Skip to main content

max / makenotwork

sando: delete the testnot prod-restore refresh The mnw-testnot-refresh trio was superseded by the seed flow on cutover and its timer has been disabled since. It reloaded testnot's database from a production backup, which is the one path that could put real user data back on the staging box, so keeping it installed for rollback was the wrong default. Removes the units and the doc paths that pointed at them.
Co-Authored-By
Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Author: Max Johnson <me@maxj.phd> · 2026-07-22 14:50 UTC
Signed with PGP, not checked
Commit: d2a543cb0b8a37a62c03e945e0bd4b9287640292
Parent: b9727ee
3 files changed, +12 insertions, -21 deletions
M sando/deploy/README.md +4 -12
@@ -15,7 +15,6 @@
15 15 | `post-receive` | git remote | Push-to-deploy hook. |
16 16 | `sandod-backup-fetch.{service,timer}` | Sando host | Daily pull of the prod backup to `/srv/sando/backups/latest.sql.gz` (04:00 UTC). |
17 17 | `mnw-testnot-seed.{sh,service}` | Sando host | Reset testnot.work to the fabricated example catalog (`--seed-examples`). On-demand, not scheduled. |
18 - | `mnw-testnot-refresh.{sh,service,timer}` | Sando host | Prod-restore refresh of testnot (05:00 UTC). **Superseded by the seed flow; kept for rollback.** |
19 18 | `sando-update@.service` + `sando-self-update.sh` | Sando host | Self-update: rebuild + restart `sandod` to a target sha. |
20 19 | `10-sando-update.rules` | Sando host | polkit grant letting the `sando` user start (only) `sando-update@*`. |
21 20 | `install-companion.sh` | a deploy target | Install a staged companion binary + restart its unit (companion services). |
@@ -146,19 +145,12 @@
146 145 sudo systemctl daemon-reload
147 146 ```
148 147
149 - Cutover (prod-mirror → example catalog):
150 -
151 - ```sh
152 - sudo /usr/local/bin/mnw-testnot-seed.sh # reseed the box
153 - sudo systemctl disable --now mnw-testnot-refresh.timer # stop the daily prod restore
154 - ```
155 -
156 - Reset testnot any time afterward: `sudo /usr/local/bin/mnw-testnot-seed.sh`
148 + Reset testnot any time: `sudo /usr/local/bin/mnw-testnot-seed.sh`
157 149 (or `sudo systemctl start mnw-testnot-seed.service`).
158 150
159 - **Rollback** to the prod-mirror flow: `sudo systemctl enable --now
160 - mnw-testnot-refresh.timer` (its units are kept installed), then run
161 - `sudo /usr/local/bin/mnw-testnot-refresh.sh` once to reload from the backup.
151 + The seed flow is the only way testnot gets its data. The prod-restore refresh it
152 + replaced was deleted on 2026-07-22; testnot holds no prod-derived data and there
153 + is no path that puts any there.
162 154
163 155 **Redeploy the binary** (no Sando integration yet — manual): build the release
164 156 on the Sando host, then over Tailscale SSH as root on the target, copy the
M sando/deploy/mnw-testnot-seed.service +3 -4
@@ -1,9 +1,8 @@
1 1 # One-shot: reset testnot.work to the fabricated example catalog.
2 2 #
3 - # Replaces the daily mnw-testnot-refresh.timer/.service (prod-restore). The seed
4 - # catalog is fixed, so this is NOT scheduled — run it deliberately on cutover or
5 - # to reset the box: systemctl start mnw-testnot-seed.service (or run the script
6 - # directly). The mnw-testnot-refresh units stay installed, disabled, for rollback.
3 + # The seed catalog is fixed, so this is NOT scheduled — run it deliberately to
4 + # reset the box: systemctl start mnw-testnot-seed.service (or run the script
5 + # directly).
7 6 #
8 7 # Needs root on fw13: uses Tailscale SSH (node identity) to reach testnot as root
9 8 # and drives the reseed there.
M sando/deploy/mnw-testnot-seed.sh +5 -5
@@ -1,11 +1,11 @@
1 1 #!/usr/bin/env bash
2 2 # Reset testnot.work to the fabricated example catalog.
3 3 #
4 - # This replaces the prod-restore refresh (mnw-testnot-refresh.sh). Instead of
5 - # reloading testnot's database from a production backup — which put real user
6 - # data on the staging box — this reseeds it from the in-repo `--seed-examples`
7 - # flow: a self-contained catalog of fabricated `@example.test` creators and
8 - # public-domain items. testnot then holds no prod-derived data at all.
4 + # Reseeds from the in-repo `--seed-examples` flow: a self-contained catalog of
5 + # fabricated `@example.test` creators and public-domain items. testnot holds no
6 + # prod-derived data at all. This replaced a prod-restore refresh that reloaded
7 + # the database from a production backup, putting real user data on the staging
8 + # box; that path was deleted on 2026-07-22.
9 9 #
10 10 # Runs on fw13 (the Sando host, which has tailnet root on testnot via Tailscale
11 11 # SSH). It stops the app, resets the schema as the postgres superuser (streamed