Backtalk6858/claude-projects
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update: context.md — id=51 deployed healthy on primary, session 3 facts + next session order

Browse Source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Backtalk6858
2026-06-22 19:38:48 -05:00
parent e7c6db19d7
commit 9ca9f2632a
1 changed files with 20 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agent-builder/.claude/context.md
+20 -16
View File
@@ -154,25 +154,29 @@ All sandbox prereqs done. Sandbox mirrors production.
- n8n_agent_worker postgres role — api_business DB, scoped to automation_ideas + agent_test_results - n8n_agent_worker postgres role — api_business DB, scoped to automation_ideas + agent_test_results
- Credential in production Vault: secret/postgres/n8n-agent-worker - Credential in production Vault: secret/postgres/n8n-agent-worker
### id=51 — MIGRATING TO PRIMARY (June 22 session 2) ### id=51 — DEPLOYED ON PRIMARY ✅ (June 22 session 3)
**Decision: move proxy from server-01 → primary server.** Reasons: security infrastructure (not a test workload), Claude Code runs on primary, all deps (Vault, bridge, N8N, ntfy) already local. Cloudflare route stays `http://coolify-proxy:80`. Container running healthy at `https://secrets-proxy.reverseproxyserver.net` on primary.
Coolify service UUID: `ilus0cfdkheipodw1viurg1d`
**June 22 session 2 facts:** **June 22 session 3 facts:**
- gitea.local pulls from server-01 now work: iptables DNAT rule applied on primary (192.168.1.88:80 → 127.0.0.1:80 via enp1s0 route_localnet=1) — NOT persisted across reboot yet (needs iptables-persistent or systemd unit) - Coolify API allowed_ips was `172.16.16.1/32` — cleared to allow API access (set to empty string in instance_settings)
- Cloudflare route `secrets-proxy.reverseproxyserver.net` already exists but pointed to primary's coolify-proxy which doesn't know about server-01 container — confirms proxy should be on primary - Server-01 service (lv3xeu2manuimle458wbm9u9) stopped and deleted ✅
- Coolify API: secrets-proxy is a SERVICE type (not application) — use /api/v1/services endpoint - Sandbox Vault and bridge now LAN-exposed on server-01: vault=192.168.1.90:8201, bridge=192.168.1.90:8083 (port bindings added to Coolify DB + sandbox compose file)
- Server-01 service UUID: lv3xeu2manuimle458wbm9u9 (to be stopped/deleted after migration) - secrets-proxy Vault AppRole created in prod (role: 3bf7b8a6-9e99-ca78-8e69-517881e26ea5) — creds at secret/proxy/vault-approle
- Image at gitea.local/backtalk6858/secrets-proxy:latest (digest sha256:5bf92d2e...) — bridge_health_check fix included - secrets-proxy Vault AppRole created in sandbox (role: f21416b3-2f3a-0461-fa38-d453a4e32865) — creds at secret/proxy/vault-approle-sandbox
- Caller keys: claude-code: 0ce8c396...591e9, agent-builder-agent: 473d9e1f...3573, n8n-builder-agent: 233e6aa9...cb - secrets_proxy DB user created in api_business (INSERT on proxy_executions only) — creds at secret/postgres/secrets-proxy
- NTFY secrets-proxy-bot created (topic: secrets-proxy-notifications, token at secret/ntfy/secrets-proxy-bot)
- Coolify bug: env vars for custom-image services can only be set via PATCH /api/v1/services/{uuid}/envs with key+value (not POST)
- Coolify DB YAML serializer mangles CMD-SHELL healthcheck single quotes (`'` → `''`) — fixed by using CMD array form in healthcheck
- psql heredoc via `docker exec ... << 'SQL'` doesn't work — use `docker cp` + `psql -f` instead
- pull_policy: never removed from docker-compose.yml (was server-01 workaround, no longer needed on primary)
- docker_compose_raw in Coolify DB must be updated via `docker cp` + `psql -f` for reliability
**NEXT SESSION — in order:** **NEXT SESSION — in order:**
1. Stop/delete secrets-proxy service on server-01 (Coolify UUID lv3xeu2manuimle458wbm9u9) 1. E2E tests: bridge_health_check, n8n_workflow_list, vault_secret_exists, vault_secret_write (all via `https://secrets-proxy.reverseproxyserver.net/exec`)
2. Deploy secrets-proxy on primary via Coolify (same docker-compose.yml, Traefik labels, coolify network) 2. Persist iptables DNAT rule on primary (iptables-persistent or systemd unit)
3. Cloudflare route already correct (http://coolify-proxy:80) — no change needed 3. Add POST /allowlist endpoint to sudo bridge
4. Full E2E test: bridge_health_check, bitwarden_item_exists, n8n_workflow_list, vault_secret_write 4. id=24 Agent Builder Agent + id=67 N8N Builder Agent
5. Persist iptables DNAT rule on primary (iptables-persistent or systemd unit) — so server-01 can always pull from gitea.local
6. Add sudo-bridge allowlist management endpoint (POST /allowlist) — gap discovered this session
7. id=24 Agent Builder Agent + id=67 N8N Builder Agent
- Bitwarden bridge LAN-exposed: 192.168.1.88:8083 ✅ - Bitwarden bridge LAN-exposed: 192.168.1.88:8083 ✅