mxm/homelab

Fork 0

feat(nspawn): migrate Matrix to Taurus #9

Merged

mxm merged 35 commits from bmns-028d-matrix-taurus into main

2026-08-07 14:19:13 +00:00

mxm commented

2026-08-07 14:19:03 +00:00

Owner

Summary

migrate Matrix villa-app-04 from Proxmox CT 119 to a first-class Taurus nspawn guest
replace the custom Continuwuity lifecycle with the native NixOS module and /var/lib/continuwuity
preserve identities and rollback material, enable accepted autostart, and close the scoped BMNS-028 application migrations

Changes

add the Taurus guest, Matrix service binding, inventory placement, storage ordering, and focused contracts
record preparation, cutover, rollback, deterministic qualification, explicit acceptance, and recovery procedures
retain CT 119 stopped with onboot: 0, both volumes, archives, checkpoints, vars, and recipients

Test Plan

nix flake check -L
exact villa-app-04 and Taurus closures built
strict Taurus deployment completed without restarting the accepted guest
authenticated Matrix login/history/media/write/readback/logout checks passed
local, both-router, public Matrix, and both .well-known probes returned HTTP 200
CT 119 verified stopped with onboot: 0 and both volumes retained
git diff --check main...HEAD

## Summary - migrate Matrix `villa-app-04` from Proxmox CT 119 to a first-class Taurus nspawn guest - replace the custom Continuwuity lifecycle with the native NixOS module and `/var/lib/continuwuity` - preserve identities and rollback material, enable accepted autostart, and close the scoped BMNS-028 application migrations ## Changes - add the Taurus guest, Matrix service binding, inventory placement, storage ordering, and focused contracts - record preparation, cutover, rollback, deterministic qualification, explicit acceptance, and recovery procedures - retain CT 119 stopped with `onboot: 0`, both volumes, archives, checkpoints, vars, and recipients ## Test Plan - [x] `nix flake check -L` - [x] exact `villa-app-04` and Taurus closures built - [x] strict Taurus deployment completed without restarting the accepted guest - [x] authenticated Matrix login/history/media/write/readback/logout checks passed - [x] local, both-router, public Matrix, and both `.well-known` probes returned HTTP 200 - [x] CT 119 verified stopped with `onboot: 0` and both volumes retained - [x] `git diff --check main...HEAD`

mxm added 35 commits

2026-08-07 14:19:04 +00:00

docs(bmns): design Matrix Taurus migration 5b252f893c

docs(bmns): plan Matrix Taurus migration 754f732240

feat(bmns): prepare Matrix Taurus guest 95214f78eb

fix(bmns): add Matrix well-known client/server configuration edaa5f8b63

docs(bmns): record Matrix migration gates bd4d213d14

docs(bmns): address Matrix runbook review findings ef28ef1b48

docs(bmns): fix reverse rollback order - set onboot:1 before start db1af276c0

style(bmns): format Matrix configuration 25e7cf6198

docs(bmns): record Task 3 recovery material execution and correct runbook Step 3 dda2918310

- Document fresh vzdump snapshot (root only, /data excluded)
- Record failed first online backup attempt: TOML table placement error
- Root cause: keys appended after [global.well_known] interpreted as belonging to that table
- Document successful corrected retry with keys inside [global] before [global.well_known]
- Record backup generation 1, media archive, and hash-verified copies to Taurus/Storage Box
- Document partial isolated qualification: database reconstruction and RocksDB open verified, network namespace isolation failed due to binary/namespace incompatibility
- Correct runbook Step 3 to explicitly require inserting keys inside [global] section before [global.well_known] table header
- Source restored to original state, full baseline verified

docs(bmns): correct Task 3 qualification report — remove false incompatibility claim bd4553cd7d

- Remove claim that Continuwuity 0.5.10 binary/namespace isolation is incompatible
- Record correct root cause: agent's systemd-run invocation had config propagation issue
- Document that debugger successfully ran qualification with explicit --config under PrivateNetwork=yes
- Mark Task 3 as BLOCKED/NEEDS_CONTEXT, not complete
- Full acceptance criteria (login/history/media/disposable-message/restart) not executed by agent
- Preserve factual Steps 3-7 and source cleanup evidence

docs(bmns): address Task 3 review findings 6c663608b6

Runbook:
- Artifact 1 (Proxmox snapshot) now explicitly states observed fresh vzdump excludes mp0 /data
- Added mandatory companion material note: online RocksDB backup and media archive required for complete recovery

Migration log:
- Status: Task 3 Steps 3-7 complete, source cleanup complete, BLOCKED on Step 8 authenticated acceptance
- Pending gates: removed Gate 3 (executed), next step is Task 3 Step 8 full acceptance
- Pending runtime artifacts: marked 4 artifacts complete with exact SHA-256 values
- Source restoration: full cleanup verification with both routers, public Matrix, both well-known HTTP 200, original TOML hash, no drop-in/temp config, unchanged identity hashes (machine-id, SSH Ed25519, sops age key, ZeroTier identity)
- Disposition: next step is Task 3 Step 8 full acceptance, then Gate 4

docs(bmns): mark Task 3 complete, next is Task 4 inactive target preparation 1a3dd8199f

