Infra inventory: the old org-root and its hosts
What runs where, who deployed it, and which infra/ script owns it now. Read on 2026-10-25 (UTC).
How to deploy: infra/README.md.
Sources:
- Read-only ssh (
systemctl show,ss -ltnp, the caddy site lines,git log -1of each checkout, the NAMES of env files and ofEnvironment=variables) on fedproxy.com, mini-cloud-0001.chadig.com, mini-cloud-0002.chadig.com and qr.fedfork.com. Nothing was changed. No env file was read. - Not reached by ssh: socialweb.computer (the gateway), hat-7, hat-9 and this host (hat-8). The task
rules forbid ssh to the hats and the gateway. Their rows come from
scripts/deploy.sh,CONTRIBUTING.md,docs/deploy.md,~/.tmp/deploy/README.mdand public HTTPS probes. tray.fedfork.com is not in the known host list and was probed over HTTPS only. - The old org-root:
~/src/publicdomainrelay-kcp(origingithub.com/publicdomainrelay/socialweb-computer, HEAD 6ed8c72). Its deploy scripts:atproto-reverse-proxy/scripts/deploy.shanddeploy-fluent-bit.sh,social-web-computer/scripts/deploy.sh,compute-spa/scripts/deploy.sh,deno-macos-runner-desktop/scripts/deploy.sh,did-key-associator/scripts/deploy.sh,socialweb-computer-kcp/scripts/deploy.shanddeploy-pds2.sh,socialweb-computer-ssh/scripts/deploy.sh,deno-kcp/deploy/install-provider.sh(a kubectl install into a kcp workspace, not a host deploy),gitlab-autoscale-socialweb-computer/systemd/gitlab-runner.service, the Caddyfiles,CI.md.
Summary
State: go replaced by Go and live, wired deployed by an infra/ script that works today,
in progress a Go replacement is being built, legacy live but not managed, dead nothing serves it.
| Host | Component | Unit | Listen | Public name | Source | Deployed by (old) | infra/ owner | State |
|---|---|---|---|---|---|---|---|---|
| fedproxy.com | ingress-relay | xrpc-relay-server.service + drop-in 30-go.conf | unix /opt/caddy/xrpc-relay-server.sock | xrpc.fedproxy.com, *.xrpc.fedproxy.com | /opt/xrpc-relay-go/current -> 64491ad29931 (previous d33616e310c3) | scripts/deploy-xrpc-relay.sh | infra/ingress-relay | go, wired |
| fedproxy.com | deno did-key ingress (fallback) | drop-in 20-socialweb-computer-kcp.conf (overridden by 30-go) | same socket | same | /opt/xrpc-relay-kcp/src 0b7b0af, deno /opt/xrpc-relay-kcp/deno-2.9.3 | by hand | infra/ingress-relay --rollback falls back to it | go (fallback kept) |
| fedproxy.com | caddy (xcaddy, cloudflare dns) | caddy.service (/usr/lib/systemd/system) | 80, 443, admin unix /opt/caddy/caddy-admin.sock | fedproxy.com (/var/www/html), rp, xrpc, *.xrpc, xrpc-test, *.xrpc-test | /etc/caddy/Caddyfile | atproto-reverse-proxy/scripts/deploy.sh (prints CF_API_TOKEN; never run) | infra/fedproxy-legacy | legacy |
| fedproxy.com | atprp-ssh-relay | atprp-ssh-relay.service | 2222, 127.0.0.1:6060 | ssh relay of fedproxy | /usr/bin/atprp-ssh-relay (Go, atproto-reverse-proxy) | same | infra/fedproxy-legacy | legacy |
| fedproxy.com | oauth-client-webapp | oauth-client-webapp.service | unix /opt/caddy/web-ui.sock | rp.fedproxy.com | /usr/bin/oauth-client-webapp | same | infra/fedproxy-legacy | legacy |
| fedproxy.com | caddy-check-dns-from-config | caddy-check-dns-from-config.service | 127.0.0.1:5555 | none (on-demand TLS ask) | /usr/bin/caddy-check-dns-from-config | same | infra/fedproxy-legacy | legacy |
| fedproxy.com | xrpc-test relay | none | /opt/caddy/xrpc-relay-server-test.sock missing | xrpc-test.fedproxy.com (502) | none | none | none | dead (caddy block left) |
| fedproxy.com | pre-iroh relay checkout | none | none | none | /opt/xrpc-relay ee6e4a8 (branch pre-iroh) | old deploy.sh git clone | none | dead (files left) |
