docs(init): validate specification — v0.14 ingress bootstrap

---ci--- project: orca phase: 0 milestone: v0.14 status: specify ---/ci---
2026-08-10 18:07:55 +00:00
parent 0424f8ce02
commit 5e0b899f1a
5 changed files with 167 additions and 24 deletions
@@ -675,3 +675,57 @@ CI agent verifies and cuts v1.0.0).
 - jobspec `health` prober (v0.13 adds lint warning; enforcement deferred)
 - jobspec `update` rolling/canary controller (v0.13 adds lint warning; enforcement deferred)
 - jobspec `schedule.cron` scheduler loop (v0.13 adds lint warning; enforcement deferred)
+
+## Milestone v0.14: Ingress Bootstrap Completeness — **IN PROGRESS**
+
+**Scope**: ensure that linux & proxmox types are properly bootstrapped with
+traefik during cluster init or node join. All cluster endpoints are
+provisioned as sockets (R-007); routing between jobs and services depends on
+traefik being present and properly configured. v0.13 shipped traefik binary +
+systemd unit + empty dynamic dir but never wrote the static config nor applied
+nft rules. v0.14 replaces the binary+systemd model with a **podman container**
+running a custom `orca-traefik` image, and completes the nft SNAT+DNAT ingress
+stack on every node type.
+
+**New load-bearing rule**: **R-024** — Traefik runs exclusively as a podman
+container from the `orca-traefik` image published per release. Every
+orca-managed ingress surface bootstraps nft DNAT + SNAT/MASQUERADE +
+`podman run --restart=always --network host` with dynamic-config + step-ca
+root CA volume mounts.
+
+**Three topologies**:
+1. **Linux**: host → nft → `podman run orca-traefik` (host network)
+2. **Proxmox Native**: host → nft → LXC (nesting=1) → `podman run orca-traefik`
+3. **Proxmox Floating-IP**: LXC (owns floating IP) → nft (inside LXC) → `podman run orca-traefik`
+
+**Milestone type**: feature (multiple `feat` phases). Tags on v0.13.x patch
+line: `v0.13.0` (P0) ... `v0.13.8` (P8 final = v0.14 milestone release).
+
+- [ ] Phase 0: Pre-execution (SPECIFY→CLARIFY→RESEARCH→PLAN→GRILL) — tag `v0.13.0`
+- [ ] Phase 1: `orca-traefik` container image + release pipeline (REQ-171) — tag `v0.13.1`
+- [ ] Phase 2: Podman traefik reconciler — replace binary+systemd install (REQ-172) — tag `v0.13.2`
+- [ ] Phase 3: nft SNAT+DNAT + `orca init` ingress bootstrap (REQ-173) — tag `v0.13.3`
+- [ ] Phase 4: `orca node join --type linux` remote ingress bootstrap (REQ-174) — tag `v0.13.4`
+- [ ] Phase 5: Proxmox native ingress mode — LXC + podman traefik (REQ-175) — tag `v0.13.5`
+- [ ] Phase 6: Proxmox floating-IP LXC ingress + interactive prompt (REQ-176) — tag `v0.13.6`
+- [ ] Phase 7: `doctor ingress` + docs + integration tests (REQ-177,178,179) — tag `v0.13.7`
+- [ ] Phase 8: Final review + ship + audit (milestone release) — tag `v0.13.8` = **v0.14 milestone release**
+
+### Per-phase REQ coverage (v0.14)
+
+- **P1** — `Dockerfile.traefik` + release pipeline (REQ-171)
+- **P2** — Podman traefik reconciler (REQ-172)
+- **P3** — nft SNAT+DNAT + init bootstrap (REQ-173)
+- **P4** — Linux node join remote ingress (REQ-174)
+- **P5** — Proxmox native ingress — LXC + podman (REQ-175)
+- **P6** — Proxmox floating-IP LXC ingress (REQ-176)
+- **P7** — doctor ingress + docs + tests (REQ-177,178,179)
+- **P8** — Final review + ship + audit
+
+### v0.14 is a continuation milestone, not a direction change
+
+The vision ("minimalist, offline-first, CLI-first orchestration engine")
+is unchanged. v0.14 completes the ingress bootstrap that v0.13 left
+non-functional (binary installed but no config, no nft applied). The
+podman-container model is the operator's constraint; the architecture's
+socket+traefik routing design (R-007, R-017) is unchanged.