Infrastructure discovery and compatibility report — wp.spboucher.ai (2026-11-02)
What was found
| Item | Finding |
|---|---|
| DNS | wp.spboucher.ai → A 51.161.112.61 (BHS64 gateway) already configured at GoDaddy. No change made, no duplicate created. |
| Public ingress | MacLustr Tunnel: WireGuard hub on BHS64 (wg0 10.67.0.1, UDP 443 fallback), Caddy with automatic TLS. Before deployment https://wp.spboucher.ai returned a TLS alert (no route). mld deploy adds the Caddy route wp.spboucher.ai → M3U96b:8560 over wg1. |
| Deployment convention | mld on M1M32 (manifest ~/dispatch/apps/<app>.json, staging, rsync, PM2, health check, tunnel route, registry). Templates: tools-spboucher-ai (Next 16 + Postgres 17 on M2M32c) and akos (M4M64c). |
| Nodes considered | M3U96b (28 c / 96 GB, Postgres 17.11, poppler, redis, 395 GB free, 2 apps), M4M64c (3 spboucher.ai apps already), M2M32c (tools), M2M32b (unreachable over Tailscale at discovery time). Chosen: M3U96b — isolation from other spboucher.ai apps, largest free disk for versioned manuscripts, Postgres already running. |
| PostgreSQL | 17.11 Homebrew on M3U96b; pgvector was missing → installed pgvector 0.8.7 with Homebrew; extensions vector, pg_trgm, unaccent, pgcrypto created in a dedicated DB wp_spboucher with dedicated roles wp_app (read/write) and wp_reader (read-only on public_* views). Local-socket trust for the superuser; scram over TCP for app roles. |
| Storage | Local SSD, dedicated directory ~/data/wp-spboucher-ai/{files,previews,inbox,tmp} (content-addressed by SHA-256). Backups ~/backups/wp-spboucher-ai (encrypted) + rsync to M3U96a (LAN 192.168.2.80). No S3-compatible object store exists in the cluster; the layout is one rclone/mc sync away from one. |
| Monitoring / logging | PM2 (pm2 logs, pm2-logrotate), mld heal every 5 min on M1M32 (restarts PM2/launchd/wg1/routes), structured JSON logs from the worker, GET /api/health used by mld. Admin dashboard shows jobs, backups, AI status. |
| Authentication convention | Same pattern as tools.spboucher.ai: DB-backed sessions (__Host- cookie, HttpOnly, Strict), Argon2id, TOTP, CSRF double-submit, same-origin checks, login rate limiting, audit log. |
| AI | OpenAI text-embedding-3-small (1536 dims) — model existence verified at runtime with GET /v1/models/{id} before first use; disabled automatically if the key or model is unavailable. No LLM generation is used for metadata. |
Isolation guarantees
Dedicated DB, roles, PM2 process names (wp-web, wp-worker), port 8560 (free on M3U96b), storage and backup directories, .env. No change to other apps, other spboucher.ai subdomains, research databases or tunnel routes.
Source manuscripts
The 39 public manuscripts were taken from the already-public catalog of www.spboucher.ai (M2U64 ~/spboucher-ai/public/papers, 44 MB) together with their verified metadata (lib/research.ts, lib/research-details.ts, written from the PDFs on 2026-11-01). WP39 and WP40 exist only as drafts in ~/Desktop/UQO/Recherche/Recherche-UQO (no compiled manuscript): registered as reserved identifiers, not public.