cabbage/archive-clients
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test: probe hardlink staging in deployment preflight

Browse Source
This commit is contained in:
cabbage
2026-08-03 11:13:10 +00:00
parent 25d40daea6
commit a7bc2bf087
3 changed files with 72 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/deployment-preflight.md
+9 -4
View File
@@ -2,9 +2,11 @@
Run the deployment preflight on every new node after its qBittorrent and
Syncthing stacks are running, but before starting the Archive Control daemon
for normal operation or creating any routes/jobs. It is read-only: it does not
contact the control daemon, alter Syncthing/qBittorrent state, or print secret
contents.
for normal operation or creating any routes/jobs. It does not contact the
control daemon, alter Syncthing/qBittorrent state, or print secret contents.
It does create and remove two unique, zero-byte probe files while proving that
the live client mount topology permits hard-link staging; no resource data or
configuration is modified.
The script is [`scripts/preflight-deployment.py`](../scripts/preflight-deployment.py).
It deliberately takes paths and container names as arguments rather than
@@ -46,7 +48,7 @@ docker compose run -d --no-deps --name archive-control-preflight \
# 3. Discover the real dependency container names if needed.
docker ps --format '{{.Names}}'
# 4. Run the read-only checks.
# 4. Run the deployment checks. They include a disposable hard-link probe.
python3 /path/to/archive-clients/scripts/preflight-deployment.py \
--client-config /srv/compose/ArchiveControl-archive/client.toml \
--client-container archive-control-preflight \
@@ -84,6 +86,9 @@ python3 scripts/preflight-deployment.py ... \
- That future route path and qBittorrent content root use one client bind
mount, so hard-link staging remains possible rather than silently falling
back to a space-consuming copy.
- A real `link(2)` operation between a unique zero-byte file in the qB root
and one in the future automatic-route root. The probe verifies that both
names refer to the same inode and removes them unconditionally.
- The token, qB password, and Syncthing API-key files are non-empty regular
files with no group/world permissions.
- The client image can read its configuration and reports usable permissions,