feat(deckle-01): kill switch for the control plane that keeps the sites online #594

Open

dominik.polakovics wants to merge 1 commit from lab/20261101-0139 into main

dominik.polakovics commented

2026-11-01 01:54:52 +01:00

Owner

Closes #593

What

services.deckle-hosted.controlPlane.enable (default true). Set to false on hosts/deckle-01/configuration.nix it masks deckle-hosted.service, deckle-build-image.service and the trash-purge timer. Caddy and the 02:30 database dump keep running, the sops restartUnits and the metrics monitoredServices drop the unit so a switched-off control plane neither fails activation nor pages anyone.

New runbook docs/runbooks/deckle-kill-switch.md: the immediate systemctl stop, the durable flip, and what stops working meanwhile. ADR-0032 gets a consequence bullet pointing at it.

Why it keeps the sites online

deploy/Caddyfile serves <slug>.<base> and custom hostnames with file_server from <data_dir>/docroot; the control plane is only the reverse-proxy upstream for the dashboard, editor, previews, git, /.deckle-hosted/* (contact form, appointments widget), redirect hosts and the on-demand TLS ask. Caddy's unit is after deckle-hosted, not requires, so masking the control plane does not touch it.

Known gaps while switched off, all listed in the runbook: contact form and appointments widget, www./old-slug redirects, and new or renewing TLS certificates (Caddy asks the control plane before issuing; renewals start a month before expiry, so days are harmless).

Verification

Standalone eval of the module against the 26.05 channel with the switch true and false: with false, systemd.units has deckle-hosted.service, deckle-build-image.service and deckle-hosted-trash-purge.service at enable = false (masked), the trash-purge timer is gone, caddy.service stays enabled and the db-dump timer stays.
The full scripts/test-configuration deckle-01 dry-build did not run: the lab gateway blocks the sops-nix tarball download from GitHub, and the pre-commit symlink in this bare checkout is dangling. Please let the hook run on your clone before merging.

🤖 Generated with Claude Code

Closes #593 ## What `services.deckle-hosted.controlPlane.enable` (default `true`). Set to `false` on `hosts/deckle-01/configuration.nix` it masks `deckle-hosted.service`, `deckle-build-image.service` and the trash-purge timer. Caddy and the 02:30 database dump keep running, the sops `restartUnits` and the metrics `monitoredServices` drop the unit so a switched-off control plane neither fails activation nor pages anyone. New runbook `docs/runbooks/deckle-kill-switch.md`: the immediate `systemctl stop`, the durable flip, and what stops working meanwhile. ADR-0032 gets a consequence bullet pointing at it. ## Why it keeps the sites online `deploy/Caddyfile` serves `<slug>.<base>` and custom hostnames with `file_server` from `<data_dir>/docroot`; the control plane is only the reverse-proxy upstream for the dashboard, editor, previews, git, `/.deckle-hosted/*` (contact form, appointments widget), redirect hosts and the on-demand TLS `ask`. Caddy's unit is `after` deckle-hosted, not `requires`, so masking the control plane does not touch it. Known gaps while switched off, all listed in the runbook: contact form and appointments widget, `www.`/old-slug redirects, and new or renewing TLS certificates (Caddy asks the control plane before issuing; renewals start a month before expiry, so days are harmless). ## Verification - Standalone eval of the module against the 26.05 channel with the switch `true` and `false`: with `false`, `systemd.units` has `deckle-hosted.service`, `deckle-build-image.service` and `deckle-hosted-trash-purge.service` at `enable = false` (masked), the trash-purge timer is gone, `caddy.service` stays enabled and the db-dump timer stays. - The full `scripts/test-configuration deckle-01` dry-build did **not** run: the lab gateway blocks the sops-nix tarball download from GitHub, and the pre-commit symlink in this bare checkout is dangling. Please let the hook run on your clone before merging. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dominik.polakovics added 1 commit

2026-11-01 01:54:52 +01:00

feat(deckle-01): kill switch for the control plane that keeps the sites online 4328d33e38

services.deckle-hosted.controlPlane.enable = false masks the control plane,
the image build and the trash purge; Caddy keeps serving the published sites
from the docroot and the database dump keeps running. Runbook in
docs/runbooks/deckle-kill-switch.md.

Closes #593

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin lab/20261101-0139:lab/20261101-0139

git switch lab/20261101-0139

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff lab/20261101-0139

git switch lab/20261101-0139

git rebase main

git switch main

git merge --ff-only lab/20261101-0139

git switch lab/20261101-0139

git rebase main

git switch main

git merge --no-ff lab/20261101-0139

git switch main

git merge --squash lab/20261101-0139