Jon Chery dea472f443 feat(P2): podman traefik reconciler + TLS model fix (REQ-172) ...

Replace internal/traefik/install.go binary+systemd installer with a
podman-container reconciler (R-024). The reconciler is idempotent:
inspect → start-if-stopped → pull+run-if-absent.

Container run flags (research-validated):
  --restart=unless-stopped (not always; research Topic 6)
  --network host (binds 127.0.0.1:8080/8443 on host/LXC loopback)
  -v /etc/traefik/traefik.yml:ro (overrides baked default; C-58)
  -v /etc/traefik/dynamic:ro (orca writes atomically via SSH-push)
  -v /etc/orca/step-ca-root.crt:ro (future mTLS; v0.14 uses tls:{})
  No :Z SELinux flag (research Topic 7)

C-50: ensurePodmanLocal/Remote installs podman if absent.
C-57: removeLegacySystemdUnitLocal/Remote stops+disables+removes
  the v0.13 orca-traefik.service + /usr/local/bin/traefik before
  starting the podman container (upgrade path).
  upgrade.go cutover rewritten to use the reconciler.

TLS model fix (research Topic 4): drop certResolver: orca from
dynamic config (traefik v3.3 only supports acme/tailscale resolvers,
not CA-file-based). Emit tls: {} instead. Real mTLS via dynamic
tls.certificates + clientAuth.caFiles deferred to v0.15 (grill
G-003, confidence 0.55 < 0.60).

Callsites updated:
  init.go: installTraefikLocal → ensureTraefikContainerLocal
  linux/bootstrap.go: traefik.InstallRemote → EnsureTraefikContainerRemote
  proxmox/bootstrap.go: same
  traefik_install.go: wrapper updated

Tests: internal/traefik/install_test.go (new) — ImageRef, podmanRunArgs,
  container-running/stopped/absent paths, legacy systemd removal (C-57).

---ci---
project: orca
phase: 2
milestone: v0.14
status: execute
---/ci---

2026-08-10 20:04:20 +00:00

..

acl_test.go

fix(P04): wire ACL enforcement + WebAuthn reg auth + audit actor (REQ-153)

2026-08-07 20:33:39 +00:00

acl.go

feat(D): capacity auto-discovery + partial updates + ACL debug + UX (REQ-168,169)

2026-08-10 16:33:27 +00:00

audit_test.go

test(cli): coverage uplift to ≥70% excl daemon.go (T01.6, REQ-057)

2026-08-04 01:43:38 +00:00

audit.go

ship: v0.1 Foundation milestone complete (#1)

2026-06-03 20:08:57 +00:00

auth_idp_test.go

feat(P06): auth init-idp real + auth register + doctor oidc (REQ-155)

2026-08-10 11:55:01 +00:00

auth_test.go

feat(P04): OIDC client + auth CLI (REQ-144, D-239, D-242, D-246)

2026-08-07 10:59:55 +00:00

auth.go

feat(P06): auth init-idp real + auth register + doctor oidc (REQ-155)

2026-08-10 11:55:01 +00:00

authactor.go

fix(P04): wire ACL enforcement + WebAuthn reg auth + audit actor (REQ-153)

2026-08-07 20:33:39 +00:00

backup_test.go

feat(P04): backup/restore — signed tarball (HMAC-SHA256)

2026-08-07 04:55:27 +00:00

backup.go

fix(P07): concurrency safety — SQLite, flock, cache, atomic writes (REQ-156)

2026-08-10 12:27:05 +00:00

cache_test.go

feat(P00): CLI cache layer (R-008) — orca_cache SQLite + cache CLI

2026-08-07 04:17:25 +00:00

cache.go

fix(P07): concurrency safety — SQLite, flock, cache, atomic writes (REQ-156)

2026-08-10 12:27:05 +00:00

cert_smoke_test.go

fix(P01): register orca cert command tree + cert_repo tests (REQ-053)

2026-08-04 00:05:10 +00:00

cert_test.go

fix(P01): register orca cert command tree + cert_repo tests (REQ-053)

2026-08-04 00:05:10 +00:00

cert.go

feat(P13): ns subcommands (inherit, set-constraint) + deprecation warnings (REQ-068)

2026-08-07 07:47:28 +00:00

cluster_compat.go

fix(P02): input validation + injection hardening — 11 vectors (REQ-150)

2026-08-07 19:28:01 +00:00

cluster_seal_test.go

feat(P05): seal/audit CLI + chain race fix + key zeroing (REQ-154)

2026-08-07 21:06:39 +00:00

cluster.go

feat(P05): seal/audit CLI + chain race fix + key zeroing (REQ-154)

2026-08-07 21:06:39 +00:00

collector_test.go

feat(P09): collector + aggregator (C-11/C-12/C-14) + drift aggregation (REQ-107)

