First tagged release + compose smoke

eva commented

2026-10-07 02:41:56 +00:00

Owner

Why

helix-proxy still has zero tags. Tip is ready enough for a first freeze — we need a tagged release and a compose smoke on lab that proves admin login, one proxy-host round-trip, and the cert path. No feature work in this pass.

Scope

Tag tip of default branch as v0.1.0 (or the next sensible semver if something already landed under that name — there are no tags today).
docker compose up on lab against that tip.
Prove admin login works.
Prove one proxy-host request round-trips.
Prove the cert path (Let's Encrypt or custom — whatever the tip actually supports on lab).
Release notes must document token / JWT_SECRET (compose already notes the random data/.jwt_secret fallback — make the contract explicit in the notes).

Acceptance

Tip tagged (v0.1.0 or next)
docker compose up on lab against that tip
Admin login proven
One proxy-host round-trip proven
Cert path proven
Release notes document token / JWT_SECRET
No new features in the release

Out of scope

New proxy features, UI polish, or storage backends
Publishing admin :81 on untrusted networks
Reworking auth beyond documenting the current secret contract

Do not merge yourself when coding — open a PR and wait for review.

## Why helix-proxy still has zero tags. Tip is ready enough for a first freeze — we need a tagged release and a compose smoke on lab that proves admin login, one proxy-host round-trip, and the cert path. No feature work in this pass. ## Scope - Tag tip of default branch as `v0.1.0` (or the next sensible semver if something already landed under that name — there are no tags today). - `docker compose up` on lab against that tip. - Prove admin login works. - Prove one proxy-host request round-trips. - Prove the cert path (Let's Encrypt or custom — whatever the tip actually supports on lab). - Release notes must document token / `JWT_SECRET` (compose already notes the random `data/.jwt_secret` fallback — make the contract explicit in the notes). ## Acceptance - [ ] Tip tagged (`v0.1.0` or next) - [ ] `docker compose up` on lab against that tip - [ ] Admin login proven - [ ] One proxy-host round-trip proven - [ ] Cert path proven - [ ] Release notes document token / `JWT_SECRET` - [ ] No new features in the release ## Out of scope - New proxy features, UI polish, or storage backends - Publishing admin `:81` on untrusted networks - Reworking auth beyond documenting the current secret contract Do not merge yourself when coding — open a PR and wait for review.

eva was assigned by Ghost

2026-10-07 03:20:25 +00:00

Ghost commented

2026-10-07 03:20:25 +00:00

Progress + blocked (compose smoke)

Done

Tagged tip of master as 0.1.0 @ 084d661 (release CI rejects v-prefix; used 0.1.0 not v0.1.0)
Release CI green (run 2138) — linux amd64/arm64 archives attached
Release notes now explicitly document JWT_SECRET / data/.jwt_secret fallback contract
No feature work in this cut

Blocked — need Jerry lab host access

Pike cannot finish acceptance smoke from jumpbox:

jumpbox has no docker/podman
pike SSH to dockge.lab.rrd / proxy.lab.rrd / nas.lab.rrd / ai.lab.rrd → Permission denied (publickey)
(proxy.lab.rrd:81 currently serves Nginx Proxy Manager, not helix)

Need from Jerry: either (1) grant pike SSH + docker on a lab host that can docker compose up against tip/0.1.0, preferably an existing Jerry path under /opt/stacks on dockge, or (2) run the compose smoke and paste evidence (admin login, one proxy-host round-trip, cert path) on this issue.

Assignees set to eva for forge routing (Jerry has no Gitea user). Drop blocked once smoke lands.

Default if no answer: leave 0.1.0 tagged + notes done; smoke stays parked under blocked until Jerry grants access or runs it — no force-tag delete, no inventing infra.

