gamertan
bf56dbce0f
Export the reviewed allowlisted snapshot from private source commit 07c1655921f21ee5e4fc4d85639d199e8867b17d. This records the Docker Compose activation, schema-compatible rollback, and stateful migration resource findings from Observatory Preview 19 dogfooding. AI-Assisted: OpenAI Codex Signed-off-by: Cole Speelman <crspeelman@gmail.com>
Reusable Tend examples
This subtree is licensed 0BSD so an operator can copy and adapt it without bringing the Tend program's AGPL license into an application configuration.
The blue/green example expects one separately reviewed environment file that the two installed slots and transient validation use consistently:
# /etc/tend/environment/example-site.env
APP_SECRET=replace-on-server
The blue/green systemd slot units then read the nonsecret listen address from
/etc/tend/slots/example-site-blue.env or -green.env; Tend overrides only
the isolated candidate address. Secret values never enter tend.json.
The singleton example follows the same split: its shared root-only environment file omits the configured listen key, the installed unit owns the live address, and Tend supplies only the transient candidate address. This prevents a shared environment file from overriding the isolated candidate port. Its imported Caddy handler is also managed from one reviewed template. Tend temporarily routes the canonical origin to the proven candidate while the fixed-address unit restarts, then returns traffic to that unit only after it passes its local checks.
Production configuration belongs outside the source checkout, owned by root, and not group- or world-writable. The Caddy handler template is an entire imported handler fragment; the enclosing site, matchers, and routing precedence remain operator-owned.
event_log is a per-service, root-owned JSONL evidence stream below that
service's release root. Grant an Observatory agent read access explicitly; do
not make the release root broadly readable. activation_window_seconds keeps
canonical routed probes active after Caddy reload and keeps the previous
blue/green slot—or the singleton handoff candidate—under health/readiness
observation until the activation is recorded.
server/ demonstrates the schema-2 receive policy, forced OpenSSH command,
restricted sudo entry, two independent service configurations, and secret-file
placement. The values are placeholders, not an installation script.