- Status: Task 3 (recovery material preparation and qualification) completed 2026-08-06
- Pending gates: removed Step 8, next is Task 4 (inactive target preparation on Taurus)
- Pending runtime artifacts: marked online backup and media archive as complete with exact SHA-256 values
- Disposition: Task 3 complete, next step is Task 4
- Added Step 8 full acceptance section documenting debugger-completed qualification
- Updated execution board BMNS-028D outcome and activity log with Task 3 completion details
- Preserved first-attempt/config root-cause history and runbook fixes

docs(bmns): add verifier evidence replication and correct runtime details 4916a9be23

- Replicate verifier evidence (verify.sh, manifests) to Taurus recovery and Storage Box verification/ subdirectories with hashes verified
- Correct false DynamicUser claim: qualification used User=root, StateDirectory=continuwuit, PrivateNetwork=yes
- Add exact runtime evidence from systemd journal including failed attempts, successful runs, and acceptance criteria verification
- Update execution board outcome with verifier evidence and corrected runtime details
- Preserve all original Task 3 evidence and acceptance status

docs(bmns): mark Task 3 BLOCKED on Storage Box CIFS root-only disposition 9f45bdefbd

- Replace false media/restart claims with exact observable evidence from MatrixObservableVerifier
- Record actual runtime: User=root (not DynamicUser), 10:32:06-10:37:28 UTC, 11,982,507 byte media download before/after restart
- Add opaque identifier SHA-256 hashes (room/event/media/message) instead of raw IDs
- Record exact chronology, HTTP statuses, byte counts, initial/final DB/media counts
- Document Storage Box CIFS permission deviation (0755 vs required 0600)
- Update migration log Status, Pending gates, Disposition to reflect BLOCKED status
- Update execution board BMNS-028D outcome and activity log with BLOCKED status
- Update task-3-report section 32 with complete observable evidence and BLOCKED status
- All Task 3 functional checks complete; BLOCKED only on Storage Box root-only disposition

docs(bmns): record archive restoration and propagate Task 3 blocker to parent 0c53f63ad2

- Record missing CT119 source online-backup archive restoration from Storage Box replica via pct push
- Document post-qualification rehash showing all three locations identical for both archives
- Note Taurus rehash used strict IPv6 mesh host alias due to LAN route refusal (no mutation)
- Update BMNS-028D outcome to reflect archive restoration and current BLOCKED status
- Update parent BMNS-028 outcome to say Task 4 is blocked by same Storage Box disposition
- Add activity log entry for archive restoration and rehash completion
- Task 3 functional checks complete, but overall BLOCKED solely on Storage Box 0755 vs 0600 disposition

docs(bmns): record operator exception acceptance and mark Task 3 complete 6a53c4997f

- Record operator explicitly accepted documented exception for Storage Box CIFS permission semantics
- Treat private Storage Box account plus villa-pve-03 root-only interactive shell access as effective access control
- Waive literal Task 3 Step 7 mode requirement (0600) for this BMNS-028D bundle
- Record exact risk: any compromised unsandboxed local service process could read plaintext archives
- Mark Task 3 recovery preparation COMPLETE
- Note Task 4 (inactive target preparation) remains pending separate explicit deployment authorization
- Preserve all exact archive/qualification/privacy evidence from previous rounds

docs(bmns): complete Task 4 inactive target preparation on Taurus b93131388a

Deploy exact reviewed Taurus closure, prepare villa-app-04 inactive root
with direct Btrfs mount, qgroup 1/202 (32 GiB limit), resource controls,
and staged identities with correct permissions. All identity hashes match
source. Source CT119 remains running and authoritative. Target inactive.
No cutover, source stop, or deletion authorized.

docs(bmns): plan Taurus activation ordering fix 5a81d0a42a

fix(nspawn): order qgroups after guest mounts d40a8e3a4c

docs(bmns): complete Task 4A corrected deployment on Taurus fb1c259d3d

Task 4A runtime correction completed after code fix (d40a8e3) added guest
mount dependencies to qgroup unit. Corrected Taurus closure activated
cleanly (single pass, zero retries). Guest profile set, boot isolation
proved, source auth tests passed, credential preserved.

Migration log: Added Task 4A section with full evidence
Execution board: Updated BMNS-028D outcome and activity log

docs(bmns): address review findings — linked/enabled wording, accepted-correction evidence, condition proof f1fe491953

Corrected Round 1 linked/enabled wording to linked (not enabled).
Added accepted-correction evidence block: Proxmox backup inventory,
CT119 checks, both routers, target isolation, four warnings.
Documented container@villa-app-04.service ConditionPathIsMountPoint
installed (ConditionResult=no expected — never started, never evaluated).

docs(bmns): clarify Task 4 gate supersession bdace22240

docs(bmns): record Matrix Taurus rollback 66f780c44c

docs(bmns): record configured marker build evidence cafb494f9e

docs(bmns): clarify marker attempt disposition fba73596c2

docs(bmns): plan corrected Matrix cutover retry bede889e0a

docs(bmns): verify retry marker GC root 0cb6a73fac

docs: record BMNS-028D retry rollback 5f5caa8842

docs(bmns): plan final Matrix cutover attempt 0095525544

docs(bmns): retain verified cutover helpers 2cf5fa7641

docs(bmns): record final Taurus qualification ab789f8327

docs(bmns): keep Matrix migration disposition open b4d83b06c8

docs(bmns): accept Matrix Taurus migration b679ef4df9