Re-scope: static site on a rented host, without the framework #43

Closed

allod-agent wants to merge 1 commit from agent/static-site-vps-rescope into master

allod-agent commented

2026-09-02 03:24:56 +01:00

Member

Re-scopes the static-site-on-a-rented-host work after the service archetype was abandoned. This is a plan, not code: nothing in any machine changes until it is agreed. It exists because the previous attempt shipped four PRs of framework machinery for a deliverable that needs none, and the useful output of that attempt was the evidence for why.

What it settles

One decision, and it is the one that unblocks everything else: publish content in the system closure, and do not build the CI-push path yet. That choice determines what the content checks are for. They validate a store path; under CI push the store path stops being what Caddy serves, and every one of them inspects the wrong artifact. Content-in-closure is also fewer moving parts — no runner, no deploy key, no rsync target — and keeps the symlink-escape guarantee where it is already implemented and tested. The trigger to revisit is publishing cadence, not preference, and the reversal costs one vhost body plus moving the symlink check into the pipeline.

Where a rented host lives. In deploy's nixosConfigurations, composed from modules that already exist and are already checked. Inside the management path — one lock, one follows discipline, uniform nixos-rebuild --flake. Outside the data-model path — no inventory entry, no builder dispatch, no vmFacts, no identity join.

Shape

Five slices, each landable alone with its own witness. Slice 3 is the deliverable and its witness is curl -sSI https://<domain> returning 200 with a real certificate — everything before it is evaluation. Slices 0 and 1 are deliberately first and cheap: rewrite two issues that presume the abandoned model, and delete a content rule that cannot fire in production, so nothing is built on known-wrong material.

Risk is per slice, R0 through R3. Slice 3 is R3 rather than R4 because the host carries no state: the worst credible failure is a misconfigured box that is destroyed and reinstalled, with nothing authoritative on it. It is not R2 because an open port or an accepted key on a public host is a real exposure and the install path cannot be exercised in fixtures.

Interface contracts: none new

That is the point. The plan consumes publicHost, staticSite, rentedKvmGuest and buildZolaSite unchanged, and says plainly that adding an interface here is a signal the shape is wrong again.

Gates

Renting the host, DNS, and the first nixos-anywhere install are human-only and block slice 3 outright. Operator SSH keys are a human decision: adminAuthorizedKeys has no default on purpose, after review found the old default handed root on a rented internet-facing box to the nexus host identity — a recipient of every ciphertext in the fleet.

What it does not do

No new archetype, builder, or inventory entry; that question is settled by allod/archetypes#60's closure and reopening it needs new evidence rather than another attempt. No stateful-service layer and no forge host. Reverting inventory's service rules is left out as separate and unurgent, with the note that any revert must keep the shape diagnostics that merge also added — they closed a real hole where a machine with no platform reached consumers unvalidated.

Slice 4 is a written record rather than work: what the forge host will need, so this plan does not foreclose it. It names the axis (inventory is wrong for both a static host and a forge; secrets is right for the forge only), keeps the half of allod/archetypes#55 that survives, and states the restore story including the bootstrap circularity — the backup contains the repositories, so what must live outside it is the age key, the backup credentials, and registrar access.

Review

Plan review passes are budgeted by risk. The highest slice here is R3, so at most two passes before landing and measuring. Slice 3's behaviour is settled by installing the host, not by a third reading.

