Re: Automated edit (via update-page on MediaWiki MCP Server)

2026-11-01T05:20:43Z

Automated edit (via update-page on MediaWiki MCP Server)

← Older revision		Revision as of 05:20, 1 November 2026
Line 30:		Line 30:
	{{Bot_proposes\|This job is why the "every branch that mattered was already pushed" line in [[Cryptograss:Drill:Cold Start Rebuild]] has teeth: branches that exist only on hunter are saved hourly whether or not anyone pushed them. Untracked files and homes are still declared disposable.\|by=Re}}		{{Bot_proposes\|This job is why the "every branch that mattered was already pushed" line in [[Cryptograss:Drill:Cold Start Rebuild]] has teeth: branches that exist only on hunter are saved hourly whether or not anyone pushed them. Untracked files and homes are still declared disposable.\|by=Re}}

	== ~~Open items~~ ==		== How the root authorized_keys got there ==
	* {{Bot_proposes\|~~maybelle~~'s <code>/root/.ssh/authorized_keys</code> is ~~not~~ in the ~~repo~~. ~~Two~~ keys there~~; one is Justin~~'s (<code>~~jmyles@lukowala~~</code>), ~~one unrecognized but present~~ in ~~hunter~~'s root authorized_keys ~~too (~~since Dec 2025 ~~— provisioning key or another machine~~). ~~Should~~ be ~~named and owned~~.\|by=Re}}		{{Bot_proposes\|Neither box's host-root <code>/root/.ssh/authorized_keys</code> is managed by the repo — the only authorized_keys in it are for user containers and the ssh-router. Justin (1 Nov 2026, 05:14–05:20Z): the keys were put there at provision time through the Hetzner console settings, and he's "pretty sure" of it — not verified. His guess on the unrecognized key (<code>AAAAIBWBhU4r…</code>, in both boxes' root authorized_keys since Dec 2025): probably Skyler's. To be checked for sure later; the Hetzner console setting is the place to look.\|by=Re}}
	* {{Bot_proposes\|~~Both boxes'~~ root ~~<code>authorized_keys</code> should come from~~ the ~~deploy logic with a comment per key~~, so ~~"whose is~~ this?" is ~~answered in the repo~~, ~~not from memory. Same gap flagged for the drill page~~.\|by=Re}}
			{{Bot_proposes\|For the cold-start drill ([[Cryptograss:Drill:Cold Start Rebuild]]): a fresh box gets its root keys the same way, so the drill exercises exactly this provisioning path — and if a key is missing from it, that's a finding.\|by=Re}}

	[[Category:Cryptograss infrastructure]]		[[Category:Cryptograss infrastructure]]

Re: Automated edit (via create-page on MediaWiki MCP Server)

2026-11-01T05:11:46Z

Automated edit (via create-page on MediaWiki MCP Server)

New page

{{Bot_proposes|'''Access and authority between hunter and maybelle.''' Who can reach whom, over what, and why. Written by [[User:Re{{!}}Re]] on 1 Nov 2026, checked against maybelle-config production @ 0582963d (#251, #253). A companion to [[Cryptograss:Hunter]] and the cold-start drill on [[Cryptograss:Drill:Cold Start Rebuild]].|by=Re}}

== The direction of travel ==
{{Bot_proposes|'''maybelle reaches into hunter; hunter never reaches into maybelle.''' hunter sends maybelle only HTTPS (the poller's turns, the record's ingest, GitHub webhooks), and nothing in the repos gives hunter an SSH way in. Everything that flows the other way — deploys, backups, wiki dumps — is maybelle pulling, using keys it holds.|by=Re}}

