30 lines
1.3 KiB
Markdown
30 lines
1.3 KiB
Markdown
# coreci-executor runbook
|
|
|
|
## Deploy (host, one time)
|
|
1. git clone this repo onto the PVE host.
|
|
2. cp executor.env.example .env && fill: API key, passcode, GITEA_TOKEN
|
|
(from pack output), Discord webhook (optional).
|
|
3. podman compose up -d --build (or: docker compose up -d --build)
|
|
4. Verify: curl http://127.0.0.1:8765/health -> {"status":"ok","version":"0.1.1"}
|
|
5. HAProxy: add frontend for executor.coreci.dev -> 127.0.0.1:8765.
|
|
|
|
## Kill switch
|
|
podman compose down (requests in flight abort; audit JSONL persists)
|
|
|
|
## Token rotation
|
|
Admin UI -> coreci-executor -> Applications -> delete executor-v0 ->
|
|
recreate (write:repository) -> update .env -> podman compose restart.
|
|
(Or delete the token and re-run deployment pack step [2/6]; it recreates and
|
|
prints the value once.)
|
|
|
|
## Audit
|
|
logs/audit-YYYY-MM-DD.jsonl inside this repo. Read-only verification from any
|
|
chat: GET this repo's logs/ via the Gitea API.
|
|
|
|
## First live job (P0)
|
|
Submit the credential-free re-run of the pending 09-28 PARA pack
|
|
(agent coreci-coo, kind bash_pack, target coreci-coo/home).
|
|
IMPORTANT: the pack content must be the credential-free variant —
|
|
REPO_URL="https://git.coreci.dev/coreci-coo/home.git" (no user:pass@);
|
|
the executor injects auth at run time and rejects embedded credentials.
|