| mini-cloud-0002.chadig.com | atproto-relay (deno) | atproto-relay.service (User johnandersen777) | 127.0.0.1:2584 | relay.mini-cloud-0002.chadig.com | ~/prod-org-root/atproto-relay 9c26e76 | by hand from the prod-org-root checkout | infra/atproto-relay (stub until scripts/deploy-atproto-relay.sh lands) | in progress (Go internal atproto-relay) |
| mini-cloud-0002.chadig.com | hono-jsr | hono-jsr.service (User johnandersen777) | 0.0.0.0:8888, no caddy site | none here (jsr.publicdomainrelay.com points at mini-cloud-0001) | ~/prod-org-root/hono-jsr 0de4055 | by hand | infra/hono-jsr | legacy |
| mini-cloud-0002.chadig.com | org-root git pull | git-pull.timer (every 5 min) -> git-pull.service (~/bin/git-pull-and-rebuild.sh) | none | none | ~/prod-org-root ea522d1 | by hand | infra/org-root-git-pull | legacy, failing |
| mini-cloud-0002.chadig.com | hono-bidder (deno) | bidder.service (enabled, inactive) | none | none | ~/prod-org-root/atproto-market/hono-bidder | by hand | none | dead |
| mini-cloud-0002.chadig.com | spindle (deno poc) | spindle.service (disabled, inactive) | none | none | ~/prod-compute-contract-reference-implementation-poc | by hand | none | dead |
| mini-cloud-0002.chadig.com | oidc-issuer | none | 127.0.0.1:9000: nothing listens | mini-cloud-0002.fedfork.com (NXDOMAIN) | none | deno-macos-runner-desktop / digitalocean-bidder era | infra/oidc-issuer | dead (caddy block left) |
| mini-cloud-0001.chadig.com (ssh port 1997) | spindle (deno poc) | spindle.service | 0.0.0.0:7777 | *.gha.spindle.tangled.fedcicd.com | ~/prod-compute-contract-reference-implementation-poc ef299b8 | by hand | infra/legacy-poc | legacy |
| mini-cloud-0001.chadig.com | market-registry (deno poc) | market-registry.service, market-registry-tunnel.service (ssh -R) | 0.0.0.0:4031 | via the tunnel | same | by hand | infra/legacy-poc | legacy |
| mini-cloud-0001.chadig.com | bidder tunnel | bidder-tunnel.service (ssh -R); bidder.service inactive | none | none | same | by hand | infra/legacy-poc | legacy |
| mini-cloud-0001.chadig.com | claude-rc | claude-rc.service (enabled, inactive) | none | none | ~/compute-contract-reference-implementation-poc | by hand | infra/legacy-poc | dead |
| mini-cloud-0001.chadig.com | fluent-bit | fluent-bit.service | none | none (ships to OpenSearch) | /opt/fluent-bit | atproto-reverse-proxy/scripts/deploy-fluent-bit.sh | infra/fluent-bit | legacy |
| mini-cloud-0001.chadig.com | caddy | caddy.service + override.conf | 80, 443, 127.0.0.1:2019 | ui, test.ui (static), dev.ui :5177, docs.ui :3030, git.ui :9876, knot1 :5555, tangled.fedcicd.com :3000, gha.spindle (static), jsr.publicdomainrelay.com :8888, mini-cloud-0001.fedfork.com :9000 | /etc/caddy/Caddyfile | by hand | infra/legacy-poc (status) | legacy; only ui.fedfork.com answers 200, the proxied names answer 502 |
| qr.fedfork.com | did-key-associator (QR session transfer) | qr-fedfork-backend.service (root) + caddy.service | 0.0.0.0:5557, 80, 443 | qr.fedfork.com (/var/www/qr.fedfork.com, /xrpc/* -> :5557) | /opt/qr-fedfork/qr-fedfork-backend from ~/src/kcp/did-key-associator | its scripts/deploy.sh (backups /root/qr-backup/<ts>, restore.sh) | infra/did-key-associator | wired |
| socialweb.computer (ssh port 1997) | gateway | socialweb-computer-gateway.service in socialweb's user manager | web app 127.0.0.1:8788, kcp front 6443, TLS front 8443, cert front 8444 | k8s.socialweb.computer, kcp.socialweb.computer | release binary at /var/lib/socialweb-computer/socialweb/bin/current | scripts/deploy.sh with ~/.tmp/deploy (orphan branch swc-deploy) | infra/gateway | go, wired (not ssh-verified) |
| socialweb.computer | old static site, digitalocean-bidder | digitalocean-bidder.service (old) | 127.0.0.1:8000 | socialweb.computer (200), digitalocean.socialweb.computer (502) | /opt/org-root | social-web-computer/scripts/deploy.sh | none | replaced by the gateway; the bidder is dead |
