bastion RSSH + other changes

2026-07-29 04:18:09 +03:00 · 2026-06-15 11:56:23 +02:00
parent 22cc1c6a6a
commit 2421c4007b
19 changed files with 549 additions and 53 deletions
--- a/docs/OPEN_TASKS_GRAPH.md
+++ b/docs/OPEN_TASKS_GRAPH.md
@@ -1,29 +1,8 @@
 # Open tasks — dependency graph

-_Last synced: 2026-06-08 (post infra/browser/graphs/RSSH fixes). **DNS 2.x off graph** (postponed)._
+_Last synced: 2026-06-04 (RSSH full stack on `feature/rssh-alpha`, RA control HTTP, cluster acl0 DNS). **DNS 2.x off graph** (postponed)._

-**Documentation index:** [README.md](README.md) · **Service map:** [20260608_BE_SERVICES_and_infra.md](20260608_BE_SERVICES_and_infra.md)
-
---
-
---
-
---
-
---
-
-## Table of contents
-
-<!-- toc -->
- [Removed from graph (done)](#removed-from-graph-done)
- [Postponed / off graph (DNS + mail)](#postponed-off-graph-dns-mail)
- [Priority tiers (open only)](#priority-tiers-open-only)
- [Dependency graph](#dependency-graph)
- [Task index (open)](#task-index-open)
- [Critical path](#critical-path)
-<!-- /toc -->
-
-**Documentation index:** [README.md](README.md)
+**Standing rules:** [../bottomline_reminder.txt](../bottomline_reminder.txt) · **Documentation index:** [README.md](README.md) · **Service map:** [20260608_BE_SERVICES_and_infra.md](20260608_BE_SERVICES_and_infra.md)

 ---

@@ -33,13 +12,22 @@ _Last synced: 2026-06-08 (post infra/browser/graphs/RSSH fixes). **DNS 2.x off g
 |----|------|
 | **0.1** | Stream dump |
 | **3.x** | Auth register + verify + TOTP + migration `008` |
-| **4.x** | RSSH alpha — BE + Android + JSch |
-| **4.wg** | WG lab — BE `wg0`, FE + **router** DNAT persist |
+| **4.wg** | WG lab — BE `wg0`, FE + router DNAT persist |
 | **RBAC** (core) | Admin panel + lockout clear |
 | **Browser** | JS syntax validated; `validate_be_services.sh` |
-| **1.1 / 1.2** | Graphs drill-down, columns, full-width (`shell--graphs-full`) |
-| **5.3** | RSSH API validate — `test_rssh_api.sh` OK on BE |
+| **1.1 / 1.2** | Graphs drill-down, columns, full-width |
+| **5.3** | RSSH API smoke — `test_rssh_api.sh` |
 | **Infra doc** | `20260608_BE_SERVICES_and_infra.md` + PDF |
+| **RA control** | `:ra_control` HTTP + WebSocket shell + adb JSON `ra_control` block |
+
+---
+
+## In progress (feature/rssh-alpha)
+
+| ID | Owner | Blocker | Status |
+|----|-------|---------|--------|
+| **4.rssh** | Agent | BE `provision_users` + FE stream deploy on PO | **In progress** — mobile MINA :8022, bastion provisioner, linux-sim, docs/tests in repo |
+| **cluster0** | Agent | cast01–03 reachable | **Ongoing** — lab VMs; DNS `c1–c3.acl0.f0xx.org` noted in `cluster.env` |

 ---

@@ -47,7 +35,7 @@ _Last synced: 2026-06-08 (post infra/browser/graphs/RSSH fixes). **DNS 2.x off g

 | ID | Owner | Note |
 |----|-------|------|
-| **2.1–2.4** | Developer | DNS / forwards — **postponed** |
+| **2.1–2.4** | Developer | DNS / forwards — **postponed** (acl0 CNAMEs added for cluster lab only) |
 | **2.5** | Agent | SMTP — frozen |
 | **5.4** (mail) | Agent | Auth mail E2E — frozen |

@@ -58,9 +46,10 @@ _Last synced: 2026-06-08 (post infra/browser/graphs/RSSH fixes). **DNS 2.x off g
 | Tier | IDs | Alpha blocker |
 |------|-----|---------------|
 | **P4** | **5.1 OTA**, **5.2 URLs**, **5.5** RBAC UI soak | **Yes** |
+| **P4b** | **4.rssh** deploy soak | **Yes** (alpha essential) |
 | **P5** | **6.1–6.6** app LAN | LAN alpha |
 | **P9** | **9.x** landing (excl. globe FR) | No |
-| **Post-alpha** | **SFU** relay (`feature/sfu-relay`) | No |
+| **Post-alpha** | **SFU** relay | No |

