From 5f4022febe11318e772de4c81d31ebf09cbd54ca Mon Sep 17 00:00:00 2001 From: Rob Lazzurs Date: Sat, 4 Jul 2026 12:30:23 +0000 Subject: [PATCH 1/3] docs(dollarbox): record the family-chat-staging comped org DollarBox org creation and comped billing are staff UI actions with no IaC surface, so this register documents the family-chat ephemeral staging account: quota, reserved IPv6 pool, credential location, and rotation. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01Gv4g5QrwxvAe1BcQF7PdvY --- dollarbox/README.md | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 dollarbox/README.md diff --git a/dollarbox/README.md b/dollarbox/README.md new file mode 100644 index 0000000..c450952 --- /dev/null +++ b/dollarbox/README.md @@ -0,0 +1,33 @@ +# DollarBox accounts + +DollarBox orgs consumed by other UnicornOps projects. Org creation and comped +billing are staff actions in the DollarBox control panel (deliberately not in +the public API or the Terraform provider), so this directory records them as a +register rather than as Terraform. Namespaces/containers *within* an org can +be managed via [terraform-provider-dollarbox](https://github.com/unicornops/terraform-provider-dollarbox) +if IaC is wanted later. + +## family-chat-staging + +Ephemeral staging for [family-chat](https://github.com/unicornops/family-chat) +— see `docs/staging-environment.md` in that repo for the full runbook. + +- **Org**: `family-chat-staging`, comped via + `python manage.py grant_comped_billing family-chat-staging` +- **Quota**: ≥ 20 containers / 60 GB storage (full e2e run ≈ 15 containers) +- **Reserved IPv6**: ≥ 5 addresses in the org's `container-reserved-ipv6` + pool — 4 family homeserver LoadBalancers + 1 control-panel LB (the panel + address is pinned via the `K8S_PANEL_RESERVED_IPV6` GitHub secret) +- **Credentials**: tenant kubeconfig stored as the `KUBECONFIG_STAGING` + secret in the family-chat repo's `staging` GitHub environment +- **Rotation**: regenerate the tenant kubeconfig in the DollarBox panel and + update `KUBECONFIG_STAGING`; nothing else holds it. The org has no API + token by design (`DOLLARBOX_API_TOKEN` stays unset so the family-chat + control panel runs in single-namespace mode). + +## family-chat (production) + +Production family-chat also deploys onto a DollarBox tenant namespace (org +managed separately; see `docs/dollarbox-deployment.md` in the family-chat +repo). Recorded here for completeness — its credentials live in the +family-chat repo's `production` GitHub environment. From 3390c49df07ae065be6d2e9d7813013f065c9c77 Mon Sep 17 00:00:00 2001 From: Rob Lazzurs Date: Sat, 4 Jul 2026 14:44:20 +0000 Subject: [PATCH 2/3] feat(cloudflare): add familychat.dev zone for family-chat staging Dedicated zone so the family-chat ephemeral-staging CI token is scoped away from the production safechat.family zone (Cloudflare subdomain zones are Enterprise-only, hence a separate registrable domain). Free plan, always-use-HTTPS, SSL strict. After apply, point the registrar at the name_servers output and copy zone_id into the family-chat staging GitHub environment as CLOUDFLARE_ZONE_ID. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01Gv4g5QrwxvAe1BcQF7PdvY --- .../zones/familychat-dev/terragrunt.hcl | 71 +++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 cloudflare/unicornops/zones/familychat-dev/terragrunt.hcl diff --git a/cloudflare/unicornops/zones/familychat-dev/terragrunt.hcl b/cloudflare/unicornops/zones/familychat-dev/terragrunt.hcl new file mode 100644 index 0000000..4d9aaaa --- /dev/null +++ b/cloudflare/unicornops/zones/familychat-dev/terragrunt.hcl @@ -0,0 +1,71 @@ +# familychat.dev — dedicated zone for family-chat ephemeral staging. +# +# Deliberately a separate registrable domain (Cloudflare subdomain zones are +# Enterprise-only): the staging CI token is scoped to this zone and cannot +# touch the production safechat.family zone. See family-chat's +# docs/staging-environment.md for the environment this serves. +# +# After first apply: point the registrar's nameservers at the name_servers +# output, then copy zone_id into the family-chat repo's `staging` GitHub +# environment as CLOUDFLARE_ZONE_ID. + +include "root" { + path = find_in_parent_folders("root.hcl") +} + +generate "provider" { + path = "provider.tf" + if_exists = "overwrite_terragrunt" + contents = < Date: Sat, 4 Jul 2026 15:00:01 +0000 Subject: [PATCH 3/3] fix(cloudflare): make familychat.dev zone discoverable by run-all terragrunt run-all only processes modules with terraform.source set; the inline-generated zone needs the self-referencing source. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01Gv4g5QrwxvAe1BcQF7PdvY --- cloudflare/unicornops/zones/familychat-dev/terragrunt.hcl | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/cloudflare/unicornops/zones/familychat-dev/terragrunt.hcl b/cloudflare/unicornops/zones/familychat-dev/terragrunt.hcl index 4d9aaaa..ee0c151 100644 --- a/cloudflare/unicornops/zones/familychat-dev/terragrunt.hcl +++ b/cloudflare/unicornops/zones/familychat-dev/terragrunt.hcl @@ -13,6 +13,12 @@ include "root" { path = find_in_parent_folders("root.hcl") } +# The zone is defined inline via the generate blocks below; the self-referencing +# source is required for terragrunt run-all to discover this module. +terraform { + source = "." +} + generate "provider" { path = "provider.tf" if_exists = "overwrite_terragrunt"