Public: anyone can read this; the crew can change it.
A box of the forge's own runs a restored snapshot as a service, beside production, taking no traffic #9008
Check · Review · Land · Live done — Landed and live in production.
This adds the unit file, the install script and a test that parses the unit. The restore, reboot and kill drills are not done, because they need a real box.
shipped production is serving it deploy e2a191c
This adds the unit file, the install script and a test that parses the unit. The restore, reboot and kill drills are not done, because they need a real box.
I didn't call keep_plan; I don't have that tool here. test/forge-box-unit.test.ts and test/restore-card.test.ts pass, as do scripts/gate.ts and tsc --noEmit. I did not run scripts/fast.ts or bun install.
What changed
infra/forge-box/forge.service: runsbun run src/main.tsfrom/opt/forgeas theforgeuser.
- It sets FORGE_DATA=/var/lib/forge and reads secrets from /etc/forge/forge.env.
- Restart=always, StartLimitIntervalSec=0 (it never gives up restarting) and WantedBy=multi-user.target are meant to bring it back after a killed process or a reboot.
- I added NoNewPrivileges and ProtectSystem=full, which the issue didn't ask for.
scripts/box-install.sh: run as root on the box.
- It creates the user, /var/lib/forge (mode 700) and a commented /etc/forge/forge.env template.
- It copies the checkout to /opt/forge, runs bun install, installs the unit and runs daemon-reload.
- It doesn't restore or start the forge, and it keeps no secrets.
test/forge-box-unit.test.ts: parses the unit and checksExecStart,WorkingDirectory,Restart=always,FORGE_DATA, the user, the boot target and the unlimited restart policy. It also checks the install script places the unit, is executable and has no inline passphrase.docs/EXTRACT.mdanddocs/RESTORE.md: both gain a short section on the box beside production.
Not done, because it needs a machine this sandbox can't reach
- Restoring onto a box.
- Comparing repository and app counts with production.
- Rebooting the box and killing the process to see it return.
- The restore drill that reads only from the bucket.
The box install doesn't pull the proxy, DNS cutover or timers (EXTRACT steps 4–6). Nothing points at the box and nothing is turned off. The owner should run the drill as written in the new docs section, then tick the three remaining boxes.
🤖 Generated with Claude Code
Unit, install script and a test that parses the unit: all present and consistent with RESTORE.md line 7 (FORGE_DATA, bun run src/main.ts). README untouched, no new dependency, no secret in the script. Two things I would do next: (1) have the drill itself run on a real box and record the counts, reboot and kill results in docs/EXTRACT.md; (2) tell the reader in RESTORE.md to load /etc/forge/forge.env (set -a; . /etc/forge/forge.env) before lines 3-6 as the forge user, since the template holds the snapshot/S3 settings those lines export, and note PORT/FORGE_SSH_PORT so the box does not clash with production if they share a host. Boxes 2-4 need a real machine and are the owner's drill, so they stay open.
Left #8945 open: 3 unticked items remain (A snapshot restores onto the box; the forge boots, / answers, every repository and app is there (counts compared with production).; The box survives a reboot and a killed process and comes back by itself.; Restoring needs nothing from the platform: read from the bucket by the restore card's lines only. This is the restore drill the spin-down waits for.).
This adds the unit file, the install script and a test that parses the unit. The restore, reboot and kill drills are not done, because they need a real box.
I didn't call
keep_plan; I don't have that tool here.test/forge-box-unit.test.tsandtest/restore-card.test.tspass, as doscripts/gate.tsandtsc --noEmit. I did not runscripts/fast.tsorbun install.What changed
infra/forge-box/forge.service: runsbun run src/main.tsfrom/opt/forgeas theforgeuser.- It sets
FORGE_DATA=/var/lib/forgeand reads secrets from/etc/forge/forge.env. -Restart=always,StartLimitIntervalSec=0(it never gives up restarting) andWantedBy=multi-user.targetare meant to bring it back after a killed process or a reboot. - I addedNoNewPrivilegesandProtectSystem=full, which the issue didn't ask for.scripts/box-install.sh: run as root on the box.- It creates the user,
/var/lib/forge(mode 700) and a commented/etc/forge/forge.envtemplate. - It copies the checkout to/opt/forge, runsbun install, installs the unit and runsdaemon-reload. - It doesn't restore or start the forge, and it keeps no secrets.test/forge-box-unit.test.ts: parses the unit and checksExecStart,WorkingDirectory,Restart=always,FORGE_DATA, the user, the boot target and the unlimited restart policy. It also checks the install script places the unit, is executable and has no inline passphrase.docs/EXTRACT.mdanddocs/RESTORE.md: both gain a short section on the box beside production.Not done, because it needs a machine this sandbox can't reach
The box install doesn't pull the proxy, DNS cutover or timers (EXTRACT steps 4–6). Nothing points at the box and nothing is turned off. The owner should run the drill as written in the new docs section, then tick the three remaining boxes.
🤖 Generated with Claude Code
Closes #8945