Repository navigation
Move the lab's brain to ultra - #105
Merged
Merged
Conversation
The brain answers on ultra's loopback (127.0.0.1:8789) and, for the shelf, through lan-forward.py under /usr/bin/python3: ultra's stealth firewall drops LAN connections to Homebrew node. Night manifests use the local brain with no tunnel; the ultra tunnel plist is gone; the workstation tunnel goes to ultra (LAN, then tailnet). backup-brain.sh gains FLEET_BACKUP_OUTBOX and FLEET_BACKUP_NO_DB. Docs follow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 23, 2026
Merged
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The reference lab's brain moved from fleet-host to ultra today (owner request, WB-509 option C). This brings the repo in line with what is now deployed.
What changed
collector/deploy/lan-forward.pyandcom.addisdev.fleet-lan-forward.plistare new. ultra's firewall is in stealth mode and drops LAN connections to Homebrewnode, even thoughsocketfilterfwreports node as permitted./usr/bin/python3gets through. So the brain binds127.0.0.1:8789, and this standard-library byte pipe serves192.168.1.111:8789. I tested it from the laptop and fleet-host with a 50 MB upload, a 30 MB download and a delayed response.deploy/explore/night/*.json) now exportFLEET_URL=http://127.0.0.1:8789and drop--tunnel runner-ts:…, because runner-host is retired.com.addisdev.fleet-tunnel-ultra.plistis removed. The ultra executor plist points at the local brain.com.addisdev.fleet-tunnel(workstation) now goes to ultra, keeping the same 18788 and reverse-8790 ports. It tries the LAN aliasultrafirst and falls back to the tailnet aliasultra-ts, which restores the away-from-home route.backup-brain.shhas two new settings:FLEET_BACKUP_OUTBOX: hands each backup, gzipped, to an outbox sealer. On ultra that sealsfleet-brain-<stamp>.tar.age, and fleet-host's existing nightly pull takes it off-site.FLEET_BACKUP_NO_DB=1: on fleet-host, which keeps the suites but no longer runs a brain, it backs up flows, web-specs and config instead of failing.docs/lab.md(machines, loopback rule, backups, runbook, the orphaned-collector trap),docs/deploy/explore-on-ultra.md,docs/deploy/networking.md, and a CHANGELOG entry.What I ran
sqlite3 .backup, and integrity and per-table counts match on both sides. All 1,096 artifacts match their names by sha256, and the file lists and sizes match.benchmarkpassed in 19 s on fleet-host's agent through ultra.fleet_devicesandfleet_findings since=24hwork through the MCP server.explore-night.ts --dry-runagainst the local brain.backup-brain.shrun under launchd on both hosts. The laptop pull from both hosts.sh -nand shellcheck onbackup-brain.sh,py_compileon the forwarder,plutil -linton the plists.Nothing here touches GitHub CI wiring: Fleet Runner stays disconnected from CI.
🤖 Generated with Claude Code