## Progress + blocked (compose smoke) ### Done - Tagged tip of `master` as **`0.1.0`** @ `084d661` (release CI rejects `v`-prefix; used `0.1.0` not `v0.1.0`) - Release CI green (run 2138) — linux amd64/arm64 archives attached - Release notes now explicitly document **`JWT_SECRET`** / `data/.jwt_secret` fallback contract - No feature work in this cut ### Blocked — need Jerry lab host access Pike cannot finish acceptance smoke from jumpbox: - jumpbox has **no docker/podman** - `pike` SSH to `dockge.lab.rrd` / `proxy.lab.rrd` / `nas.lab.rrd` / `ai.lab.rrd` → **Permission denied (publickey)** - (proxy.lab.rrd:81 currently serves Nginx Proxy Manager, not helix) **Need from Jerry:** either (1) grant `pike` SSH + docker on a lab host that can `docker compose up` against tip/`0.1.0`, preferably an existing Jerry path under `/opt/stacks` on dockge, or (2) run the compose smoke and paste evidence (admin login, one proxy-host round-trip, cert path) on this issue. Assignees set to **eva** for forge routing (Jerry has no Gitea user). Drop `blocked` once smoke lands. **Default if no answer:** leave `0.1.0` tagged + notes done; smoke stays parked under `blocked` until Jerry grants access or runs it — no force-tag delete, no inventing infra.

Ghost added the

blocked

label

2026-10-07 03:20:32 +00:00

Ghost commented

2026-10-07 03:25:09 +00:00

CLEAR — compose smoke on dockge.lab.rrd for tag 0.1.0 @ 084d661.

Built and ran helix-proxy:dev from that checkout under /opt/stacks/helix-proxy. Ports used: 80/443 for proxy HTTP/HTTPS, 9081→81 for admin (smoke only; ADMIN_HOST=0.0.0.0). Other stacks left alone; stack brought back down after.

Proven:

Admin login — POST /api/login with ADMIN_PASSWORD set for smoke → JWT; /api/users/me OK. (Password not in this comment.)
Proxy-host round-trip — host helix-smoke.lab.rrd → http://172.17.0.1:5001 (Dockge UI). curl with Host header on :80 → 200 + Dockge HTML. Host-header only; no DNS writes.
Cert path — PROXY_MODE=development, LE request for that host → self-signed test cert (meta.test_cert, files under data/certs/1/). Attached to the proxy host; HTTPS :443 with curl -k → 200.

Evidence (scrubbed): /workspace/lab-ops/verify-runs/helix-proxy-smoke-20261006/ (SUMMARY.md + curl/logs).

Leftovers on dockge: stack tree + data/ + image kept for rerun; compose is down so 80/443/9081 are free again. Dropping blocked — Eva/Pike can close once acceptance looks good from your side.

CLEAR — compose smoke on dockge.lab.rrd for tag `0.1.0` @ `084d661`. Built and ran `helix-proxy:dev` from that checkout under `/opt/stacks/helix-proxy`. Ports used: **80/443** for proxy HTTP/HTTPS, **9081→81** for admin (smoke only; `ADMIN_HOST=0.0.0.0`). Other stacks left alone; stack brought back down after. Proven: 1. **Admin login** — `POST /api/login` with `ADMIN_PASSWORD` set for smoke → JWT; `/api/users/me` OK. (Password not in this comment.) 2. **Proxy-host round-trip** — host `helix-smoke.lab.rrd` → `http://172.17.0.1:5001` (Dockge UI). `curl` with Host header on `:80` → 200 + Dockge HTML. Host-header only; no DNS writes. 3. **Cert path** — `PROXY_MODE=development`, LE request for that host → self-signed test cert (`meta.test_cert`, files under `data/certs/1/`). Attached to the proxy host; HTTPS `:443` with `curl -k` → 200. Evidence (scrubbed): `/workspace/lab-ops/verify-runs/helix-proxy-smoke-20261006/` (`SUMMARY.md` + curl/logs). Leftovers on dockge: stack tree + `data/` + image kept for rerun; compose is down so 80/443/9081 are free again. Dropping `blocked` — Eva/Pike can close once acceptance looks good from your side.

Ghost removed the

blocked

label

2026-10-07 03:25:15 +00:00

eva commented

2026-10-07 03:26:17 +00:00

Author

Owner

Jerry's compose smoke on dockge for 0.1.0@084d661 met acceptance — admin login, proxy-host round-trip, and cert path all clear. Closing.

eva removed their assignment

2026-10-07 03:26:17 +00:00

eva closed this issue