`sudo -v` always attempts interactive credential validation; it does not
consult NOPASSWD entries. On any user configured with `NOPASSWD:ALL`
(cloud-init's default ubuntu, most CI runners), `sudo -v` still demands
a TTY password prompt and dies with "sudo authentication failed" when
there is no TTY.
Found by the obmp-portability-test two-VM run: deploy.sh failed at line
433 on a cloud-init-provisioned Ubuntu 24.04 VM despite the ubuntu user
having passwordless sudo (`sudo -n whoami` returned root correctly).
Fix: try `sudo -n -v` first (succeeds silently on NOPASSWD users, fails
non-interactively on others), and only fall through to the interactive
`sudo -v` prompt when the non-interactive probe fails. Humans still get
the same visible up-front prompt; automation now succeeds without one.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Implements the one-shot goal from the greenfield audit: tear down fully
and/or deploy cleanly on a pristine WSL instance with nothing but the
interactive script.
- './deploy.sh teardown': leave-it-down removal across ALL compose
profiles (core/test/auth/evpn-test/scale-out -- the old reset missed the
last two), networks, named volumes, rendered gobgpd.confs. Data wipe is
opt-in (--wipe-data, guarded on native hosts) and preserves backups/
unless --purge-backups; --purge-images reclaims images. Prints the
Windows-side cleanup (wsl-portproxy.ps1 -Remove, new switch).
- fresh-host preflight: verifies the docker DAEMON (not just the client),
offers to install docker-ce from the official repo (--install-prereqs
for unattended), and handles the classic pristine-WSL trap: systemd off
-> writes /etc/wsl.conf [boot] systemd=true and stops with exact
restart instructions instead of dying cryptically.
- sudo authenticates ONCE up front (no more password prompt buried
mid-provision); --reset now covers all profiles and preserves backups/
- guided flow: banner, Step N/6 headers, context lines explaining
HOST_IP-vs-router-facing before the address prompts, router-facing IP
validated as a dotted quad (a failed Windows-LAN autodetect can no
longer write a <WINDOWS_LAN_IP> placeholder into .env), stage
completions print green checkmarks, loud abort note on the plan
confirm, post-deploy Verify + teardown hints.
- shared helpers moved to scripts/deploy-lib.sh; setup.sh sources it too
(duplicate get_env/set_env/ask/confirm definitions deleted), keeping
setup.sh as a standalone provisioning primitive.
Verified live on this host: teardown left zero obmp containers and
removed rendered configs; unattended redeploy brought the stack back.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
From a two-agent audit (docs accuracy + greenfield deploy path):
- init_db docs were describing upstream behavior: this repo's psql-app
auto-creates the schema on first run and drops config/do_not_init_db to
skip later (psql-app/scripts/run:74). README/DOCS/backup-restore now
describe the marker semantics; the restore flow creates the marker
BEFORE first start instead of 'not creating init_db'
- DOCS.md contained heavy retired-lab drift: banner declares it a legacy
walkthrough with illustrative values; fixed its self-contradictions --
external port 1790, folder OBMP-Reference, datasource 'PostgreSQL',
OpenConfig gNMI paths (matching telegraf.conf), EXABGP_PEERS,
TRAFFIC_GEN_PORT
- deploy.sh --help now shows the current scope names (old ones remain
accepted aliases)
- navigation: new docs/README.md index with operator and network-engineer
tracks (links the previously orphaned backup-restore, security-hardening,
ROADMAP, DB_SCHEMA); README gains a Start-here router
- intra-docs prose paths no longer carry the docs/ prefix (they resolve
from within docs/); RR-CLIENTS -> RR-CLIENT matches the blueprint;
ROADMAP A6 marked done
- scripts/deploy-lib.sh added: shared log/ask/confirm/get_env/set_env
helpers for the deploy tooling consolidation (wiring lands next)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Decision landed: routers target 1790 (IANA BMP port); the collector keeps
listening on 5000 in-container. One .env variable now drives every hop:
- compose publishes ${ROUTER_FACING_PORT:-1790}:5000 (was hardcoded 5000:5000)
- gobgpd.conf.tmpl (+ evpn) gains __BMP_PORT__; setup.sh renders it from
ROUTER_FACING_PORT -- gobgp is host-networked, so it must chase the
published port or the full-table feeder silently breaks
- deploy.sh + scripts/wsl-portproxy.ps1: the WSL side now publishes the
router-facing port itself, so the portproxy forwards the same port
end-to-end instead of down-mapping to 5000
- cml/proxmox_bmp_config.py reads ROUTER_FACING_IP/PORT from .env (HOST_IP
fallback for pre-key .envs); xrd-node-definition.yaml baked port -> 1790
- .env.example documents ROUTER_FACING_IP/PORT; docs updated, finding 12
closed on the repo side (routers still on 5000 need a config re-apply)
Verified live: collector republished 0.0.0.0:1790->5000, gobgp BMP session
Up to HOST_IP:1790 with the RIB dump flowing.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
deploy.sh referenced DEPLOYMENT-TYPES.md and router-bmp-config.md, which were
never committed (they lived only in a chat session's outputs). Land them under
docs/ along with PORTABILITY-FINDINGS.md covering all 12 greenfield findings,
including the two from today's deploy (chmod-777-vs-psql, telegraf docker API)
and the open router-side gap (cml tooling still targets HOST_IP:5000).
- scripts/wsl-portproxy.ps1: idempotent elevated-PS helper for the Windows
portproxy + firewall rules; auto-detects the current WSL IP. Replaces the
copy-paste netsh block as the primary path (raw commands kept as fallback).
- deploy.sh: plan now prints the branch @ commit (+dirty marker) so every
deploy records exactly what it ran from; doc references point at docs/.
- README: greenfield quickstart with pinned-checkout guidance; warning on the
manual chmod path that breaks existing Postgres trees (finding 10).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