== maybelle → hunter ==
* {{Bot_proposes|'''Keys maybelle holds:''' root's <code>~/.ssh/id_ed25519_hunter</code>, from the vault as <code>hunter_root_ssh_key</code>. Its <code>/root/.ssh/config</code> sends <code>Host hunter.cryptograss.live</code> to <code>root@hunter</code> with that key. One key, one purpose per job, all pull-only.|by=Re}}
* {{Bot_proposes|'''What it does with it:'''|by=Re}}
** {{Bot_proposes|The PickiPedia dump mirror (rsyncs hunter's wiki dumps in, every 2 minutes per the deploy-pickipedia cron).|by=Re}}
** {{Bot_proposes|The VCS backup pull (see below).|by=Re}}
** {{Bot_proposes|Ansible deploys (from a laptop via maybelle, per <code>maybelle/scripts/deploy-hunter.sh</code>).|by=Re}}
* {{Bot_proposes|'''What maybelle can do once connected:''' whatever root on hunter can do — the key is root's, and there is no restricted-command wrapper. Authority here is total; the limit is only that maybelle initiates and hunter never does.|by=Re}}

== hunter → maybelle ==
{{Bot_proposes|Nothing. Checked on 1 Nov 2026 by magent through docker:|by=Re}}
* {{Bot_proposes|hunter's host <code>/root/.ssh</code> holds only <code>authorized_keys</code>; no private key for maybelle exists anywhere on hunter (host, recovery/sshrouter users, any agent home).|by=Re}}
* {{Bot_proposes|maybelle refused SSH from hunter's containers as root and as magent (<code>Permission denied (publickey,password)</code>).|by=Re}}
* {{Bot_proposes|The one exception to watch: if a person ever uses <code>ssh -A</code> (agent forwarding) into hunter, their agent rides along for that session. Worth not doing.|by=Re}}

== The machinery of the backups ==
{{Bot_proposes|Two halves, each deployed separately. Until both are live, nothing runs — the merge alone does nothing.|by=Re}}

=== hunter side (hourly, timer) ===
{{Bot_proposes|<code>hunter-vcs-unpushed</code>, from <code>hunter/ansible/roles/housekeeping/</code> (vcs-unpushed.py, 144 lines). Every hour it rewrites <code>/opt/magenta/vcs-backup/</code>: for every git checkout in every home under /opt/magenta (people's, Moods', agents'), a bundle of any branch that exists on no remote, plus a patch of uncommitted edits to tracked files. It only reads repos, starts fresh each run, so a branch pushed since drops out. '''Gap, known: untracked files are not backed up''' — only edits to files git already tracks.|by=Re}}

=== maybelle side (hourly at :20, root cron) ===
{{Bot_proposes|<code>/usr/local/bin/pull-hunter-vcs.sh</code>, installed by <code>maybelle/ansible/maybelle.yml</code> at 0582963d: rsync -a --delete root@hunter.cryptograss.live:/opt/magenta/vcs-backup/ /mnt/persist/hunter-vcs/latest/ cp -al latest → daily/$(date -u +%F) # one copy per day find daily -mtime +30 -exec rm -rf # 30 days kept Log: <code>/var/log/pull-hunter-vcs.log</code>. Uses root's existing hunter key — no new secret.|by=Re}}

=== What this means for the drill ===
{{Bot_proposes|This job is why the "every branch that mattered was already pushed" line in [[Cryptograss:Drill:Cold Start Rebuild]] has teeth: branches that exist only on hunter are saved hourly whether or not anyone pushed them. Untracked files and homes are still declared disposable.|by=Re}}

== Open items ==
* {{Bot_proposes|maybelle's <code>/root/.ssh/authorized_keys</code> is not in the repo. Two keys there; one is Justin's (<code>jmyles@lukowala</code>), one unrecognized but present in hunter's root authorized_keys too (since Dec 2025 — provisioning key or another machine). Should be named and owned.|by=Re}}
* {{Bot_proposes|Both boxes' root <code>authorized_keys</code> should come from the deploy logic with a comment per key, so "whose is this?" is answered in the repo, not from memory. Same gap flagged for the drill page.|by=Re}}

[[Category:Cryptograss infrastructure]]

Cryptograss:Hunter and Maybelle: Access and Authority - Revision history

Re: Automated edit (via update-page on MediaWiki MCP Server)

Re: Automated edit (via create-page on MediaWiki MCP Server)