Move staging to OVH baremetal with TDX attestation - #3
Closed
posix4e wants to merge 34 commits into
Closed
Conversation
posix4e
force-pushed
the
wip/infra-simplify-clean
branch
from
March 24, 2026 19:05
e3b10bb to
75babd6
Compare
posix4e
force-pushed
the
wip/infra-simplify-clean
branch
from
March 24, 2026 19:07
75babd6 to
f9086aa
Compare
posix4e
force-pushed
the
wip/infra-simplify-clean
branch
from
March 24, 2026 19:12
f9086aa to
2b4d4d8
Compare
posix4e
force-pushed
the
wip/infra-simplify-clean
branch
from
March 24, 2026 19:13
2b4d4d8 to
6811fc0
Compare
posix4e
force-pushed
the
wip/infra-simplify-clean
branch
from
March 24, 2026 19:36
6811fc0 to
da7f298
Compare
posix4e
force-pushed
the
wip/infra-simplify-clean
branch
from
March 24, 2026 20:58
da7f298 to
3ab9e1c
Compare
posix4e
force-pushed
the
wip/infra-simplify-clean
branch
from
March 24, 2026 21:34
5913914 to
98ff6d3
Compare
3 tasks
posix4e
marked this pull request as draft
March 24, 2026 21:40
posix4e
changed the title
posix4e
force-pushed
the
wip/infra-simplify-clean
branch
from
March 24, 2026 21:49
98ff6d3 to
b1fff88
Compare
posix4e
force-pushed
the
wip/infra-simplify-clean
branch
from
March 24, 2026 22:45
b1fff88 to
de1125d
Compare
posix4e
marked this pull request as ready for review
March 24, 2026 23:45
create_and_run_cp_tunnel now looks up existing tunnels by name before creating. If a stale tunnel exists, it is deleted and recreated so we get a fresh token. This prevents the 'You already have a tunnel with this name' error that was blocking staging deploys.
- point staging agent registration at app-staging.slopandmop.com - derive cp_public_hostname and Cloudflare domain from inventory - require explicit cp_url / cp_public_hostname in the playbook - use bootstrap_cp config for locally launched staging control-plane VMs - wire staging workflow through the staging GitHub environment and staging-specific Cloudflare secrets This replaces the dead app-staging.devopsdefender.com staging path while keeping DevOps Defender production on the old domain.
The staging workflow only needs repo-level staging Cloudflare secrets. Using environment=staging was pulling a malformed DD_CP_ADMIN_PASSWORD value into the generated control-plane config, which caused dd-cp to fail parsing DD_CONFIG and crash-loop before health checks. Use repo-level secrets directly so the local OVH staging CP boots cleanly under the Slop and Mop hostname.
This reverts commit 613fc61.
posix4e
force-pushed
the
wip/infra-simplify-clean
branch
4 times, most recently
from
March 26, 2026 13:15
8c2b6fb to
2337d4d
Compare
posix4e
marked this pull request as ready for review
March 26, 2026 18:15
posix4e
force-pushed
the
wip/infra-simplify-clean
branch
3 times, most recently
from
March 26, 2026 21:39
4e2e975 to
be83798
Compare
posix4e
force-pushed
the
wip/infra-simplify-clean
branch
from
March 26, 2026 21:44
be83798 to
8197dd7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
We moved DevOps Defender's staging environment for example apps from Google Cloud to our own dedicated server in Europe (OVH).