Prepared and validated on 2026-11-06; nothing deployed. Candidates:
- code/litellm branch upgrade-v1.108.0 → image 1.0.0-20261106-9e25578
(8/8 patches verified in the built image and in a live sandbox run;
image-gen spend row verified nonzero twice — fake + real Regolo probe;
36 additive migrations; budget_reset_at + portal API shapes unchanged).
- co-op/librechat-custom branch bump-appstore-1.4.8 → overlay 20261106-c2aec74
(appstore 1.4.8 = tooling bumps on the same 0.8.8 upstream; all overlay
anchors verified against the real 1.4.8 image — no porting needed).
Runbook: LiteLLM first, member-scope verification, rollback = previous tag
per app, window estimate 45-60 min.
- Migration addendum: replace the 'DNS split' wording with the verified state —
every hostname resolves to the new box (A+AAAA) per Cloudflare's public
resolver; nothing points at the old box.
- Reframe the old box: not a benign rollback spare but a decommissioned server
still alive and internet-exposed (22/80/443/587/993 open), holding old data and
config, serving no member traffic. UNRESOLVED — operator decision to shut it
down or firewall it. Do not act on it without the operator's word.
- README: add a 'Known open items' section listing the exposure, the CI failure,
the unpushed CI-agent repo and the unconfirmed member mailbox contents.
Audit of the operator docs against live reality (2026-11-04):
- app-inventory.md: all 19 Cloudron apps with id, fqdn and registry image pin.
Corrects the portal path (code/member-portal, not co-op/member-portal) and the
panel path (local/coop.inference.admin-panel, not code/admin-panel).
- maintenance/backups.md: the two backup systems; the deliberate per-user restic
cache split and the --group-by "" retention fix, with why.
- maintenance/woodpecker-ci.md: CI server + agent, image build/pin, manual-only
trigger, git-lfs requirement, and its current not-yet-green state (agent's
job-collection long-poll gets HTTP 500 from the server).
- provider-pricing/: index + GreenPT, Tinfoil (local EHBP proxy architecture) and
the Metis /v1/systemone decision-model route; regolo.md updated to record the
gateway prices were applied.
- agent-fleet.md: steward, infrastructure-bot and socialbot (Unix users, gateway
units, teams); member-bot tier 2 planned but not yet provisioned.
- README: file list; operator-token-runbook: correct the membership_sweep cadence
(3x daily, not nightly); migration doc: post-migration addendum (16->19 apps,
DNS split resolved, old box still on with apps stopped).
Absorbs the Cloudron server-migration material from co-op/runbooks
(now archived) so there is a single public operator documentation
repository. Files move into migration/ (plan, DNS change sheet,
pre-migration state) and provider-pricing/ is kept as its own section;
the merged README replaces both.
History is preserved: this is a merge of the unrelated histories, so
co-op/runbooks' 26 commits remain reachable from this repository and
git log -- migration/ shows their real authors and messages. File
contents are byte-identical to co-op/runbooks (blob hashes unchanged).
The cutover finished 2026-11-02 and this repo is public and read by members, so leaving a plan that reads like outstanding work is actively misleading. A dated banner now says it is complete and retained as the record; the STATE OF PLAY section is re-labelled as pre-cutover and marked superseded, with the one part known to be wrong (Listmonk's mail path, which moved to Scaleway TEM) named rather than silently corrected; and both files point at where live knowledge now lives — the cloudron-ops skill for procedure and co-op/docs/infrastructure.md for the member-facing description.
They were published to co-op/runbooks for member review, so the README's own 'Private: these contain...' line was both wrong and the first thing a reader saw. Also records the DNS sheet's wildcard caveat up front, and says explicitly that this repository is the source (no private copy).
Pre-flight, ordered cutover, post-restore verification, rollback, and the list of what Cloudron's backup does not cover. Written from a live inventory of the server on 2026-10-29; open unknowns are marked rather than guessed.
inference-bot