| socialweb.computer | ssh door | socialweb-computer-ssh.service (old deno) or the Go SshGateway | 22 (host sshd on 1997) | ssh.socialweb.computer (200) | /opt/org-root/socialweb-computer-ssh (old) | socialweb-computer-ssh/scripts/deploy.sh | none yet | replaced by Go (run gateway ssh); which one serves now is not verified |
| socialweb.computer | pds2 | pds2.service | 127.0.0.1:8794 | pds2.socialweb.computer (no answer) | ts/hono-pds of a socialweb-computer-kcp checkout | scripts/deploy-pds2.sh | none | dead (the TypeScript it runs is gone from this tree) |
| hat-7 | bidder | socialweb-computer-bidder@<handle>.service in swc-bidder's user manager | port 0 | none | /var/lib/socialweb-computer/swc-bidder/bin/current | install bidder / upgrade over ssh (CONTRIBUTING) | infra/bidder | go, wired (not ssh-verified) |
| hat-9 | bidder | same | port 0 | none | same | same | infra/bidder | go, wired (not ssh-verified) |
| hat-8 (local) | bidder | same (account swc-bidder, uid 947); install records also for test-0002 and test-0003 | port 0 | none | same; staged releases in /var/tmp/swc-release | same, run locally | infra/bidder (SSH_TARGET=local) | go, wired |
| tray.fedfork.com | tray static site | caddy.service | 80, 443 | tray.fedfork.com (404) | /var/www/tray.fedfork.com | deno-macos-runner-desktop/scripts/deploy.sh | infra/tray | legacy (not ssh-verified) |
| compute.fedfork.com | compute-spa | caddy | - | NXDOMAIN | /var/www/compute-spa | compute-spa/scripts/deploy.sh | none | dead |
| plc, jsr, reg.market .fedfork.com | old CI deploy targets | - | - | NXDOMAIN | hono-plc, hono-package-registry, hono-atproto-relay | old .github/workflows/deploy.yml (opkssh, user deploy) | none | dead |
Secret and env file paths (names only, never read)
| Host | Path or unit | Variable names |
|---|---|---|
| fedproxy.com | caddy.service (/usr/lib/systemd/system) Environment= | CF_API_TOKEN |
| fedproxy.com | atprp-ssh-relay.service Environment= | CF_API_TOKEN, THIS_ENDPOINT, CADDY_SOCK, GOMEMLIMIT |
| fedproxy.com | oauth-client-webapp.service Environment= | THIS_ENDPOINT, LISTEN_SOCKET, DATABASE_URI (sqlite /opt/caddy/oauth-client-webapp.db), GOMEMLIMIT |
| fedproxy.com | xrpc-relay-server.service and its drop-ins | UNIX_SOCKET, HOSTNAME, DENO_DIR |
| mini-cloud-0002.chadig.com | ~/prod-org-root/atproto-relay/hono-atproto-relay/atproto-relay.env, .env.secrets | not read |
| mini-cloud-0002.chadig.com | ~/prod-org-root/atproto-market/hono-bidder/bidder.env, .env.secrets | not read |
| mini-cloud-0001.chadig.com | ~/prod-compute-contract-reference-implementation-poc/src/typescript/{spindle,market-registry,bidder}/*.env, *.env.secrets, *-tunnel.env | not read |
| mini-cloud-0001.chadig.com | caddy.service and /etc/systemd/system/caddy.service.d/override.conf | CF_API_TOKEN |
| mini-cloud-0001.chadig.com | /etc/default/fluent-bit, /etc/sysconfig/fluent-bit (optional) | not read |
| socialweb.computer | /var/lib/socialweb-computer/socialweb/gateway.env (from ~/.tmp/deploy/gateway.env) | SOCIALWEB_GATEWAY_AUDIENCES, SOCIALWEB_GATEWAY_KCP_PUBLIC_HOST, SOCIALWEB_CLUSTERPROVIDER_JOIN, SOCIALWEB_CLUSTERPROVIDER_MARKET_DENY_BIDDER_DIDS, SOCIALWEB_CLUSTERPROVIDER_SCALE_MAX_NODES, SOCIALWEB_CLUSTERPROVIDER_SCALE_PODS_PER_NODE, SOCIALWEB_CLUSTERPROVIDER_ESO_NAMESPACE |
| deploy host | ~/.aliceoa_bsky_social_source, ~/.bobvmbuilder_bsky_social_source (mode 0600) | ALICE_ATPROTO_HANDLE, ALICE_ATPROTO_PASSWORD, BOB_ATPROTO_HANDLE, BOB_ATPROTO_PASSWORD |
CF_API_TOKEN sits inline in unit files on fedproxy.com and mini-cloud-0001. When those units are ported,
it moves to OpenBao behind a SecretRef; infra/ never carries it.
