Swarm Role Layout Production Rollout

Change metadataCopy Anchor Link

• Change id: CR-2026-08-14-swarm-role-layout-rollout
• Date and time: 2026-08-14 18:44–19:06 UTC
• Environment: VPS / production
• Requester and approver: repository owner, explicit approval in the active session
• Executor: Codex
• Status: completed with one pre-existing registry credential follow-up

ScopeCopy Anchor Link

• Split the shared platform stack into infra-redis and infra-rabbitmq.
• Rename the updater stack to infra-watchtower.
• Reclassify RustFS, Kong, and NetBird as svc-rustfs, svc-kong, and svc-netbird.
• Replace the administration-stack identity with panels while preserving the five-suspended/three-running baseline.
• Redeploy infra-edge from separate Traefik and Kener fragments with service identities edge-traefik and edge-kener.
• Install both backup timers from canonical operations/systemd/ paths and retire compatibility executables.

Preconditions and backupCopy Anchor Link

• Captured stacks, replicas, images, volumes, networks, secrets, and timer state.
• Confirmed 97 GiB free disk space.
• Detected that the legacy Tier-1 unit had skipped runs since July because its ConditionPathExists referenced a nonexistent path.
• Created fresh local Tier-1 backup tier1-20260814T184617Z for PostgreSQL, MySQL, and MongoDB; all 14 artifact checksums passed.
• Kept MSSQL intentionally at 0/0 and outside the scheduled engine list.

Execution and validationCopy Anchor Link

1. Removed infra-platform, then deployed infra-redis and infra-rabbitmq; both reached 1/1 using their original external volumes.
2. Replaced infra-operations with infra-watchtower; both updater scopes are healthy at 1/1. Initial default-overlay allocation retries and duplicate Watchtower cleanup converged without intervention.
3. Migrated RustFS, Kong, and NetBird one at a time. Public behavior matched baseline: RustFS routes 403, Kong unmatched root 404, NetBird instance API 200.
4. Corrected Kong's one-shot migration task to load its existing Docker secret; the final task completed successfully and Kong remained healthy.
5. Replaced the administration stack with panels. The role filter returns exactly eight services; pgAdmin completed a controlled 0 -> 1 -> 0 test and returned the expected non-NetBird 403 after Traefik reconciliation.
6. Redeployed infra-edge; Kener returned 200, while Kong and NetBird routes continued returning their expected statuses.
7. Installed and enabled both canonical backup timers. The persistent Tier-1 timer immediately ran the missed job successfully as tier1-20260814T185509Z; next schedules are Sunday 03:00 UTC for databases and the last day of the month at 03:00 UTC for WordPress.

Preservation checksCopy Anchor Link

• Production Docker volume inventory is unchanged.
• Production Docker secret inventory is unchanged.
• The only network inventory change is the expected updater default-overlay rename to infra-watchtower_default.
• Migrated floating-tag workloads retained their captured image digests.
• Redis returned PONG; RabbitMQ diagnostics returned Ping succeeded.
• Vaultwarden health 200, Zitadel readiness 200 and root 308, Gitea health 200 and registry challenge 401.

Follow-upCopy Anchor Link

• An authenticated pull from the Gitea Docker registry still returns unauthorized because the VPS Docker client's dedicated svc-puller credential is absent or expired. Restore that credential without reusing another service token, then repeat the pull.

RollbackCopy Anchor Link

Each migrated stack can be removed and its prior identity redeployed from the pre-change revision against the same external volumes, networks, and secrets. No rollback was required.