fleet: uprootiny · INT-131944351 sources live ⟳
MISSION TIER 0 — what this strand is for
Drive a Contabo + DNS fleet — 4 VPS, ~94 subdomains across dissemblage.art and hyperstitious.org — from one local operator console. Read state truthfully (every figure carries a provenance tier), surface cost & thrift, and issue guarded real control actions — without ever fabricating data the Contabo API can't give us.
4boxes
49serving vhosts
33parked · 404
$0/ month
$0/ year
1live sources
TAKES — what we set out to do · what we tried · how it landed
take 1Auth + vendored CLIshipped2026-06-11
tried OAuth2 password grant via a keychain wrapper (creds in Keychain, not on disk); build cntb v1.6 from source with Go 1.26.3 under nix.
landed cntb get datacenters/instances returns live data end-to-end. Master auth blocker cleared.
take 2Read-only fleet auditshipped2026-06-11
tried audit-host.sh probes all 94 names → audit-results.tsv (code/cert/flags); map names onto the 4 boxes.
landed 39 healthy · 35 parked-404 · 10 self-signed. 7 confirmed misconfigs (self-signed apex, wrong default cert, DNS typo, zero firewalls).
take 3Console v0.1.0partial2026-06-11
tried http-kit + hiccup + htmx; background-refreshed atom so the render is always fast; panels for instances/alerts/certs/drift/dns.
landed Live & useful, but several panels (reconcile jobs, clock, footer) shipped as fabricated placeholders — de-fabricated 2026-06-27.
take 4Cost & control surface v0.2.0shipped2026-06-19
tried Tiered cost oracle (T0–T3); per-box €/serving-vhost; real cntb control behind a name-echo confirm + verb whitelist.
landed Shipped & verified: confirm mismatch → 422, cancel → "not permitted"; neither calls cntb. Destructive verbs never exposed.
take 5Make it a real repopartial2026-06-19
tried git init; 12 files tracked; vendored cntb/ gitignored; flake.nix dev shell + `nix run`.
landed Repo is real and green. Continuity still needs the remote/provenance surface kept truthful as repo state changes.
take 6USD pricing correctionpartial2026-06-19
tried A real Contabo billing email ($12.95 preauth) gave a confirmed V77 price; flip currency € → $.
landed V77 confirmed; V45/V95 still estimates until read off the PDF invoices. Same email flagged a card-declined event to watch.
take 7Accountability surfaceshipped2026-06-27
tried Point the console at the strand itself: this page, rendered from a data ledger + live git/fleet facts.
landed Shipped. Also wired the dead /canvas + /inspect routes and de-fabricated the console clock/footer/jobs in the same pass.
CAPABILITIES — working / blocked, by tier
| cntb auth + instances/history live, authoritative — specs, status, created-date, lifecycle churn | TIER 0 | shipped |
| DNS enumeration (subdom) A-records across both zones → name→ip map | TIER 0 | shipped |
| Host audit (code/cert/flags) fast, cached in audit-results.tsv | TIER 0 | shipped |
| Guarded control actions start/restart/shutdown/stop/snapshot · whitelist + name-echo confirm | TIER 0 | shipped |
| Cost & thrift model live specs × operator-declared prices — still mostly estimates | TIER 1 | partial |
| Drift / parked / serving derived from audit + DNS, per-box and fleet rollup | TIER 1 | shipped |
| Live load (CPU/RAM/disk) needs SSH onto each box — host key not accepted on any of the 4 | TIER 2 | blocked |
| Use-over-time sampling no sampler yet; gated behind T2 | TIER 3 | planned |
| Orchestration (place/postpone) cost oracle is ready; the load half it reads from isn't | TIER 3 | planned |
FRICTION — where the time actually goes
SSH key rejected on all 4 boxesblocked
This host's key (SHA256:M72ni1…wJcQxc) authorizes none of the fleet. It is the master gate for the entire load/orchestration half — cost is ready, load isn't.
Contabo API exposes no billing, no live metricspartial
Forces operator-declared prices (hence the est. badges) and forces SSH for any real utilization signal. The /cost stats endpoint covers object-storage only.
Continuity metadata must stay livepartial
Repo branch/commit/remote/session provenance must be read live, not left as stale page copy, or the artifact lies about its own continuity.
Fabricated placeholders read as realshipped
v0.1.0 shipped fake clock/jobs/footer. De-fabricated 2026-06-27 — the console now shows real collected-at and live source status only.
Shell footguns—
viper has no dash→underscore env replacer (CNTB_* unusable → flags only); the `security` keychain call can hang (mitigated by an 8s timeout in fleet/run).
SELF-AUDIT — code vs reality
✓/canvas + /inspect linked in UI but unrouted → 404
server.clj✓topbar clock + main footer reconcile times fabricated
views.clj✓reconcile-jobs panel was static fake data
fleet.clj✓currency flipped to $ but eur helper emitted € glyph
views.clj✓missing README / ARCHITECTURE / JOURNAL strand docs
repo root○prices operator-declared estimates (V45/V95 unconfirmed)
cost.clj○addon 1501 (all 4) / 1681 (lab) prices unknown → flagged
cost.cljROADMAP — projected, ordered by leverage · each step names the gate it opens
1blocked
Unblock SSH — add this host's pubkey to the 4 boxes (or obtain the private key)
↳ opens ALL of Tier-2 live load → the orchestration half
2planned
Confirm V45/V95 + addon prices against the PDF invoices, flip price-confidence :confirmed
↳ drops every est. badge — cost becomes authoritative
3planned
Create a private GitLab remote and push
↳ satisfies repo-policy; lets Atlas enumerate the strand
4planned
Build the load sampler (Tier-3 use-over-time)
↳ feeds the scheduler real utilization next to real cost
5planned
Ship the orchestration layer (place/postpone/batch across boxes)
↳ the original point of the cost oracle — needs steps 1 & 4
6planned
Remediate the 7 audited misconfigs (LE/wildcard cert, prune 35 dangling DNS, firewall baseline)
↳ kills the self-signed apex warning + closes the open attack surface