 Jon Chery
|
ecdba833d9
|
feat(P7): doctor ingress + docs + integration tests (REQ-177,178,179)
New 'orca doctor ingress' command: verifies podman orca-traefik
container running, nft DNAT+SNAT, /etc/traefik/dynamic exists,
step-ca root CA present.
UAT signoff script: replaced assertion 36 (systemd → podman
container), added assertions 40-46 (nft table, DNAT, SNAT, dynamic
dir, step-ca CA, traefik.yml, doctor ingress pass).
docs/ingress.md: R-024 podman traefik section — three topologies,
container config, nft ruleset, doctor ingress, Dockerfile.traefik.
TLS model updated (drop certResolver, tls:{} for v0.14, mTLS v0.15).
ARCHITECTURE.md: v0.14 deltas section — R-024, three topologies,
nft emitter changes, TLS model, migration 0009, new CLI.
Integration tests (tests/ingress_bootstrap_test.go): nft postrouting
+ DNATTarget, priority -10, traefik TLS model (tls:{} no
certResolver), image ref resolution, floating-IP LXC provisioning
commands (pct create with hwaddr/ip/gw/features), MAC generation.
---ci---
project: orca
phase: 7
milestone: v0.14
status: execute
---/ci---
|
2026-08-10 20:24:13 +00:00 |
|
|
Jon Chery
|
289e5cf6e1
|
docs(P02): CLI reference + jobspec reference + ingress guide
P02 — operator-facing documentation (REQ-091, REQ-092, REQ-093; gate C-22).
docs/cli.md (REQ-091):
- Full CLI command/flag reference: every command/subcommand with synopsis,
flag tables (name/type/default/description), one-line examples.
- Global flags (--json, --system, --config, --no-deprecation-warnings).
- Output modes (text/json/watch), env vars, exit codes.
- Deprecated surface callout boxes (daemon, cert, node-join-mTLS, HCL
jobspec) pointing to v0.11 removal.
docs/jobspec.md (REQ-092):
- Markdown frontmatter schema reference: all top-level keys, block
reference (runtime/ports/env-secrets/volumes/restart/update/service/
health/lifecycle/constraints/affinity/tasks), kinds matrix
(Job/Service/DaemonSet required vs allowed), CEL subset grammar, body
byte-exact preservation (R-015), deprecated HCL callout.
docs/ingress.md (REQ-093):
- Traefik ingress reference: service->Traefik mapping (D-175), R-007
socket-vs-TCP-bind semantics, generated YAML shape (routers/services/
healthCheck), atomic reload (C-10), drain (weight:0), TLS (certResolver,
trust domain, step-ca), worked-example pointer to examples/full-stack/,
v0.11 forward limitations.
All factual claims grounded in live codebase (gate C-22). Cross-links
verified to resolve.
---ci---
project: orca
phase: 2
milestone: v0.10
status: execute
---/ci---
|
2026-08-05 20:57:05 +00:00 |
|