chore: decommission ScanA11y (sa-core scanner, both vhosts, LDAP tenant, mail + nb references) #244

Open

dominik.polakovics wants to merge 2 commits from afk/243 into main

dominik.polakovics commented

2026-07-30 12:01:25 +02:00

Owner

Closes #243

Retires ScanA11y across the fleet per the settled scope in the issue. Two commits:

Commit 1 — the decommission

web-arm: deletes modules/sa-core.nix, modules/scana11y.nix, pkgs/sa-core.nix, sites/scana11y.com.nix, sites/stage.scana11y.com.nix; drops the overlay line, both site imports, both module imports, the stale "comment out for first build" note, and the commented-out # ./modules/a11ywatch.nix.
mail: drops the dc=scana11y,dc=com tenant from openldap.nix — it was the last list entry, so the remaining tenants keep {03}–{06} unchanged. The index comment now states the real rule (lib.imap1 (i: mkTenant (i + 2)) → index = position + 2) instead of the {03} {04} {06} {08} {09} numbers the code never produced. Also drops the doveadm user *@scana11y.com sync block from dovecot.nix. No postfix change (LDAP-driven).
nb/shared: removes the office@scana11y.com Thunderbird account, the ScanA11y/sa-core clone line, and the project_history.json entry (wohnservice entries untouched).
One small addition beyond the issue's file list: hosts/dev-new/modules/coding-lab/default.nix had a comment citing the now-deleted sa-core.nix as a pattern example; the mention is dropped so the comment doesn't point at a dead file.

Commit 2 — separate, per the issue: deletes hosts/web-arm/modules/pa11y.nix and modules/a11ywatch.nix (byte-identical duplicates, neither imported).

Deliberately untouched: hosts/web-arm/secrets.yaml (sa-core-mailpw comes out by hand via sops), ADR 0016's SPF list (historical record), CONTEXT.md, and the unimported allywatch.nix copies on fw (outside the issue's scope).

⚠️ Merge gate (human, on mail, before merging)

Purge the LDAP subtree while the tenant is still served, to avoid a third orphan in the shared LMDB env:

ldapdelete -r -D cn=admin,dc=cloonar,dc=com -W dc=scana11y,dc=com
ldapsearch  -b dc=scana11y,dc=com   # expect: No such object

Only then merge (bento deploys to web-arm, mail, nb within ~5 min). Post-deploy host cleanup checklist is in #243.

Validation

No system Nix exists in this run's sandbox, so the pre-commit hook could not execute; commits used --no-verify after running the equivalent gate manually: ./scripts/test-configuration web-arm, mail and nb (the hosts the issue names) all exit 0 against the pinned nixos-26.05 channel via a portable Nix (nix-instantiate 2.20.6), web-arm re-checked after commit 2. Only pre-existing evaluation warnings (option renames etc.) appear. Since no dry-build check appears on the PR, re-running those three from a nix-capable checkout before merging is still recommended, per the issue.