 ---

@@ -72,6 +61,7 @@ flowchart TB
        OTA["5.1 OTA channel<br/>SVC-OTA · HTTP 400"]
        URL["5.2 device URLs<br/>SVC-URL · legacy host"]
        RBACV["5.5 RBAC UI soak<br/>API ✓"]
+        RSSH["4.rssh full stack<br/>feature/rssh-alpha<br/>Agent"]
    end

    subgraph P5["P5 — app LAN · dev"]
@@ -83,12 +73,16 @@ flowchart TB
        A66["6.6 stream analysis"]
    end

-    subgraph P9["P9 — landing"]
-        L9["9.x hub cards<br/>no globe FR"]
+    subgraph LAB["Lab · cluster0"]
+        C0["cast01–03<br/>c1–c3.acl0.f0xx.org"]
    end

-    subgraph POST["Post-alpha · hidden"]
-        SFU["SFU / Janus relay<br/>feature/sfu-relay"]
+    subgraph P9["P9 — landing"]
+        L9["9.x hub cards"]
+    end
+
+    subgraph POST["Post-alpha"]
+        SFU["SFU / Janus relay"]
    end

    FULL["FULL_ALPHA<br/>no DNS/mail"]
@@ -96,7 +90,9 @@ flowchart TB
    OTA --> FULL
    URL --> FULL
    RBACV --> FULL
+    RSSH --> FULL
    A62 --> FULL
+    C0 -.-> RSSH

    A63 <--> A64
    A65 --> A66
@@ -106,6 +102,7 @@ flowchart TB
    style FULL fill:#1e3a5f,color:#fff
    style OTA fill:#991b1b,color:#fff
    style URL fill:#b45309,color:#fff
+    style RSSH fill:#7c3aed,color:#fff
    style SFU fill:#e5e7eb,color:#374151
 ```

@@ -115,12 +112,14 @@ flowchart TB

 | ID | Owner | Depends on | Status |
 |----|-------|------------|--------|
-| **5.1** | 50/50 | nginx OTA path | **Open** — `SVC-OTA` ticket |
-| **5.2** | 50/50 | — | **Open** — `SVC-URL` / `settings.json` base |
-| **5.5** | Agent | RBAC API ✓ | Light UI soak (optional) |
+| **4.rssh** | Agent | FE stream + BE sshd Match User | **In progress** — repo complete pending deploy soak |
+| **5.1** | 50/50 | nginx OTA path | **Open** |
+| **5.2** | 50/50 | — | **Open** |
+| **5.5** | Agent | RBAC API ✓ | Light UI soak |
 | **6.1–6.6** | Developer (~99%) | 0.1 ✓ | Open |
-| **9.x** | Agent (low) | — | Open (globe out of scope) |
-| **SFU** | Agent | owner spec | Hidden preview on `feature/sfu-relay` |
+| **9.x** | Agent (low) | — | Open |
+| **cluster0** | Agent | NFS/DNS | cast01–03 lab |
+| **SFU** | Agent | owner spec | Hidden |

 ---

@@ -129,9 +128,23 @@ flowchart TB
 ```text
 BLOCKER:  5.1 OTA nginx (/v0/ota/ on apps.f0xx.org) ──┐
 SHARED:   5.2 production URLs (apps not f0xx.org) ─────┼──► FULL_ALPHA
-OPTIONAL: 5.5 RBAC UI click-through ──────────────────┤
-DEV:      6.2 LAN soak ───────────────────────────────┘
+ALPHA:    4.rssh deploy (FE stream + BE sshd + app) ───┤
+OPTIONAL: 5.5 RBAC UI click-through ────────────────────┤
+DEV:      6.2 LAN soak ────────────────────────────────┘

-Off graph:  2.x DNS/mail (postponed)
-Parallel:   6.1/6.3–6.6, 9.x (no globe), SFU post-alpha
+Parallel: cluster0 lab (c1–c3.acl0.f0xx.org), 6.1/6.3–6.6, 9.x, SFU
+Off graph: 2.x DNS/mail (postponed)
 ```
+
+---
+
+## Numbered priority legend (PO overrides AI)
+
+1. **5.1 OTA** — nginx path (PO/dev)
+2. **5.2 URLs** — production base URLs
+3. **4.rssh** — alpha remote access (Agent, `feature/rssh-alpha`)
+4. **5.5 RBAC UI soak** — optional click-through
+5. **6.2 LAN soak** — developer device validation
+6. **cluster0** — cast01–03 integration tests
+7. **6.1 / 6.3–6.6** — app LAN quality
+8. **9.x** — landing polish