2026-08-07 06:14:16 +00:00

collector.go

feat(P09): collector + aggregator (C-11/C-12/C-14) + drift aggregation (REQ-107)

2026-08-07 06:14:16 +00:00

concurrency_test.go

fix(P07): concurrency safety — SQLite, flock, cache, atomic writes (REQ-156)

2026-08-10 12:27:05 +00:00

cutover_rotate_compat_test.go

feat(P14b,P14c): daemon cutover + rotate-lead (REQ-114) + mixed-version tolerance (REQ-065, REQ-086, C-13)

2026-08-07 08:18:12 +00:00

cutover.go

fix(P04): wire ACL enforcement + WebAuthn reg auth + audit actor (REQ-153)

2026-08-07 20:33:39 +00:00

daemon_test.go

fix(P07): remove all password/token paths (REQ-146, R-021, C-34) -- BREAKING

2026-08-07 11:12:18 +00:00

daemon.go

fix(P04): wire ACL enforcement + WebAuthn reg auth + audit actor (REQ-153)

2026-08-07 20:33:39 +00:00

deprecation_test.go

feat(P13): ns subcommands (inherit, set-constraint) + deprecation warnings (REQ-068)

2026-08-07 07:47:28 +00:00

doctor_audit_modes_test.go

feat(P05): seal/audit CLI + chain race fix + key zeroing (REQ-154)

2026-08-07 21:06:39 +00:00

doctor_nft_test.go

feat(P15.5): threat model (C-19) + ingress hybrid (R-017, REQ-099..102) + doctor mTLS (REQ-118)

2026-08-07 08:35:06 +00:00

doctor_nft.go

feat(P15.5): threat model (C-19) + ingress hybrid (R-017, REQ-099..102) + doctor mTLS (REQ-118)

2026-08-07 08:35:06 +00:00

doctor_test.go

fix(P09): migration + operational safety — job stop, retention, logs cap (REQ-158)

2026-08-10 13:37:28 +00:00

doctor.go

fix(P09): migration + operational safety — job stop, retention, logs cap (REQ-158)

2026-08-10 13:37:28 +00:00

drain_test.go

feat(P05): drain + daemon drain-and-stop (REQ-061) + job migrate (REQ-116)

2026-08-07 05:17:01 +00:00

drain.go

fix(P08): transport + SSH safety — typed errors, IPv6, timeouts, signal (REQ-157)

2026-08-10 13:11:07 +00:00

drift_test.go

feat(P10b): drift detection (R-018/R-019/R-020, REQ-103..113)

2026-08-07 07:17:41 +00:00

drift.go

fix(P08): transport + SSH safety — typed errors, IPv6, timeouts, signal (REQ-157)

2026-08-10 13:11:07 +00:00

init_test.go

fix(P01): bump go toolchain to 1.25.12 + fix pre-existing test bugs (REQ-149)

2026-08-07 19:07:17 +00:00

init.go

feat(P2): podman traefik reconciler + TLS model fix (REQ-172)

2026-08-10 20:04:20 +00:00

job_dispatch_test.go

feat(P03): wire scheduler into job run + fix jobspec parser (REQ-151, REQ-152)

2026-08-07 19:59:31 +00:00

job_dispatch.go

feat(C): remote deployment correctness — PVE runtime, DB record, Traefik (REQ-166)

2026-08-10 16:21:50 +00:00

job_lint_test.go

feat(P03): wire scheduler into job run + fix jobspec parser (REQ-151, REQ-152)

2026-08-07 19:59:31 +00:00

job_lint.go

feat(P03): wire scheduler into job run + fix jobspec parser (REQ-151, REQ-152)

2026-08-07 19:59:31 +00:00

job_test.go

fix(P09): migration + operational safety — job stop, retention, logs cap (REQ-158)

2026-08-10 13:37:28 +00:00

job_verify_test.go

feat(P11,P12): orca job lint (REQ-084) + orca job verify (dry-run txn)

2026-08-07 07:29:44 +00:00

job_verify.go

feat(P11,P12): orca job lint (REQ-084) + orca job verify (dry-run txn)

2026-08-07 07:29:44 +00:00

job.go

feat(C): remote deployment correctness — PVE runtime, DB record, Traefik (REQ-166)

2026-08-10 16:21:50 +00:00

logs_test.go

fix(P09): migration + operational safety — job stop, retention, logs cap (REQ-158)

2026-08-10 13:37:28 +00:00

logs.go

fix(P09): migration + operational safety — job stop, retention, logs cap (REQ-158)

2026-08-10 13:37:28 +00:00

metrics_test.go

feat(P10): observability expansion — metrics + security headers (REQ-159)

2026-08-10 13:44:04 +00:00

metrics.go

feat(P10): observability expansion — metrics + security headers (REQ-159)

2026-08-10 13:44:04 +00:00

namespace_test.go

fix(P09): migration + operational safety — job stop, retention, logs cap (REQ-158)