Deploy mechanisms, old and new
| Mechanism | Where | Targets | Now |
|---|---|---|---|
atproto-reverse-proxy/scripts/deploy.sh (scp to /tmp/stage, bash -xe over ssh, writes caddy and four units, git clone of the pre-iroh relay) | old org-root | fedproxy.com | never run: it echoes CF_API_TOKEN. infra/fedproxy-legacy is the stub that will replace it |
atproto-reverse-proxy/scripts/deploy-fluent-bit.sh (doctl lookups, OpenSearch) | old org-root | any droplet (mini-cloud-0001 has it) | infra/fluent-bit stub |
social-web-computer/scripts/deploy.sh (static site, tar of the org-root to /opt/org-root, digitalocean-bidder unit) | old org-root | socialweb.computer | replaced by the gateway (scripts/deploy.sh) |
socialweb-computer-ssh/scripts/deploy.sh (deno ssh door, moves host sshd to 1997) | old org-root | socialweb.computer | replaced by the Go SshGateway |
compute-spa/scripts/deploy.sh | old org-root | compute.fedfork.com | dead (NXDOMAIN) |
deno-macos-runner-desktop/scripts/deploy.sh | old org-root | tray.fedfork.com | infra/tray stub |
did-key-associator/scripts/deploy.sh | ~/src/kcp/did-key-associator (the old org-root copy is older) | qr.fedfork.com | wrapped by infra/did-key-associator |
socialweb-computer-kcp/scripts/deploy.sh (old copy) | old org-root | socialweb.computer | superseded by scripts/deploy.sh here |
scripts/deploy-pds2.sh | old org-root and this tree | socialweb.computer | dead: runs ts/hono-pds/main.ts, which this tree no longer has |
.github/workflows/deploy.yml (opkssh, user deploy, six hosts) | old org-root, atproto-reverse-proxy | fedproxy, compute, qr, tray, plc, reg.market, jsr | removed ("ci: remove the Deploy workflow"); CI never deploys |
git-pull.timer (pull every 5 min, reset --hard, submodules, compute-spa rebuild) | mini-cloud-0002 | itself | failing on the atproto-relay submodule checkout; infra/org-root-git-pull stub |
gitlab-runner.service (user unit, ~/bin/gitlab-runner) | old org-root gitlab-autoscale-socialweb-computer | the gitlab host (ssh alias gitlab) | not a deploy target here |
scripts/deploy-xrpc-relay.sh | this tree | fedproxy.com | kept as is; infra/ingress-relay is its port |
scripts/deploy.sh + ~/.tmp/deploy (gateway.env, gateway-spec.yaml) | this tree, orphan branch swc-deploy | socialweb.computer | wrapped by infra/gateway |
install bidder / upgrade --binary --sha256 / rollback over ssh | this tree (CONTRIBUTING, docs/deploy.md) | hat-7, hat-9, local | infra/bidder |
scripts/deploy-atproto-relay.sh (being written) | this tree | mini-cloud-0002 | infra/atproto-relay delegates to it once it lands |
Findings
- mini-cloud-0002
git-pull.servicefails every 5 minutes (Unable to checkout ... in submodule path 'atproto-relay'), and it runsgit reset --hardon the checkout the live atproto relay runs from. - hono-jsr listens on 0.0.0.0:8888 on mini-cloud-0002 with no caddy in front.
- Caddy blocks with no upstream: xrpc-test.fedproxy.com, mini-cloud-0002.fedfork.com (also NXDOMAIN), mini-cloud-0001.fedfork.com, jsr.publicdomainrelay.com, knot1.fedfork.com, tangled.fedcicd.com.
- fedproxy.com keeps the deno relay drop-in
20-socialweb-computer-kcp.confunder30-go.conf; that is the rollback target ofinfra/ingress-relay --rollback./opt/xrpc-relay(pre-iroh) is unused. /opt/xrpc-relay-goholds four versions (64491ad29931 current, d33616e310c3 previous, b0a0710162b3, d7800c7668c2); nothing prunes them.- The prod-org-root checkouts on mini-cloud-0002 point at
org-root-dispatcher-typescript, the org-root's older repository name.