Closes #243 Retires ScanA11y across the fleet per the settled scope in the issue. Two commits: **Commit 1 — the decommission** - **web-arm**: deletes `modules/sa-core.nix`, `modules/scana11y.nix`, `pkgs/sa-core.nix`, `sites/scana11y.com.nix`, `sites/stage.scana11y.com.nix`; drops the overlay line, both site imports, both module imports, the stale "comment out for first build" note, and the commented-out `# ./modules/a11ywatch.nix`. - **mail**: drops the `dc=scana11y,dc=com` tenant from `openldap.nix` — it was the **last** list entry, so the remaining tenants keep `{03}`–`{06}` unchanged. The index comment now states the real rule (`lib.imap1 (i: mkTenant (i + 2))` → index = position + 2) instead of the `{03} {04} {06} {08} {09}` numbers the code never produced. Also drops the `doveadm user *@scana11y.com` sync block from `dovecot.nix`. No postfix change (LDAP-driven). - **nb/shared**: removes the `office@scana11y.com` Thunderbird account, the `ScanA11y/sa-core` clone line, and the `project_history.json` entry (wohnservice entries untouched). - One small addition beyond the issue's file list: `hosts/dev-new/modules/coding-lab/default.nix` had a comment citing the now-deleted `sa-core.nix` as a pattern example; the mention is dropped so the comment doesn't point at a dead file. **Commit 2 — separate, per the issue**: deletes `hosts/web-arm/modules/pa11y.nix` and `modules/a11ywatch.nix` (byte-identical duplicates, neither imported). **Deliberately untouched**: `hosts/web-arm/secrets.yaml` (`sa-core-mailpw` comes out by hand via sops), ADR 0016's SPF list (historical record), CONTEXT.md, and the unimported `allywatch.nix` copies on fw (outside the issue's scope). ## ⚠️ Merge gate (human, on mail, before merging) Purge the LDAP subtree **while the tenant is still served**, to avoid a third orphan in the shared LMDB env: ``` ldapdelete -r -D cn=admin,dc=cloonar,dc=com -W dc=scana11y,dc=com ldapsearch -b dc=scana11y,dc=com # expect: No such object ``` Only then merge (bento deploys to web-arm, mail, nb within ~5 min). Post-deploy host cleanup checklist is in #243. ## Validation No system Nix exists in this run's sandbox, so the pre-commit hook could not execute; commits used `--no-verify` after running the equivalent gate manually: `./scripts/test-configuration web-arm`, `mail` and `nb` (the hosts the issue names) all exit 0 against the pinned nixos-26.05 channel via a portable Nix (nix-instantiate 2.20.6), web-arm re-checked after commit 2. Only pre-existing evaluation warnings (option renames etc.) appear. Since no dry-build check appears on the PR, re-running those three from a nix-capable checkout before merging is still recommended, per the issue.

dominik.polakovics added 2 commits

2026-07-30 12:01:25 +02:00

chore: decommission ScanA11y across the fleet d0b9aca069

web-arm: drop the sa-core scanner (module, package, overlay entry) and
both scana11y vhosts, plus the stale first-build note and commented-out
a11ywatch import. mail: drop the dc=scana11y,dc=com LDAP tenant (last in
the list, so the remaining tenants keep {03}-{06}) and the doveadm sync
block; the tenant index comment now states the real imap1 rule instead
of numbers the code never produced. nb/shared: remove the Thunderbird
account, the sa-core clone line, the project_history entry, and a stale
sa-core.nix example in dev-new's coding-lab comment.

Host-state and LDAP cleanup are manual, per the issue: merge is held
until the dc=scana11y,dc=com subtree is purged while still served.

Hook bypassed: no system nix in this environment; equivalent dry-builds
for web-arm, mail and nb ran green via scripts/test-configuration with a
portable nix.

chore(web-arm): delete unimported pa11y/a11ywatch duplicate modules dac736c9ed

Byte-identical copies of the same config; neither has been imported
since the a11ywatch experiment ended, and the dashboards they described
are retired with ScanA11y (#243).

This pull request has changes conflicting with the target branch.

hosts/web-arm/configuration.nix
hosts/web-arm/overlays/packages.nix
hosts/web-arm/sites/default.nix

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title

Merge pull request 'chore: decommission ScanA11y (sa-core scanner, both vhosts, LDAP tenant, mail + nb references)' (#244) from afk/243 into main

Merge commit body

Reviewed-on: https://git.cloonar.com/Cloonar/nixos/pulls/244

Merge pull request 'chore: decommission ScanA11y (sa-core scanner, both vhosts, LDAP tenant, mail + nb references)' (#244) from afk/243 into main

Reviewed-on: https://git.cloonar.com/Cloonar/nixos/pulls/244

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin afk/243:afk/243

git switch afk/243

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff afk/243

git switch afk/243

git rebase main

git switch main

git merge --ff-only afk/243

git switch afk/243

git rebase main

git switch main

git merge --no-ff afk/243

git switch main

git merge --squash afk/243