From 384e515cf41a3a2f72bb4afe3eee302b5575996d Mon Sep 17 00:00:00 2001 From: Garrett Allen <98648590+Gerrrt@users.noreply.github.com> Date: Sat, 10 Oct 2026 21:23:15 +0000 Subject: [PATCH 1/2] docs(sensor): the compose header says make up, and that fenrir is built The header still said "NOT `make up STACK=sensor`", because the stack had no secrets, and that fenrir was "NOT BUILT YET". Both stopped being true. #834 gave Alloy an ingest token that `make up` renders from secrets/sensor.sops.yaml, as the stack's README and the INGEST_TOKEN line further down this file already say. fenrir was built on 2026-09-30, and #437's reboot proof passed. Comment only; no service definition changes. Co-Authored-By: Claude Opus 5.5 --- stacks/sensor/compose.yaml | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/stacks/sensor/compose.yaml b/stacks/sensor/compose.yaml index 04596282..a361f987 100644 --- a/stacks/sensor/compose.yaml +++ b/stacks/sensor/compose.yaml @@ -3,20 +3,19 @@ # carries its logs to the lab's Loki (#437). # # Deployed on: fenrir (10.0.30.90, VLAN 30 / ImaginationLAN) — a guest on -# `Saruman`, VMID 190. NOT BUILT YET. Authored ahead of the guest -# the way stacks/soc was ahead of odin. The build, and the reboot -# proof that closes #437, is docs/runbooks/build-the-sensor-guest.md. +# `Saruman`, VMID 190. Built 2026-09-30 by +# docs/runbooks/build-the-sensor-guest.md, which also holds +# #437's reboot proof. # Decided by: docs/adr/0068-mirror-the-lab-bridge-to-zeek-with-tc-not-open-vswitch.md # — why a `tc` mirror on the Linux bridge rather than Open vSwitch, # why a guest of its own, and why the check that the mirror is up # lives on the hypervisor and not here. -# Deploy with: NOT `make up STACK=sensor`. That target renders a secrets file, -# and this stack has none — no service here takes a credential. -# On fenrir, from the repository root: -# cp stacks/sensor/.env.example stacks/sensor/.env -# docker compose -f stacks/sensor/compose.yaml up -d -# stacks/media is the other stack deployed this way, for a -# different reason (#528); README.md has the procedure. +# Deploy with: `make up STACK=sensor`, on fenrir, from the repository root. +# Since #834 the stack has one secret, Alloy's token for the +# lab's ingest proxy, and `make up` renders it from +# secrets/sensor.sops.yaml. Before that it had none and was +# brought up with plain `docker compose`; README.md has the +# one-time secrets-init and secrets-edit steps. # # WHAT THIS SEES AND WHY. `fenrir` has two NICs. `net0` is on vmbr0 like every # other guest and carries this stack's own traffic to alexander. `net1` sits From 8500ac627592cc5db837af2001a45a1c05863294 Mon Sep 17 00:00:00 2001 From: Garrett Allen <98648590+Gerrrt@users.noreply.github.com> Date: Sat, 10 Oct 2026 21:47:13 +0000 Subject: [PATCH 2/2] docs(sensor): the runbook has #437's reboot test; the changelog has its result Co-Authored-By: Claude Opus 5.5 --- stacks/sensor/compose.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/stacks/sensor/compose.yaml b/stacks/sensor/compose.yaml index a361f987..5c43c110 100644 --- a/stacks/sensor/compose.yaml +++ b/stacks/sensor/compose.yaml @@ -4,8 +4,9 @@ # # Deployed on: fenrir (10.0.30.90, VLAN 30 / ImaginationLAN) — a guest on # `Saruman`, VMID 190. Built 2026-09-30 by -# docs/runbooks/build-the-sensor-guest.md, which also holds -# #437's reboot proof. +# docs/runbooks/build-the-sensor-guest.md, which also has the +# reboot test for #437. The result, run that day, is under +# 2026-09-30 in docs/changelog.md. # Decided by: docs/adr/0068-mirror-the-lab-bridge-to-zeek-with-tc-not-open-vswitch.md # — why a `tc` mirror on the Linux bridge rather than Open vSwitch, # why a guest of its own, and why the check that the mirror is up