matt/echo6-docs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

auto: docs sync 2026-07-16T12:00:15+00:00

Browse source 
Files changed: engine/.embcache.json engine/changelog.md engine/lint-report.md vault/docs/hardware/environment.md vault/docs/hardware/ip-allocation.md vault/docs/software/central.md vault/docs/software/conduit.md vault/runbooks/add-peertube-channel.md vault/runbooks/central-deploy-cutover.md vault/runbooks/conduit-operations.md vault/runbooks/peertube-remote-runner.md
This commit is contained in:
echo6-autocommit 2026-07-16 12:00:15 +00:00
commit 77b4715384
11 changed files with 54 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

17
vault/runbooks/conduit-operations.md
View file

@ -1,22 +1,23 @@
---
title: "Conduit — Operations Runbook"
title: Conduit — Operations Runbook
type: runbook
tags:
- mesh
aliases: []
related:
- [[central-deploy-cutover]]
- [[conduit]]
- [[central]]
- [[navi]]
- [[meshai]]
updated: 2026-07-15
- [[recon-operations]]
- [[deployment]]
- [[ct-runbook]]
updated: 2026-07-16
---
# Conduit — Operations Runbook
## When to use
Deploying a change, adding a pull source, provisioning an API key, or reviewing the navi/meshai migration history for [[conduit]]. See [[conduit]] for architecture and current state.
Deploying a change, adding a pull source, provisioning an API key, or reviewing the [[navi]]/[[meshai]] migration history for [[conduit]]. See [[conduit]] for architecture and current state.
## Key facts
@ -67,7 +68,7 @@ Note: **code and schema changes still need this deploy + restart cycle.** Only *
## Fresh deploy from scratch
`scripts/provision.sh` (repo root) is the canonical from-scratch installer — it stands up one Conduit instance from nothing: Postgres role + database (plain Postgres, no timescaledb/postgis), generated secrets (AES-256 master key + session secret), a uv-managed venv with an editable install, schema migrations, an optional GUI operator, and (optionally) a systemd unit. It takes every name/path/port as an env var or flag — no Matt-specific values are hardcoded, so it's the same script for the live deploy and for a disposable test instance.
`scripts/provision.sh` (repo root) is the canonical from-scratch installer — it stands up one [[conduit]] instance from nothing: Postgres role + database (plain Postgres, no timescaledb/postgis), generated secrets (AES-256 master key + session secret), a uv-managed venv with an editable install, schema migrations, an optional GUI operator, and (optionally) a systemd unit. It takes every name/path/port as an env var or flag — no Matt-specific values are hardcoded, so it's the same script for the live deploy and for a disposable test instance.
Example (adjust for a real deploy — this example matches the throwaway shape used to prove the script works):
@ -124,7 +125,7 @@ For UA-sensitive upstreams (NWS contact header, Idaho Power WAF, avalanche.org U
## Provision an API key
API keys live in Conduit's own AES-256-GCM encrypted keystore (`api_keys` table), addressed by the `alias` a source's `api_key_alias` references. Encrypted under Conduit's own master key (`/etc/conduit/master.key`) — this store is separate from central's (central no longer exists to have one).
API keys live in Conduit's own AES-256-GCM encrypted keystore (`api_keys` table), addressed by the `alias` a source's `api_key_alias` references. Encrypted under Conduit's own master key (`/etc/conduit/master.key`) — this store is separate from [[central]]'s (central no longer exists to have one).
Keys currently held: `tomtom`, `roads511`, `firms` — all harvested from central before its retirement or provisioned directly. For a brand-new key, insert it directly through the keystore's encrypt path (no plaintext in shell history or logs), or use the GUI's API Keys page.