deploy: production moved to BHS128b (wg1 10.67.0.62); BHS64b stack stopped, volumes kept as cold copy

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Simon-Pierre Boucher committed 10 days ago (Sep 14, 2026) parent 5bec867

4 changed files +14 −10

modified CLAUDE.md +5 −3

		`@@ -47,6 +47,8 @@ pytest -q # from apps/api`
47	47
48	48	## Production
49	49
50		−BHS64b (OVH Beauharnois, ubuntu@51.161.112.66) runs `infra/compose.yml` (edge Caddy :8350 bound to WireGuard
51		−10.67.0.61). Public route: BHS64 gateway `https://www.internetpressure.io → 10.67.0.61:8350`. Probes run as
52		−launchd (macOS) / systemd (Linux) services on cluster nodes. `deploy/bin/deploy.sh` and `deploy/bin/probes.sh`.
	50	+BHS128b (OVH Beauharnois, ubuntu@51.161.112.85, since 2026-09-14) runs `infra/compose.yml` (project `ip`, edge Caddy :8350
	51	+bound to WireGuard 10.67.0.62). Public route: BHS64 gateway `https://www.internetpressure.io → 10.67.0.62:8350`. Probes run as
	52	+launchd (macOS) / systemd (Linux) services on cluster nodes. `deploy/bin/deploy.sh` and `deploy/bin/probes.sh` (defaults in
	53	+`deploy/bin/lib.sh`: `IP_SERVER=BHS128b`, `IP_WG_IP=10.67.0.62`). Nightly backup cron (04:10 UTC) → BHS128:/srv/backups/internetpressure.
	54	+Until 2026-09-14 production was BHS64b (10.67.0.61); its stack is stopped (`docker compose down`, volumes `ip_*` kept as a cold copy).

modified deploy/bin/deploy.sh +1 −1

		`@@ -23,7 +23,7 @@ health() {`
23	23
24	24	route() {
25	25	log "route https://$IP_DOMAIN → $IP_WG_IP:8350 on $IP_GATEWAY"
26		− ssh -o BatchMode=yes "$IP_GATEWAY" "sudo tunnelctl add $IP_DOMAIN BHS64b:8350 && sudo tunnelctl redirect internetpressure.io $IP_DOMAIN \|\| true; sudo tunnelctl ls \| grep -i internetpressure"
	26	+ ssh -o BatchMode=yes "$IP_GATEWAY" "sudo tunnelctl add $IP_DOMAIN $IP_SERVER:8350 && sudo tunnelctl redirect internetpressure.io $IP_DOMAIN \|\| true; sudo tunnelctl ls \| grep -i internetpressure"
27	27	}
28	28
29	29	case "$cmd" in

modified deploy/bin/lib.sh +4 −3

		`@@ -1,12 +1,13 @@`
1	1	#!/usr/bin/env bash
2		−# Shared helpers for deploy scripts. Server = BHS64b (ubuntu@51.161.112.66), reached through the laptop's SSH alias.
	2	+# Shared helpers for deploy scripts. Server = BHS128b (ubuntu@51.161.112.85) since 2026-09-14 (was BHS64b / 10.67.0.61
	3	+# until then; its stopped stack + volumes are kept as a cold copy). Reached through the laptop's SSH alias.
3	4	set -euo pipefail
4	5
5		−IP_SERVER="${IP_SERVER:-BHS64b}"
	6	+IP_SERVER="${IP_SERVER:-BHS128b}"
6	7	IP_REMOTE_DIR="${IP_REMOTE_DIR:-/opt/internetpressure}"
7	8	IP_GATEWAY="${IP_GATEWAY:-BHS64}" # MacLustr Tunnel gateway (Caddy + WireGuard hub)
8	9	IP_DOMAIN="${IP_DOMAIN:-www.internetpressure.io}"
9		−IP_WG_IP="${IP_WG_IP:-10.67.0.61}"
	10	+IP_WG_IP="${IP_WG_IP:-10.67.0.62}" # wg1 address of IP_SERVER on the BHS64 hub (ipmap)
10	11	REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
11	12
12	13	log() { printf '\033[1;36m▸\033[0m %s\n' "$*"; }

modified docs/DEPLOY.md +4 −3

		`@@ -4,11 +4,12 @@`
4	4
5	5	\| Where \| What \|
6	6	\|---\|---\|
7		−\| BHS64b (`ssh BHS64b`, ubuntu@51.161.112.66, OVH Beauharnois, 8 c/16 t, 64 GB) \| Docker Compose `infra/compose.yml` in `/opt/internetpressure`: edge Caddy :8350 (bound to wg1 10.67.0.61), web, api, engine, bgp, corroboration, Postgres 17, ClickHouse 25.8, Redis 7 \|
8		−\| BHS64 gateway \| `tunnelctl add www.internetpressure.io BHS64b:8350` (+ apex redirect). DNS `A www → 51.161.112.61` (GoDaddy). \|
	7	+\| BHS128b (`ssh BHS128b`, ubuntu@51.161.112.85, OVH Beauharnois ADVANCE-2, 8 c/16 t, 128 GB) — since 2026-09-14 \| Docker Compose `infra/compose.yml` (project `ip`) in `/opt/internetpressure`: edge Caddy :8350 (bound to wg1 10.67.0.62), web, api, engine, bgp, corroboration, Postgres 17, ClickHouse 25.8, Redis 7. Volumes `ip_*` copied from BHS64b (tar over ssh, ~1 min downtime). Shares the server with cancerindex, company-atlas, rareindex, satelliteindex (native PM2). \|
	8	+\| BHS64b (former host, until 2026-09-14) \| Stack stopped (`docker compose down`, volumes `ip_*` kept as a cold copy); still runs the DataCenterIndex crawl worker. \|
	9	+\| BHS64 gateway \| `tunnelctl add www.internetpressure.io BHS128b:8350` (+ apex redirect — apex `internetpressure.io` has no A record at GoDaddy yet). DNS `A www → 51.161.112.61` (GoDaddy). \|
9	10	\| Probes \| `ca-qc-01` M4M36 · `ca-mtl-01` BHS128 · `us-atl-01` m2m16b · `fr-gra-01` R9128 · `ie-dub-01` m1m16 · `tr-ist-01` m4mh · `tr-usk-01` m4mi · `cy-ayn-01` m4mg — LaunchDaemon `io.internetpressure.probe` (macOS) / `ip-probe.service` (Linux) \|
10	11
11		−Secrets: `deploy/.env` on the server only (copy in `~/.internetpressure/env.bhs64b` on the laptop). Probe keys live in
	12	+Secrets: `deploy/.env` on the server only (copy in `~/.internetpressure/env.bhs128b` on the laptop; `env.bhs64b` = the former host, same secrets, `WG_IP=10.67.0.61`). Probe keys live in
12	13	production Postgres; sudo passwords of rented Macs in `~/.internetpressure/sudo.txt`.
13	14
14	15	## Commands
15	16