openvibers/openvibe.host Commits

Host Stage B is launched at openvibe.host (2026-10-07); the cert timer unit can write /etc/letsencrypt. (#26)

OP OpenVibers committed 7 Oct 2026 · d269973249 · 4 files, +19 −12

OpenVibe.Host Stage B launched at openvibe.host on 2026-10-07 (owner authority), and the records say so.

What ran on the host, in docs/launch.md order: the pre-flight (Host ready, validate clean, env names present, wildcard cert valid, DNS as expected, disk 39 GB free); optional step 0, an nginx catch-all (444 on :80, ssl_reject_handshake on :443 for any host no site names; verified: an unknown host is refused at the handshake on the public address while openvibe.live/network/tools/chat/media/bot/events and openre.stream still answer 200); the ovhost CLI updated; ovhost nginx tenants host --install (openvibe.host.conf and openvibe.host-custom-domains.conf, the pending vhost removed, one clean nginx -t); openvibe-certs.timer enabled and run (certbot renew: ok). Backups of the replaced vhosts: /root/host-launch-20261007-170330.

Verified: https://openvibe.host/ renders the showcase front page; robots.txt, sitemap.xml and limits.json 200; /api/v1/projects 401 signed out; /metrics 404; an unknown tenant site 404.

This PR:
- deploy/systemd/openvibe-certs.service: ProtectSystem=true, not full. full also makes /etc read-only, so certbot failed on /etc/letsencrypt/.certbot.lock and the timer never renewed anything (fixed on the host the same way).
- README (status, domain line, Stage B row, Launch rule), STATUS.json (stage B launched, deployed, placeholderInSites false, features), docs/launch.md (the launch record at the top).

Sites drops openvibe.host and Contracts/Network mark host live in their own PRs. Tests: ov test test/docs.test.js test/host-secrets-dashboard.test.js: passed.

Changes

ddiff --git a/README.md b/README.md
iindex d654c0d..e2571d7 100644
---- a/README.md
++++ b/README.md
@@@ -2,8 +2,8 @@
  
  > The network's deployment/control plane first; then isolated hosting for community sites, bots and mods.
  
--**Status:** alpha. Stage A (operator plane) is a CLI, `ovhost`, tested against a fake host. It is installed on the production host (2026-09-23, `/usr/local/bin/ovhost`, inventory `/etc/openvibe/host.json`) and it deploys 20 services (`ovhost deploy <svc>`: Network, Events, Chat, Billing, Tips, VIP, AI, Search, Sources, Wiki, Blog, News, Reviews, Deals, Coupons, Trade, Codes, Host, Media, Community; 70+ releases since 2026-09-23, with automatic rollback on a failed readiness check) and runs the nightly backups and the restore drills of 19 services. Live, Tools, Sites, Games and OpenRe moved to it in the 2026-09-27 cutover (roadmap WS-N task 11) through the deploy strategies `release-layout`, `multi-app`, `static-build` and `pnpm-build`, so every service now deploys with `sudo ovhost deploy <svc>` (Live with `--wait-idle`); each of those repositories keeps `deploy/scripts/deploy.sh` as a thin wrapper that hands over to ovhost or falls back to its old script: [docs/deploy-strategies.md](docs/deploy-strategies.md). Stage B (tenant static hosting) is a service, written and tested; it runs on the host on loopback `:4910` (2026-09-23 audit) and is **not launched**: `openvibe.host` is still the Sites placeholder and `*.openvibe.host` answers 404. The launch is ready to run: [docs/launch.md](docs/launch.md) (steps, verification, rollback and the launch-rule evidence) and [docs/threat-review.md](docs/threat-review.md). Stage C (sandboxed user code) is **not started**.
--**Domain:** `openvibe.host` (dashboard and API) and `*.openvibe.host` (tenant sites). The domain keeps its placeholder page on [OpenVibe.Sites](https://github.com/OpenVibers/OpenVibe.Sites) until Stage B is deployed and launched (see [Launch rule](#launch-rule)).
++**Status:** alpha. Stage A (operator plane) is a CLI, `ovhost`, tested against a fake host. It is installed on the production host (2026-09-23, `/usr/local/bin/ovhost`, inventory `/etc/openvibe/host.json`) and it deploys 20 services (`ovhost deploy <svc>`: Network, Events, Chat, Billing, Tips, VIP, AI, Search, Sources, Wiki, Blog, News, Reviews, Deals, Coupons, Trade, Codes, Host, Media, Community; 70+ releases since 2026-09-23, with automatic rollback on a failed readiness check) and runs the nightly backups and the restore drills of 19 services. Live, Tools, Sites, Games and OpenRe moved to it in the 2026-09-27 cutover (roadmap WS-N task 11) through the deploy strategies `release-layout`, `multi-app`, `static-build` and `pnpm-build`, so every service now deploys with `sudo ovhost deploy <svc>` (Live with `--wait-idle`); each of those repositories keeps `deploy/scripts/deploy.sh` as a thin wrapper that hands over to ovhost or falls back to its old script: [docs/deploy-strategies.md](docs/deploy-strategies.md). Stage B (tenant static hosting) is a service, written and tested, and **launched on 2026-10-07**: `openvibe.host` serves the dashboard, API and front page, and `*.openvibe.host` serves tenant sites (vhosts from `ovhost nginx tenants host --install`; the Sites placeholder and the pending 404 vhost are gone; certificate lifecycle on `openvibe-certs.timer`; an nginx catch-all refuses hosts no site names). The launch record, verification and rollback: [docs/launch.md](docs/launch.md); the threat review: [docs/threat-review.md](docs/threat-review.md). Stage C (sandboxed user code) is **not started**.
++**Domain:** `openvibe.host` (dashboard and API) and `*.openvibe.host` (tenant sites). Launched on 2026-10-07 (see [Launch rule](#launch-rule)); OpenVibe.Sites no longer serves it.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §15.3 and §15.17; roadmap Wave 21.
  **License:** AGPL-3.0 (same as every OpenVibe service).
  
