Реализованы сервисы ВМ2 - проверка сообщений и синхронизация с Б24 (деплой еще без перевода в боевой режим)

2026-08-13 18:52:42 +03:00
parent 5100ba9fc3
commit 99605b1c77
144 changed files with 15295 additions and 1120 deletions
@@ -4,6 +4,90 @@ This is the executable checklist for the single-VM contour. PostgreSQL and S3
 are managed external services. Never use `docker compose down -v`, an Alembic
 downgrade, or a mutable image tag during deployment.

+## VM2 Processing is a separate host
+
+Do not run this backend/VM1 setup script on VM2. VM2 has its own bootstrap:
+`codebase/services/deployment/scripts/setup-vm.sh`, and its authoritative
+operator checklist is `codebase/services/deployment/RUNBOOK.ru.md`.
+
+The VM2 ownership boundary is intentionally different from the legacy VM1
+script: `deploy` is **not** a member of the `docker` group. Root owns
+`/opt/han-chat/services`, Compose, units, helpers, `.env`, allow-lists and
+secret mappings. Deploy may write only to `/var/lib/han-deploy/incoming` and
+may invoke exact systemd/safety-mode commands installed in sudoers.
+The separate `admin` account is break-glass only: it has its own Ed25519 key
+and a separate local sudo password. Root, deploy and admin keys must differ.
+
+Initial VM2 bootstrap commands:
+
+```sh
+# Local operator workstation: upload only the reviewed setup script.
+scp codebase/services/deployment/scripts/setup-vm.sh \
+  root@<VM2_PUBLIC_IP>:/root/setup-vm2.sh
+
+# VM2 root: install host packages/roles/firewalls; this does not start Compose.
+chmod 0700 /root/setup-vm2.sh
+DEPLOY_AUTHORIZED_KEY_FILE=/root/bootstrap/deploy.pub \
+ADMIN_AUTHORIZED_KEY_FILE=/root/bootstrap/admin.pub \
+OPS_CIDRS='<OPS_PUBLIC_IP>/32' \
+VM1_PRIVATE_CIDRS='<VM1_PRIVATE_IP>/32' \
+/root/setup-vm2.sh
+```
+
+Generate and upload the two public keys before this command; never copy the
+root key into either account. Set the admin sudo password with `passwd admin`.
+Keep the root session open and verify both key-based logins plus `sudo -v` as
+admin in separate sessions. Only then rerun as VM2 root with
+`HARDEN_SSH=true SKIP_APT_UPGRADE=true` to disable direct root SSH.
+
+Release transfer is performed as deploy, while activation and installation
+remain root operations:
+
+```sh
+# deploy: receive and inspect only.
+cd /var/lib/han-deploy/incoming
+sha256sum vm2-services-<RELEASE>.tar.gz
+tar -tzf vm2-services-<RELEASE>.tar.gz
+
+# root: verify the operator-provided digest, activate root-owned files,
+# then rerun setup-vm.sh so it installs fixed helpers and systemd units.
+printf '%s  %s\n' '<EXPECTED_SHA256>' \
+  /var/lib/han-deploy/incoming/vm2-services-<RELEASE>.tar.gz | sha256sum --check -
+ARCHIVE=/var/lib/han-deploy/incoming/vm2-services-<RELEASE>.tar.gz
+if tar -tzf "$ARCHIVE" | grep -Eq '(^/|(^|/)\.\.(/|$)|^services/\.env$)'; then exit 1; fi
+if tar -tzf "$ARCHIVE" | grep -Ev '^services(/|$)' | grep -q .; then exit 1; fi
+if tar -tvzf "$ARCHIVE" | awk '$1 ~ /^[lh]/ {found=1} END {exit !found}'; then exit 1; fi
+STAGING="$(mktemp -d /opt/han-chat/.vm2-release.XXXXXX)"
+tar -xzf "$ARCHIVE" \
+  -C "$STAGING" --no-same-owner --no-same-permissions
+test -f "$STAGING/services/docker-compose.yml"
+rsync -a --delete --exclude=.env --chown=root:root --chmod=D755,F644 \
+  "$STAGING/services/" /opt/han-chat/services/
+rm -rf -- "$STAGING"
+OPS_CIDRS='<OPS_PUBLIC_IP>/32' \
+VM1_PRIVATE_CIDRS='<VM1_PRIVATE_IP>/32' \
+DEPLOY_AUTHORIZED_KEY_FILE=/root/bootstrap/deploy.pub \
+ADMIN_AUTHORIZED_KEY_FILE=/root/bootstrap/admin.pub \
+HARDEN_SSH=true SKIP_APT_UPGRADE=true \
+/root/setup-vm2.sh
+```
+
+After root configures `.env`, Selectel encrypted credentials, loader mapping,
+TLS and CIDR allow-lists, root synchronizes secrets, runs preflight/migrations
+and performs the first start. Subsequent routine operations available to
+deploy are limited to:
+
+```sh
+sudo systemctl restart han-secrets-vm2.service
+sudo systemctl restart han-processing.service
+sudo systemctl --no-pager status han-processing.service
+sudo journalctl --no-pager -u han-processing.service
+```
+
+Exact archive activation, file installation, credential creation, migration
+and first-start commands are documented in the VM2 Russian runbook referenced
+above. They must not be replaced with direct Docker access for deploy.
+
 ## Gate 0 — decisions and ownership

 - [ ] Release SHA/digests, maintenance window, on-call and rollback owner recorded.