Re-scopes the static-site-on-a-rented-host work after the `service` archetype was abandoned. This is a plan, not code: nothing in any machine changes until it is agreed. It exists because the previous attempt shipped four PRs of framework machinery for a deliverable that needs none, and the useful output of that attempt was the evidence for why. ## What it settles **One decision, and it is the one that unblocks everything else: publish content in the system closure, and do not build the CI-push path yet.** That choice determines what the content checks are for. They validate a store path; under CI push the store path stops being what Caddy serves, and every one of them inspects the wrong artifact. Content-in-closure is also fewer moving parts — no runner, no deploy key, no rsync target — and keeps the symlink-escape guarantee where it is already implemented and tested. The trigger to revisit is publishing cadence, not preference, and the reversal costs one vhost body plus moving the symlink check into the pipeline. **Where a rented host lives.** In `deploy`'s `nixosConfigurations`, composed from modules that already exist and are already checked. Inside the management path — one lock, one `follows` discipline, uniform `nixos-rebuild --flake`. Outside the data-model path — no `inventory` entry, no builder dispatch, no `vmFacts`, no identity join. ## Shape Five slices, each landable alone with its own witness. Slice 3 is the deliverable and its witness is `curl -sSI https://<domain>` returning 200 with a real certificate — everything before it is evaluation. Slices 0 and 1 are deliberately first and cheap: rewrite two issues that presume the abandoned model, and delete a content rule that cannot fire in production, so nothing is built on known-wrong material. Risk is per slice, R0 through R3. Slice 3 is R3 rather than R4 because the host carries no state: the worst credible failure is a misconfigured box that is destroyed and reinstalled, with nothing authoritative on it. It is not R2 because an open port or an accepted key on a public host is a real exposure and the install path cannot be exercised in fixtures. ## Interface contracts: none new That is the point. The plan consumes `publicHost`, `staticSite`, `rentedKvmGuest` and `buildZolaSite` unchanged, and says plainly that adding an interface here is a signal the shape is wrong again. ## Gates Renting the host, DNS, and the first `nixos-anywhere` install are human-only and block slice 3 outright. Operator SSH keys are a human decision: `adminAuthorizedKeys` has no default on purpose, after review found the old default handed root on a rented internet-facing box to the nexus host identity — a recipient of every ciphertext in the fleet. ## What it does not do No new archetype, builder, or inventory entry; that question is settled by `allod/archetypes#60`'s closure and reopening it needs new evidence rather than another attempt. No stateful-service layer and no forge host. Reverting `inventory`'s `service` rules is left out as separate and unurgent, with the note that any revert must keep the shape diagnostics that merge also added — they closed a real hole where a machine with no `platform` reached consumers unvalidated. Slice 4 is a written record rather than work: what the forge host will need, so this plan does not foreclose it. It names the axis (`inventory` is wrong for both a static host and a forge; `secrets` is right for the forge only), keeps the half of `allod/archetypes#55` that survives, and states the restore story including the bootstrap circularity — the backup contains the repositories, so what must live outside it is the age key, the backup credentials, and registrar access. ## Review Plan review passes are budgeted by risk. The highest slice here is R3, so at most two passes before landing and measuring. Slice 3's behaviour is settled by installing the host, not by a third reading.

allod-agent added 1 commit

2026-09-02 03:24:56 +01:00

Add the static site VPS re-scope plan 743043b9ba

allod-agent commented

2026-09-02 04:06:19 +01:00

Author

Member

Closing unmerged. This plan scopes work that already exists.

static-site-parts is a complete standalone flake serving hashpool.dev — nixosConfigurations.pages, its own static-site module, its own checks, a site builder, and a last commit reading "Serve the real website instead of a placeholder". It is one line from installable: the operator public key, deliberately left empty for a human to commit.

That repository is also already the shape this plan spent five slices arriving at: a standalone flake composing modules, no inventory entry, no archetype, no secrets identity.

The failure was mine and it was cheap to avoid. work-diff listed static-site-parts in this workspace at the start of the session and I never opened it. A plan is the wrong artifact when the deliverable is sitting in the working tree; the right first move was to read what exists.

What survives from the plan is recorded where it belongs rather than here: the deploy-model decision on allod/archetypes#57, the structural finding on allod/archetypes#60, and the layering conclusion on allod/archetypes#55. The forge-host notes were the only genuinely new material, and they belong on a forge issue written against a real machine.

Closing unmerged. This plan scopes work that already exists. `static-site-parts` is a complete standalone flake serving `hashpool.dev` — `nixosConfigurations.pages`, its own static-site module, its own checks, a site builder, and a last commit reading "Serve the real website instead of a placeholder". It is one line from installable: the operator public key, deliberately left empty for a human to commit. That repository is also already the shape this plan spent five slices arriving at: a standalone flake composing modules, no `inventory` entry, no archetype, no `secrets` identity. The failure was mine and it was cheap to avoid. `work-diff` listed `static-site-parts` in this workspace at the start of the session and I never opened it. A plan is the wrong artifact when the deliverable is sitting in the working tree; the right first move was to read what exists. What survives from the plan is recorded where it belongs rather than here: the deploy-model decision on `allod/archetypes#57`, the structural finding on `allod/archetypes#60`, and the layering conclusion on `allod/archetypes#55`. The forge-host notes were the only genuinely new material, and they belong on a forge issue written against a real machine.

allod-agent closed this pull request

2026-09-02 04:06:21 +01:00