Implements the one-shot goal from the greenfield audit: tear down fully
and/or deploy cleanly on a pristine WSL instance with nothing but the
interactive script.
- './deploy.sh teardown': leave-it-down removal across ALL compose
profiles (core/test/auth/evpn-test/scale-out -- the old reset missed the
last two), networks, named volumes, rendered gobgpd.confs. Data wipe is
opt-in (--wipe-data, guarded on native hosts) and preserves backups/
unless --purge-backups; --purge-images reclaims images. Prints the
Windows-side cleanup (wsl-portproxy.ps1 -Remove, new switch).
- fresh-host preflight: verifies the docker DAEMON (not just the client),
offers to install docker-ce from the official repo (--install-prereqs
for unattended), and handles the classic pristine-WSL trap: systemd off
-> writes /etc/wsl.conf [boot] systemd=true and stops with exact
restart instructions instead of dying cryptically.
- sudo authenticates ONCE up front (no more password prompt buried
mid-provision); --reset now covers all profiles and preserves backups/
- guided flow: banner, Step N/6 headers, context lines explaining
HOST_IP-vs-router-facing before the address prompts, router-facing IP
validated as a dotted quad (a failed Windows-LAN autodetect can no
longer write a <WINDOWS_LAN_IP> placeholder into .env), stage
completions print green checkmarks, loud abort note on the plan
confirm, post-deploy Verify + teardown hints.
- shared helpers moved to scripts/deploy-lib.sh; setup.sh sources it too
(duplicate get_env/set_env/ask/confirm definitions deleted), keeping
setup.sh as a standalone provisioning primitive.
Verified live on this host: teardown left zero obmp containers and
removed rendered configs; unattended redeploy brought the stack back.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Decision landed: routers target 1790 (IANA BMP port); the collector keeps
listening on 5000 in-container. One .env variable now drives every hop:
- compose publishes ${ROUTER_FACING_PORT:-1790}:5000 (was hardcoded 5000:5000)
- gobgpd.conf.tmpl (+ evpn) gains __BMP_PORT__; setup.sh renders it from
ROUTER_FACING_PORT -- gobgp is host-networked, so it must chase the
published port or the full-table feeder silently breaks
- deploy.sh + scripts/wsl-portproxy.ps1: the WSL side now publishes the
router-facing port itself, so the portproxy forwards the same port
end-to-end instead of down-mapping to 5000
- cml/proxmox_bmp_config.py reads ROUTER_FACING_IP/PORT from .env (HOST_IP
fallback for pre-key .envs); xrd-node-definition.yaml baked port -> 1790
- .env.example documents ROUTER_FACING_IP/PORT; docs updated, finding 12
closed on the repo side (routers still on 5000 need a config re-apply)
Verified live: collector republished 0.0.0.0:1790->5000, gobgp BMP session
Up to HOST_IP:1790 with the RIB dump flowing.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
deploy.sh referenced DEPLOYMENT-TYPES.md and router-bmp-config.md, which were
never committed (they lived only in a chat session's outputs). Land them under
docs/ along with PORTABILITY-FINDINGS.md covering all 12 greenfield findings,
including the two from today's deploy (chmod-777-vs-psql, telegraf docker API)
and the open router-side gap (cml tooling still targets HOST_IP:5000).
- scripts/wsl-portproxy.ps1: idempotent elevated-PS helper for the Windows
portproxy + firewall rules; auto-detects the current WSL IP. Replaces the
copy-paste netsh block as the primary path (raw commands kept as fallback).
- deploy.sh: plan now prints the branch @ commit (+dirty marker) so every
deploy records exactly what it ran from; doc references point at docs/.
- README: greenfield quickstart with pinned-checkout guidance; warning on the
manual chmod path that breaks existing Postgres trees (finding 10).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
