This repository was archived by the owner on Aug 26, 2026. It is now read-only.
chore(scripts): collect the cutover and recovery helpers into infra/scripts - #768
Merged
Merged
Conversation
…cripts
Five operational scripts were sitting untracked in the repository root, where
they survived only as long as the working copy. Each one encodes a procedure
that is worth having on the next incident:
fix-vault-bootstrap-auth.sh creates the vault-bootstrap policy and
kubernetes auth role, and proves the
ServiceAccount can log in from inside the
cluster. Needed again after any Vault
re-initialisation.
resume-mail-provisioner.sh resumes apps-mail and verifies the
provisioning sidecar, re-suspending and
rolling back on any failed check.
flip-flux-source-to-org.sh points the Flux source at the organisation
repository with GitHub App auth.
flip-flux-source-to-monorepo.sh the matching rollback, including the
spec.provider removal that a plain apply
does not undo.
post-cutover-fixups.sh writes the Discord webhook and mints the
Vault metrics token.
Renamed to the kebab-case the directory already uses, and the cross-reference
between the two flip scripts follows the rename.
flip-flux-source-to-monorepo.sh derived the monorepo path from a hardcoded
absolute path under one user's home directory. Now that it lives in the tree it
derives the root from its own location instead, verified to resolve correctly
when invoked by relative path, by absolute path, and from an unrelated working
directory.
flip-flux-source-to-org.sh runs under `set -uo pipefail` with no `-e`, so its
unguarded `cd "$WORK"` would have continued into the wrong tree had the cd
failed. It now dies instead.
Not included: tmp.sh contains a live Discord webhook URL and is scratch rather
than a procedure; tmp.js, tpm.sh and tmp.sh.bak-qbt are one-off fragments; and
unseal-vault.sh was not part of this work.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Five operational scripts were sitting untracked in the repository root, surviving only as long as the working copy. Each encodes a procedure worth having on the next incident.
fix-vault-bootstrap-auth.shvault-bootstrappolicy and kubernetes auth role, then proves the ServiceAccount can log in from inside the cluster. Needed again after any Vault re-initialisation.resume-mail-provisioner.shapps-mailand verifies the provisioning sidecar, re-suspending and rolling back the Deployment on any failed check.flip-flux-source-to-org.shflip-flux-source-to-monorepo.shspec.providerremoval that a plainkubectl applydoes not undo.post-cutover-fixups.shRenamed to the kebab-case the directory already uses; the cross-reference between the two flip scripts follows the rename.
Two fixes the move justified
flip-flux-source-to-monorepo.shderived the monorepo path from a hardcoded absolute path under one user's home directory. Now that it lives in the tree it derives the root from its own location — verified to resolve correctly when invoked by relative path, by absolute path, and from an unrelated working directory.flip-flux-source-to-org.shruns underset -uo pipefailwith no-e, so its unguardedcd "$WORK"would have carried on into the wrong tree had thecdfailed. It now dies instead. Shellcheck flagged it; the missing-eis what made it real rather than cosmetic.All five are
bash -nclean with zero shellcheck warnings at-S warning.fix-vault-bootstrap-auth.shwas re-run from its new location to confirm the move did not break its preflight.Deliberately not included
tmp.shcontains a live Discord webhook URL. It is scratch rather than a procedure, and that URL needs rotating regardless — it was pasted into a chat transcript.tmp.js,tpm.sh,tmp.sh.bak-qbtare one-off fragments.unseal-vault.shwas not part of this work, so it is left where it is rather than adopted without review.