
|
||||
LoadCredential=server.json:/etc/gamertan-observatory/server.json
|
||||
LoadCredential=web-push.json:/etc/gamertan-observatory/web-push.json
|
||||
EnvironmentFile=/etc/tend/environment/observatory.env
|
||||
ExecStart=/opt/gamertan-observatory/current/observatory server --config %d/server.json --systemd-credential-config
|
||||
Restart=on-failure
|
||||
RestartSec=2s
|
||||
TimeoutStartSec=20s
|
||||
TimeoutStopSec=20s
|
||||
KillMode=mixed
|
||||
UMask=0077
|
||||
|
||||
StateDirectory=gamertan-observatory
|
||||
StateDirectoryMode=0700
|
||||
NoNewPrivileges=yes
|
||||
PrivateDevices=yes
|
||||
PrivateTmp=yes
|
||||
ProtectClock=yes
|
||||
ProtectControlGroups=yes
|
||||
ProtectHome=yes
|
||||
ProtectHostname=yes
|
||||
ProtectKernelLogs=yes
|
||||
ProtectKernelModules=yes
|
||||
ProtectKernelTunables=yes
|
||||
ProtectProc=invisible
|
||||
ProtectSystem=strict
|
||||
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
||||
RestrictNamespaces=yes
|
||||
RestrictRealtime=yes
|
||||
RestrictSUIDSGID=yes
|
||||
LockPersonality=yes
|
||||
MemoryDenyWriteExecute=yes
|
||||
SystemCallArchitectures=native
|
||||
CapabilityBoundingSet=
|
||||
AmbientCapabilities=
|
||||
TasksMax=128
|
||||
MemoryMax=768M
|
||||
LimitNOFILE=8192
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,30 @@
|
||||
{
|
||||
"schema": 1,
|
||||
"listen": "127.0.0.1:8093",
|
||||
"public_url": "https://observatory.gamertan.com",
|
||||
"data_dir": "/var/lib/gamertan-observatory",
|
||||
"max_body_bytes": 33554432,
|
||||
"max_concurrent_ingest": 8,
|
||||
"session_lifetime": "12h",
|
||||
"query": {
|
||||
"max_duration": "5s",
|
||||
"max_rows": 10000,
|
||||
"max_scanned_bytes": 268435456,
|
||||
"max_memory_bytes": 134217728
|
||||
},
|
||||
"retention": {
|
||||
"raw_logs_days": 30,
|
||||
"raw_traces_days": 30,
|
||||
"raw_metrics_days": 14,
|
||||
"cold_raw_days": 400,
|
||||
"delete_cold_raw": false,
|
||||
"metric_rollups_days": 400,
|
||||
"evidence_days": 400
|
||||
},
|
||||
"web_push": {
|
||||
"private_key_file": "/run/credentials/gamertan-observatory.service/web-push.json",
|
||||
"subject": "mailto:security@sandwichhime.com",
|
||||
"queue_capacity": 64,
|
||||
"request_timeout": "10s"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
SPDX-License-Identifier: AGPL-3.0-only
|
||||
@@ -0,0 +1,50 @@
|
||||
{
|
||||
"schema_version": 2,
|
||||
"service": {
|
||||
"name": "observatory",
|
||||
"allowed_host": "observatory.gamertan.com",
|
||||
"environment_file": "/etc/tend/environment/observatory.env"
|
||||
},
|
||||
"build": {
|
||||
"package": "./cmd/observatory",
|
||||
"binary": "observatory",
|
||||
"branch": "main",
|
||||
"version_symbol": "gamertan.com/observatory/internal/version.Version",
|
||||
"commit_symbol": "gamertan.com/observatory/internal/version.Commit",
|
||||
"date_symbol": "gamertan.com/observatory/internal/version.Date"
|
||||
},
|
||||
"deployment": {
|
||||
"strategy": "singleton_candidate",
|
||||
"root": "/opt/gamertan-observatory",
|
||||
"lock_file": "/run/lock/tend-deploy.lock",
|
||||
"state_file": "/opt/gamertan-observatory/tend-state.json",
|
||||
"event_log": "/opt/gamertan-observatory/deployment-events.jsonl",
|
||||
"health_path": "/healthz",
|
||||
"readiness_path": "/readyz",
|
||||
"candidate_timeout_seconds": 30,
|
||||
"activation_window_seconds": 10,
|
||||
"smoke": [
|
||||
{
|
||||
"path": "/",
|
||||
"contains": "Gamertan Observatory"
|
||||
}
|
||||
],
|
||||
"public_smoke": [
|
||||
{
|
||||
"url": "https://observatory.gamertan.com/",
|
||||
"contains": "Gamertan Observatory"
|
||||
}
|
||||
],
|
||||
"singleton": {
|
||||
"unit": "gamertan-observatory.service",
|
||||
"address": "127.0.0.1:8093",
|
||||
"candidate_address": "127.0.0.1:18093",
|
||||
"listen_env": "OBSERVATORY_TEND_CANDIDATE_LISTEN",
|
||||
"current_link": "/opt/gamertan-observatory/current",
|
||||
"previous_link": "/opt/gamertan-observatory/previous",
|
||||
"caddy_config": "/etc/caddy/Caddyfile",
|
||||
"caddy_handler": "/etc/caddy/observatory.caddy",
|
||||
"caddy_handler_template": "/etc/tend/caddy/observatory.template"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
SPDX-License-Identifier: AGPL-3.0-only
|
||||
Reference in New Issue
Block a user