Part of #11804, step 1 (docs/OPERATING.md, "The vxrail without a control plane"). Nothing moves; the pod keeps serving.
Done:
[ ] infra/forge-box/forge.service starts src/release/launch.ts (the supervisor of swaps, as in the image), with Delegate=yes so cells get their cgroup, and FORGE_CELL_MOUNTS=allow-list (off Kubernetes the default is deny-list, which lets a cell see the host's mounts); test/forge-box-unit.test.ts holds all three.
[ ] scripts/box-install.sh checks for bubblewrap, chromium and socat beside bun and git, writes /etc/sysctl.d/90-forge.conf with net.ipv4.tcp_migrate_req=1, and makes the forge user with a uid given as an argument (the pod's, so the volume's files need no chown).
[ ] infra/forge-box/cloudflared-forge.service and its config: the tunnel's connector on the host, ingress to http://127.0.0.1:3000 for forge.open-platform.sh, --forge.open-platform.sh, --forge-trevato-apps.open-platform.sh and each app's own domain (the list #11803 writes). Installed, not started.
[ ] forge-github-mirror is a timer on the vxrail (pushing twice is harmless, so it runs beside pg-grand's until that one is stopped).
[ ] On the vxrail, a person runs the install and a restore of the newest backup (#11805) into a scratch directory under the unit on another port with FORGE_SSH_PORT=0; it boots and answers /. The result goes on this issue.
Rollback: systemctl disable --now forge cloudflared-forge, remove /etc/sysctl.d/90-forge.conf. Nothing pointed at it.
Part of #11804, step 1 (docs/OPERATING.md, "The vxrail without a control plane"). Nothing moves; the pod keeps serving.
Done:
infra/forge-box/forge.servicestartssrc/release/launch.ts(the supervisor of swaps, as in the image), withDelegate=yesso cells get their cgroup, andFORGE_CELL_MOUNTS=allow-list(off Kubernetes the default is deny-list, which lets a cell see the host's mounts);test/forge-box-unit.test.tsholds all three.scripts/box-install.shchecks for bubblewrap, chromium and socat beside bun and git, writes/etc/sysctl.d/90-forge.confwithnet.ipv4.tcp_migrate_req=1, and makes theforgeuser with a uid given as an argument (the pod's, so the volume's files need no chown).infra/forge-box/cloudflared-forge.serviceand its config: the tunnel's connector on the host, ingress tohttp://127.0.0.1:3000for forge.open-platform.sh,--forge.open-platform.sh,--forge-trevato-apps.open-platform.shand each app's own domain (the list #11803 writes). Installed, not started.forge-github-mirroris a timer on the vxrail (pushing twice is harmless, so it runs beside pg-grand's until that one is stopped).FORGE_SSH_PORT=0; it boots and answers/. The result goes on this issue.Rollback:
systemctl disable --now forge cloudflared-forge, remove/etc/sysctl.d/90-forge.conf. Nothing pointed at it.Files: infra/forge-box/forge.service, infra/forge-box/cloudflared-forge.service, scripts/box-install.sh, test/forge-box-unit.test.ts, docs/EXTRACT.md