2026-08-10 13:37:28 +00:00

nft_test.go

fix(P02): input validation + injection hardening — 11 vectors (REQ-150)

2026-08-07 19:28:01 +00:00

nft.go

fix(P02): input validation + injection hardening — 11 vectors (REQ-150)

2026-08-07 19:28:01 +00:00

node_capacity_test.go

feat(D): capacity auto-discovery + partial updates + ACL debug + UX (REQ-168,169)

2026-08-10 16:33:27 +00:00

node_capacity.go

feat(D): capacity auto-discovery + partial updates + ACL debug + UX (REQ-168,169)

2026-08-10 16:33:27 +00:00

node_test.go

feat(P12): --type linux SSH-join + UAT plan + signoff script (REQ-161..163)

2026-08-10 14:33:29 +00:00

node.go

feat(B): Traefik deployment to all nodes during init/join (REQ-165, REQ-167)

2026-08-10 16:09:48 +00:00

ns_test.go

fix(P02): namespace path traversal (REQ-120, F4)

2026-08-07 10:55:18 +00:00

ns.go

fix(P07): concurrency safety — SQLite, flock, cache, atomic writes (REQ-156)

2026-08-10 12:27:05 +00:00

osdetect_test.go

feat(P03): doctor os + doctor proxmox + audit logging

2026-08-03 19:59:51 +00:00

osdetect.go

feat(P03): doctor os + doctor proxmox + audit logging

2026-08-03 19:59:51 +00:00

peer_setup.go

fix(P08): transport + SSH safety — typed errors, IPv6, timeouts, signal (REQ-157)

2026-08-10 13:11:07 +00:00

recovery_test.go

feat(P07): recovery (orca restore) — verified restore + alloc protection

2026-08-07 05:47:01 +00:00

recovery.go

fix(P07): concurrency safety — SQLite, flock, cache, atomic writes (REQ-156)

2026-08-10 12:27:05 +00:00

root_test.go

feat(P02): HCL config file parsing — internal/config package (REQ-054)

2026-08-04 00:09:33 +00:00

root.go

fix(P08): transport + SSH safety — typed errors, IPv6, timeouts, signal (REQ-157)

2026-08-10 13:11:07 +00:00

rotate_lead.go

fix(P08): transport + SSH safety — typed errors, IPv6, timeouts, signal (REQ-157)

2026-08-10 13:11:07 +00:00

rotate_master_reseal_test.go

feat(P05): seal/audit CLI + chain race fix + key zeroing (REQ-154)

2026-08-07 21:06:39 +00:00

secrets_test.go

feat(P03): secrets subsystem (REQ-080) — AES-256-GCM + HKDF-SHA256 per-ns

2026-08-07 04:47:33 +00:00

secrets.go

fix(P07): concurrency safety — SQLite, flock, cache, atomic writes (REQ-156)

2026-08-10 12:27:05 +00:00

signal_handler_test.go

fix(P08): transport + SSH safety — typed errors, IPv6, timeouts, signal (REQ-157)

2026-08-10 13:11:07 +00:00

status_test.go

test(cli): coverage uplift to ≥70% excl daemon.go (T01.6, REQ-057)

2026-08-04 01:43:38 +00:00

status.go

docs(P11): doc drift round 2 — README, cli.md, CHANGELOG, verify-reqs (REQ-160)

2026-08-10 14:18:27 +00:00

traefik_install.go

feat(P2): podman traefik reconciler + TLS model fix (REQ-172)

2026-08-10 20:04:20 +00:00

txn_test.go

fix(P04): wire ACL enforcement + WebAuthn reg auth + audit actor (REQ-153)

2026-08-07 20:33:39 +00:00

txn.go

fix(P08): transport + SSH safety — typed errors, IPv6, timeouts, signal (REQ-157)

2026-08-10 13:11:07 +00:00

upgrade_test.go

fix(P09): migration + operational safety — job stop, retention, logs cap (REQ-158)

2026-08-10 13:37:28 +00:00

upgrade.go

feat(P2): podman traefik reconciler + TLS model fix (REQ-172)

2026-08-10 20:04:20 +00:00

validate.go

fix(P02): input validation + injection hardening — 11 vectors (REQ-150)

2026-08-07 19:28:01 +00:00

version_test.go

test(cli): coverage uplift to ≥70% excl daemon.go (T01.6, REQ-057)

2026-08-04 01:43:38 +00:00

version.go

ship: v0.1 Foundation milestone complete (#1)

2026-06-03 20:08:57 +00:00

watch_test.go

feat(C): remote deployment correctness — PVE runtime, DB record, Traefik (REQ-166)

2026-08-10 16:21:50 +00:00

workload_test.go

fix(P06): workloadToTaskSpecs command split + runnable examples

2026-08-05 21:23:32 +00:00