[jaspermayone]

Declares hank, a new lab VM for Stash (the Patchwork archive, patchworklabsorg/stash), and everything around it. The VM is not built yet.

Piece	Where
Service module: stash-web and stash-worker from ghcr.io/patchworklabsorg/stash, host network, archived files on a host directory bind-mounted into both containers, worker with --shm-size 1g --memory 3g --memory-swap 3g	modules/stash/default.nix, exported as nixosModules.stash
hank: VMID 362, 10.100.90.62, 6 GB, 80 GB disk, nginx on tailscale0:80, production on 3007 and staging on 3008, uid 1000 reserved for the containers	hosts/hank/, terraform/proxmox/variables.tf
The stash role and schema in patchwork_central (skein and hem)	hosts/central-db-schema.nix
Traefik routes on alastor for stash.patchworklabs.org and stash-staging.patchworklabs.org	hosts/alastor/edge.nix
Four secrets: role passwords (jsp + skein, jsp + hem) and env files (jsp only until hank has a host key)	secrets/, bin/new-stash-secrets
AD: hank in linuxHosts, hank-admins (Jasper)	ad/org.json

flowchart LR
  internet((Internet)) --> alastor["alastor (Traefik)"]
  alastor -- "tailnet, HTTP :80" --> hank["hank: nginx -> stash-web :3007 / :3008"]
  hank -- "tailnet :5432" --> skein["skein: patchwork_central, schema stash"]
  hank -. "staging :5432" .-> hem["hem: central staging"]
  worker["stash-worker: Chromium, git, yt-dlp, LibreOffice"] --> data[("/data/stash")]
  hank --- worker

Loading

Checks: nix flake check --no-build passes (the x86_64 VM tests did not build here). nix eval of the hank units gives the expected docker run commands. The adversarial review's high finding (artifact downloads fail with the disk service) is fixed in Stash (ActiveStorage::SetCurrent, patchworklabsorg/stash 6167a23); its medium and low findings are in the second commit.

Decisions: the archived files live on hank's disk instead of an S3 bucket, so Stash does not depend on Krater's SeaweedFS on weft. STASH_STORAGE_SERVICE=s3 with the S3_* variables in the env file switches later. Nothing backs up /data/stash yet: that is owed before the first real capture.

Steps after merge, in order:

1. Merge jaspermayone/infra#81 (tag:patchwork-stash) and feat: stash and stash-staging records dns#19 (the two records).
2. bin/install-host hank, then put hank's host key in secrets/secrets.nix (the two env files and ad-join.age) and agenix -r.
3. Deploy skein and hem so the stash role gets its password.
4. Make the Stash app in Weave (redirect https://stash.patchworklabs.org/auth/callback, scopes openid profile email roles plus introspect, app roles viewer, archivist, admin) and fill WEAVE_CLIENT_ID and WEAVE_CLIENT_SECRET into stash-env.age; the same with Weave staging for stash-staging-env.age.
5. deploy .#hank, then nix flake update patchwork-infra and deploy alastor for the routes.