@@@ -75,7 +75,7 @@ credentials from `/etc/openvibe/host.env`):
  | Stage | Scope | State |
  |---|---|---|
  | **A: operator plane** | `ovhost` CLI and library: inventory, validate, plan, deploy (`--wait-idle`/`--force`), automatic rollback, rollback, status, releases, certs, nginx render/install, snapshot, backup, restore drill. No daemon and no server. Port **4910** is reserved for a later operator API. | **alpha**: written and tested (fake host, plus the real executor against temp SQLite/HTTP/git). Installed on the host: deploys every service, runs the nightly backups and the restore drills. |
--| **B: tenant static hosting** | The Host API service (port 4910): projects, sites, immutable content-addressed deploys, activation and rollback, `<site>.openvibe.host` and TXT-verified custom domains, quotas, upload logs, events, a server-rendered dashboard; tenant vhosts via `ovhost nginx tenants`. | **alpha**: written and tested (`npm test`, against a temp database, a mock Network and a DNS table). Runs on the host on loopback `:4910`; not launched. |
++| **B: tenant static hosting** | The Host API service (port 4910): projects, sites, immutable content-addressed deploys, activation and rollback, `<site>.openvibe.host` and TXT-verified custom domains, quotas, upload logs, events, a server-rendered dashboard; tenant vhosts via `ovhost nginx tenants`. | **alpha**: written and tested (`npm test`, against a temp database, a mock Network and a DNS table). Runs on the host on `:4910` behind nginx; launched at openvibe.host on 2026-10-07. |
  | **C: sandboxed user code** | Isolation profiles, CPU/memory/time/network/storage budgets, secret references, outbound policy, metering, kill/revoke without touching platform services. | **not started**, deliberately. Blocked until isolation and metering are proven. Nothing in Stage B runs tenant code. |
  
  Not in Stage A yet (from the charter/roadmap list): container adapters, DNS adapters, certificate **renewal**, logs/metrics links, the release-manifest/active-client work in §15.18, and the Wave 22 cutover runbook. (Incident and maintenance controls, `ovhost incident|maintenance|freeze`, and release notifications, `host.release.published`, exist now.) Restore drills (`ovhost drill`) ran on the host for 19 services on 2026-09-23 ([docs/restore-drills.md](docs/restore-drills.md)).
@@@ -503,9 +503,8 @@ Stage A: everything that touches the system goes through the executor (`lib/exec
  
  ## Launch rule
  
--This repository does not make the product real, and the domain keeps its placeholder page on
--[OpenVibers/OpenVibe.Sites](https://github.com/OpenVibers/OpenVibe.Sites) until all of the
--following exist here (plan §12.12):
++**Launched on 2026-10-07.** Every item below is met (docs/launch.md, Launch readiness), and openvibe.host left
++OpenVibe.Sites the same day. The rule, as it stood (plan §12.12):
  
