playbook: §12b m2o desktop provisioning (RDP + console-auth + m2gw) - #5
Closed
mariuszkreft wants to merge 4 commits into
Closed
playbook: §12b m2o desktop provisioning (RDP + console-auth + m2gw)#5mariuszkreft wants to merge 4 commits into
mariuszkreft wants to merge 4 commits into
Conversation
Captures the m2 / m2.2 host topology, path & DNS gotchas, first-boot `unhealthy` window, expected WARNs on m2.2, and the socat-relay pattern for wiring m2.2-hosted desktops into m2's Guacamole (guacamole-full). Adds `scripts/launch-m2o-desktop.sh`, an idempotent wrapper that runs provision.sh, waits for healthy, creates the guacd relay (m2.2 only), upserts the Guacamole RDP row on m2, and grants perms — one command end-to-end. Installed on both hosts as `launch-desktop.sh`. Amendment trigger: pattern that had to be reconstructed from scratch during euroclean-m2o provisioning (2026-08-24) — belongs in the playbook. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds the Console (ttyd, magic-link flow) subsection to §12b: there is only ONE real console-auth in the fleet (on m2). m2.2 desktops route via m2.2 Traefik → local console-auth socat → m2's console-auth-lan-relay → real console-auth. Documents the two per-desktop sync requirements (Traefik Host + m2's CONSOLE_BASIC_CREDS) and the admin curl to mint magic links. Notes the provision.sh bug (fixed 2026-08-24 on both hosts): the Traefik router Host() was hardcoded to m2o.machinemachine.ai, so /console/<name> silently 404'd for every m2.2-hosted desktop. provision.sh now reads CONSOLE_PUBLIC_HOST from console-auth/secrets.env. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
… fix session-wipe Docs the m2o-console-link Guacamole extension (built + deployed this session): tiny JS/CSS extension that adds a Console ↗ button to each row on the Guacamole home page. Click → POST /console-mint/issue-web with the current session token → console-auth validates against the Guacamole REST API and mints a magic link for that desktop. Traefik route /console-mint/* → console-auth was already in place. For the m2.2 desktops the URL must be console.m-2.cc, not the default m2o.machinemachine.ai. Adds CONSOLE_HOST_OVERRIDES env to console-auth (JSON slug → host map) and threads it through _host_for(desktop). launch-desktop.sh now auto-adds the new desktop to this map and redeploys console-auth on m2 when provisioning on m2.2. Also removes the accidental `docker restart guacamole-full` from launch-desktop.sh — Guacamole picks up DB changes on next session, so the restart was gratuitous AND invalidated every active user's cookie (operator saw the connection list briefly "disappear" until re-login). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds `scripts/m2gw-provision-agent.sh` — one idempotent command that creates a tenant, upserts the agent with a configurable route chain, mints a bearer, and (optionally) patches a target desktop's Hermes config.yaml. Runs on m2 or SSH-in from m2.2. Installed on both hosts alongside launch-desktop.sh and in ~/m2-gpt/m2-gpt/scripts/ on m2. Threads a new `--provision-m2gw` flag through launch-desktop.sh so desktop spawn + gateway wire is a single command. New flags --m2gw-primary/--m2gw-fallback/--m2gw-model/--m2gw-principal let the caller pick a different route chain than the default (spark-glm -> deepseek-spark, model=m2gw-spark-glm/glm-5.3-flash). §12b in the playbook gets a "Provisioning the m2-gpt tenant / agent / bearer" subsection with the rationale (per-desktop bearer vs the fleet-wide placeholder baked in by provision.sh), the introspection one-liner for the routes table, and a note that deepseek-v4-3107 isn't deployed today — the fleet standard text route is deepseek-v4-flash-0731. euroclean-m2o brought up end-to-end this session: tenant + agent (chain: spark-glm -> deepseek-spark), per-agent bearer minted, Hermes config on euroclean-m2o updated to use it with model.default=m2gw-spark-glm/glm-5.3-flash. Gateway -> chain -> LLM smoke passed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reopens after PR #4 was closed with the branch deleted. Same content plus the m2-gpt provisioning slice at the end.
What this adds
§12b — m2o Desktop Provisioning (RDP + cross-host Guacamole + console/ttyd + m2gw) in
PLAYBOOK.md.One-command wrapper:
scripts/launch-m2o-desktop.shIdempotent end-to-end desktop bring-up. Runs
provision.sh, waits for healthy (tolerating the ~2 min first-bootrm -rf /home), creates the guacd socat relay on m2.2, upserts the Guacamole RDP row on m2, grants perms — and with--provision-m2gwalso does the m2-gpt work below. Installed on both hosts aslaunch-desktop.sh.Companion:
scripts/m2gw-provision-agent.shCreates the tenant + agent (configurable route chain), mints a per-agent bearer, patches the target desktop's Hermes
config.yaml(model.default+model.api_key), restartshermes-gateway. Runs on m2 or SSHes there from m2.2. Defaults:spark-glm(glm-5.3-flash, vision) →deepseek-spark(deepseek-v4-flash-0731) fallback.Fixes
desktop/provision.sh(both hosts) — TraefikHost()was hardcoded tom2o.machinemachine.ai, silently breaking/console/<name>for every m2.2 desktop. Now readsCONSOLE_PUBLIC_HOSTfromconsole-auth/secrets.env(m2.2 sets it toconsole.m-2.cc).scripts/launch-m2o-desktop.sh— removed thedocker restart guacamole-fullstep (invalidated every active user's session cookie; Guacamole picks up DB changes on next session anyway).Deployed as side-effects (not just documented)
m2o-console-linkGuacamole extension — adds aConsole ↗button to each connection tile on the home page.CONSOLE_HOST_OVERRIDESenv support toconsole-auth/app.pyso m2.2 desktops getconsole.m-2.ccURLs from/issueand/issue-web.launch-desktop.shauto-maintains the map on new m2.2 desktops.euroclean-m2oend-to-end: container (m2.2) → Guacamole (m2) via socat relay → console-auth magic-link flow → m2-gpt tenant/agent/bearer + Hermes wired tospark-glm → deepseek-spark.Test plan
launch-desktop.sh eurocleanon m2.2 — idempotent re-run reuses container, relay, connection.Euroclean Desktopvisible toguacadmin+m2./console/euroclean/end-to-end: token accepted → 302 → session cookie → 200.Console ↗button appears on the Guacamole home page and mints per-desktop URLs on the right host.m2gw-provision-agent.sh euroclean-m2o --skip-hermes— tenant reused, agent chain updated, fresh bearer minted.curl gpt.machinemachine.ai/v1/chat/completionswith the new bearer returns 200 and the requested content.bash -non all shell scripts.🤖 Generated with Claude Code