Release v1.14.1 — ansible certs-dir fix + Robokassa go-live #239

Merged

developer merged 2 commits from development into master 2026-07-10 10:58:38 +00:00

Conversation 1 Commits 2 Files Changed 1

+15 -1

developer commented 2026-07-10 10:52:28 +00:00

Owner

Copy Link

Copy Source

Release v1.14.1 — Ansible certs-dir fix + Robokassa go-live

Patch promotion of development to master.

What ships

• #238 — certs dir provisioned 0755 (traversable by the nonroot gateway UID 65532). Root-cause fix for the crash-loop hit during the v1.14.0 rollout (a hoster reboot restarted the gateway, which then could not traverse the 0750 certs dir). Ansible-only — no app/image change; applies on the next provisioning run. The live prod host was already hand-fixed.

Deploy note (not in this PR — env/secrets)

The prod deploy of this tag also flips Robokassa to live: the owner set PROD_BACKEND_ROBOKASSA_TEST empty/0 and the live Pass1/Pass2. The deploy renders the runtime env from these, so IsTest goes off and real Robokassa payments credit. No schema migration in this release → no maintenance window, just a rolling service restart.

Verified before go-live: a Robokassa test payment credited end-to-end on prod (order paid, fund ledger row, balance +50, succeeded event).

# Release v1.14.1 — Ansible certs-dir fix + Robokassa go-live Patch promotion of `development` to `master`. ## What ships - **#238 — certs dir provisioned 0755 (traversable by the nonroot gateway UID 65532).** Root-cause fix for the crash-loop hit during the v1.14.0 rollout (a hoster reboot restarted the gateway, which then could not traverse the 0750 certs dir). Ansible-only — no app/image change; applies on the next provisioning run. The live prod host was already hand-fixed. ## Deploy note (not in this PR — env/secrets) The prod deploy of this tag also flips **Robokassa to live**: the owner set `PROD_BACKEND_ROBOKASSA_TEST` empty/`0` and the live Pass1/Pass2. The deploy renders the runtime env from these, so `IsTest` goes off and real Robokassa payments credit. No schema migration in this release → no maintenance window, just a rolling service restart. Verified before go-live: a Robokassa **test** payment credited end-to-end on prod (order paid, `fund` ledger row, balance +50, `succeeded` event).

developer added 2 commits 2026-07-10 10:52:28 +00:00

fix(deploy): provision the certs dir traversable by the nonroot gateway ... 2d2dd2bc47

The Ansible base-directory loop created /opt/scrabble/certs at mode 0750
(deploy:deploy), like config/dumps/images. The gateway (and backend) run as
the distroless nonroot UID 65532 — not the deploy user — so the container
cannot traverse a 0750 certs dir and fails at startup with
"mtls: load server keypair: ... permission denied", crash-looping.

This is latent: a long-running container holds the keypair in memory and
never re-reads the file, so the misconfig only bites when a container
restarts (a host reboot / redeploy). A hoster maintenance reboot exposed it
on prod — the gateway came back crash-looping while the deploy could not SSH
in mid-reboot.

Split certs out of the 0750 loop and create it 0755 (traversable). The keys
stay 0644 by design (the gateway compose relies on it); the host is
single-tenant + SSH-access-controlled, so a traversable certs dir adds no
meaningful exposure. The live prod host was already chmod-fixed by hand; this
keeps the next provisioning run from re-tightening it.

Merge pull request 'fix(deploy): provision the certs dir traversable by the nonroot gateway' (#238) from fix/ansible-certs-dir-traversable into development 2683103fc1

owner approved these changes 2026-07-10 10:58:08 +00:00

developer merged commit 0ca01133b5 into master 2026-07-10 10:58:38 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

owner

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

owner (Ilia) developer

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: developer/scrabble-game#239