What this is #
The srv.ordner.fyi provisioning run on real bare metal surfaced twelve latent defects in the recipes — every one of them masked until now by the lab's pre-existing state, and every one fixed here with its lesson in a comment. All verified live: after this branch, site-srv.yml runs end-to-end on a fresh box (node, base, SeaweedFS, resolver, knot, spindle, backup) and the nginx tag issues the wildcard lineage through deSEC.
The fixes #
base — the clamd wait checked only daily.*, but both units' start conditions also require main.*; when daily lands a minute before main, systemd condition-skips the units, no socket exists, and the play burns its PING retries. Now waits for both.
seaweedfs — three: (1) unarchive into /usr/local/src/weed-extract without creating it (the lab had the dir from a manual install); (2) the s3.json mint script was a YAML folded scalar — the newlines between exit 0 and umask folded into spaces, gluing the commands into one line, making the mint branch dead code (the lab only ever took the already-exists path); (3) the health waits pointed at endpoints the weed master 404s and the volume server 400s even on the lab — corrected to /cluster/status and /healthz, verified against weed 4.47.
knot — two: (1) the config template never rendered ssh_host_key_file, which knot2 refuses to start without (the lab's config predates the template); (2) the restored-config identity check grepped only ^(hostname|admins) and missed the indented DID lines inside the admins array, so it refused the deployment's own config — it now reads the whole file. This check is the restore-day safety net, so it matters that it reads correctly.
spindle — three: (1) git 2.56 builds its Rust component via cargo — rustc/cargo join the build deps; (2) the clone/build steps need a git on PATH and a fresh box has none — distro git joins the packages (the service itself keeps the prefix git first); (3) tangled-core has no main branch — spindle_source_ref is master and the clone is full, because the tangled.org proxy's shallow clone leaves no branch to check out.
nginx-srv — four: (1) DNS-01 moved from the unofficial Hover API hooks to the dns CLI + the desec provider (dns set/dns remove with --wait); the token lives on the box in the dns CLI's file keychain (dns login, DNS_KEYCHAIN=file in /etc/environment), so the playbook carries no DNS credentials; (2) deSEC rejects rrset TTLs below 900 — the hook uses 900; (3) both authorizations of the wildcard lineage share one challenge name, so the auth hook accumulates with dns add and the cleanup tolerates nothing-left; (4) the port-80 vhost defines the svc_timed log format the other vhosts reference.
Test results #
- Full
site-srv.yml(node, base, seaweedfs, resolver, knot, spindle, backup): green end-to-end on the fresh srv.ordner.fyi (Hetzner, Debian 13), all services active, knot/xrpc/_health200. --tags nginx: the wildcard lineage (ordner.fyi + *.ordner.fyi) issued via the desec hooks, valid to 2027-01-10, renewal hooks installed.