  1. an owning runtime with health/readiness endpoints and observability;
  2. canonical identity/auth integration (OpenVibe.Network subjects, scoped service principals);
ddiff --git a/STATUS.json b/STATUS.json
iindex 9d5fad8..5a2ec0a 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -38,14 +38,14 @@
    ],
    "stages": {
      "A": "alpha: ovhost CLI installed on the production host 2026-09-23 (/usr/local/bin/ovhost, inventory /etc/openvibe/host.json); every service deploys with `sudo ovhost deploy <svc>` since the 2026-09-27 cutover (roadmap WS-N task 11: Live, Tools, Sites, Games and OpenRe through the release-layout, multi-app, static-build and pnpm-build strategies); nightly backups, restore drills (19 passed 2026-09-23, docs/restore-drills.md), release notifications, incidents and maintenance, the alerts relay; the D41 deploy-and-rollback proof (scripts/d41-proof.sh) is written and tested",
--    "B": "alpha: running on the host on loopback :4910 (2026-09-23 audit), not launched; launch-rule items met in code and tests, launch steps in docs/launch.md, threat review in docs/threat-review.md",
++    "B": "launched 2026-10-07 at openvibe.host (dashboard, API, front page) and *.openvibe.host (tenant sites); docs/launch.md, threat review in docs/threat-review.md",
      "C": "not started (deliberately: blocked until isolation and metering are proven)"
    },
    "artifactStorage": "local disk, content-addressed per project; HOST_OBJECT_STORE=media writes objects through to OpenVibe.Media with local disk as the read cache (opt-in, off by default)",
    "customDomainCertificates": "operator-issued (certbot), not automated",
    "installedOnHost": true,
--  "deployed": "loopback only, not launched",
--  "placeholderInSites": true,
++  "deployed": "production: openvibe.host and *.openvibe.host since 2026-10-07",
++  "placeholderInSites": false,
    "adoptedByServices": [],
    "capabilitiesNote": "released in openvibe-contracts v0.24.0; v0.32.0 adds the four takedown routes to host.site.manage.implementedBy",
    "launchReady": true,
@@@ -59,7 +59,7 @@
      "release notifications (host.release.published), incidents, maintenance windows and freezes",
      "Prometheus alerts relay to Network",
      "browser check and release-lifecycle acceptance suite",
--    "Stage B: tenant static sites with immutable deploys, activation, rollback, custom domains, quotas and takedowns (not launched)",
++    "Stage B: tenant static sites with immutable deploys, activation, rollback, custom domains, quotas and takedowns",
      "Stage B git deploys, Phase 1: a site's Git source (repo + branch); the tenant's own CI posts each build, which lands as a source=git preview with immutable commit provenance and goes live only through activate (Host never clones, fetches, holds a credential or builds)",
      "per-actor limits on Stage B writes (openvibe-sdk/limits)"
    ],
ddiff --git a/deploy/systemd/openvibe-certs.service b/deploy/systemd/openvibe-certs.service
iindex 4e85bdb..76ad5b3 100644
---- a/deploy/systemd/openvibe-certs.service
++++ b/deploy/systemd/openvibe-certs.service
@@@ -13,7 +13,8 @@ ExecStart=/usr/local/bin/ovhost certs renew --install
  Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  Environment=OVHOST_INVENTORY=/etc/openvibe/host.json
  UMask=0077
--# /usr and /boot read-only; /etc stays writable (certbot and the nginx install write there).
--ProtectSystem=full
++# /usr and /boot read-only; /etc stays writable (certbot and the nginx install write there). Not `full`:
++# that also makes /etc read-only, and certbot failed on /etc/letsencrypt/.certbot.lock (2026-10-07).
++ProtectSystem=true
  PrivateTmp=true
  NoNewPrivileges=true
ddiff --git a/docs/launch.md b/docs/launch.md
iindex aa11b38..0574d04 100644
---- a/docs/launch.md
++++ b/docs/launch.md
@@@ -1,5 +1,12 @@
  # Launching Stage B at openvibe.host
  
++**Launched on 2026-10-07.** The window ran in this order: pre-flight (every line agreed); optional step 0, an
++nginx catch-all (`/etc/nginx/sites-available/00-default-catchall.conf`, a 444 on :80 and `ssl_reject_handshake` on
++:443 for any host no site names); the `ovhost` CLI updated; `ovhost nginx tenants host --install` (openvibe.host.conf
++and openvibe.host-custom-domains.conf written, the pending vhost removed, one clean `nginx -t`); `openvibe-certs.timer`
++enabled (its unit needed `ProtectSystem=true`, not `full`, to write /etc/letsencrypt); Sites removed openvibe.host;
++Contracts marks host live and Network pins it. Backups of the replaced vhosts are in `/root/host-launch-20261007-170330`.
++
  This is the launch release the [Launch rule](../README.md#launch-rule) describes. One change window:
  
  - `*.openvibe.host` starts serving tenant sites;