last1.id Mode 2A — Week 1 Execution Report¶
Date: 2026-08-25
Status: Week 1 COMPLETE — STOP for Ryan Week 2 approval (database migration)
Railway / Supabase / GCP: untouched per constraints
DNS auth.last1.id: not created (tunnel route prepared only)
VM inventory¶
| VMID | Hostname | LAN IP | Tailscale IP | Spec |
|---|---|---|---|---|
| 113 | sovereign-db-last1id |
192.168.1.95/24 |
100.102.4.113 |
2 vCPU, 8 GB RAM, 50 GB boot + 100 GB data (tank-fast) |
| 114 | auth-last1id |
192.168.1.96/24 |
100.85.114.46 |
2 vCPU, 8 GB RAM, 50 GB boot (tank-fast) |
Provisioning notes: Noble cloud image + MAC-matched cloud-init network snippets (same pattern as VM 111). Offline SSH key injection required on first boot (documented n8n lesson). scsihw=virtio-scsi-single set after initial bring-up.
Scripts: scripts/last1-id/provision-vms.sh, join-tailscale.sh, setup-postgres.sh, setup-auth-stack.sh, create-bws-secrets-week1.sh, deploy-last1id-observability.sh
Postgres (sovereign-db-last1id)¶
| Item | Status |
|---|---|
| Version | PostgreSQL 17.11 (PGDG; meets 17.6.x+ requirement) |
| Data directory | /data/postgres/17/main (100 GB ZFS disk) |
| Database | last1id_prod |
| Roles | last1id_owner, last1id_app, prometheus_exporter |
| Extensions | pgcrypto |
| Tuning | shared_buffers=2GB, max_connections=100, ssl=on |
| Remote access | listen_addresses=*; pg_hba: auth VM (LAN + Tailscale IP) |
| Schema | Empty auth schema created; GoTrue migrations applied structure only (no Supabase data import — Week 2) |
| Backup | Cron 03:15 UTC daily pg_dump -Fc → /data/postgres/backups/ |
Connection test: last1id_app → 192.168.1.95:5432/last1id_prod OK from auth-last1id.
Follow-up: BWS DATABASE_* URLs use LAN IP (192.168.1.95) because Tailscale east-west to Postgres timed out (ACL review needed before MagicDNS cutover). Revisit before Week 6 public cutover.
GoTrue + Kong (auth-last1id)¶
| Item | Status |
|---|---|
| Stack path | /opt/auth-last1id/ (Docker Compose) |
| GoTrue | supabase/gotrue:v2.170.0 — healthy |
| Kong | kong:2.8.1 — healthy, :8000 |
| Config | GOTRUE_SITE_URL=https://auth.last1.id (target; not public yet) |
| Health | curl http://127.0.0.1:8000/auth/v1/health → GoTrue v2.170.0 |
Not deployed (Week 1 constraint): last1.id Node app, partner OIDC layer (OAUTH_JWT_* — Week 3–4 from Railway).
MinIO (auth-last1id)¶
| Item | Status |
|---|---|
| Endpoint | http://192.168.1.96:9000 (BWS: LAST1_ID_R940_PROD_MINIO_ENDPOINT) |
| Console | :9001 (LAN/Tailscale only) |
| Bucket | profile-photos (empty) |
| Health | /minio/health/live OK |
Cloudflare Tunnel (prepared, no DNS)¶
| Item | Status |
|---|---|
| Tunnel | lastvet-r940 on lastvet-edge (192.168.1.89) |
| Route added | auth.last1.id → http://192.168.1.96:8000 (Kong) |
| DNS | Not created — production still Railway last1.id |
| Validate | cloudflared tunnel ingress validate OK |
BWS (last1-platform)¶
Created Week 1:
| Key | Purpose |
|---|---|
LAST1_ID_R940_PROD_DATABASE_URL |
App/GoTrue role (LAN host Week 1) |
LAST1_ID_R940_PROD_DATABASE_OWNER_URL |
Owner/migrations |
LAST1_ID_R940_PROD_GOTRUE_JWT_SECRET |
New GoTrue session JWT (0 users) |
LAST1_ID_R940_PROD_GOTRUE_ADMIN_SECRET |
GoTrue admin API |
LAST1_ID_R940_PROD_MINIO_ACCESS_KEY |
MinIO root user |
LAST1_ID_R940_PROD_MINIO_SECRET_KEY |
MinIO root password |
LAST1_ID_R940_PROD_MINIO_ENDPOINT |
S3 endpoint URL |
LAST1_ID_R940_POSTGRES_EXPORTER_PASSWORD |
Observability scrape user |
Deferred Week 3–4: OAUTH_JWT_*, GOOGLE_OAUTH_*, SMTP_* (from Railway).
Observability¶
| Component | Status |
|---|---|
| node_exporter | .95:9100, .96:9100 |
| postgres_exporter | .95:9187 (pg_up=1) |
| promtail | Both VMs → Loki 192.168.1.93:3100 |
| Prometheus | Scrape targets + rules deployed |
| Alerts (critical) | PostgresLast1idDown, PostgresLast1idExporterDown, GoTrueDown, KongDown (host-level; service-level HTTP probes Week 2+) |
| Alerts (warning) | Last1idHighDbConnections, Last1idDbDiskSpaceLow |
| Grafana dashboards | Deferred — Prometheus/Loki wired; dashboard JSON Week 2 |
NPM package audit (V8)¶
Scope: Last-1-Enterprises/last1.id @ main; npm registry @last1id/*.
| Package | npm version | Published | Hard-coded infra URLs |
|---|---|---|---|
@last1id/sdk |
0.3.1 | Yes | No — issuerUrl is caller-supplied |
@last1id/login-button |
0.1.3 | Yes | No |
@last1id/sdk-nextjs |
0.1.0 | Yes | No |
@last1id/sdk-react-native |
0.1.0 | Yes | No |
@last1id/evidence-sdk |
0.1.1 in repo | Not on npm | N/A |
README examples use https://last1.id as documentation default (not compiled into SDK). No Railway URLs in package source.
Migration impact: npm publishing continues from repo (npm run sdk:publish); no registry migration needed. Week 6 issuer move to https://auth.last1.id requires consumer config updates (LastVet, docs), not npm republish unless README major refresh desired.
Constraints verified¶
| Constraint | OK |
|---|---|
| Railway last1.id untouched | Yes |
| Supabase project untouched | Yes |
| GCP OAuth untouched | Yes |
| last1.id app code not deployed | Yes |
auth.last1.id DNS not created |
Yes |
STOP — Ryan Week 2 approval¶
Week 2 begins Supabase schema + data migration (pg_dump, RLS, MinIO photo copy). Approve to proceed:
- Accept LAN IP in BWS
DATABASE_*for Week 2 work (or approve Tailscale ACL change first). - Confirm empty GoTrue
authschema on R940 is acceptable vs waiting for full dump-first approach. - Week 2 kickoff date.
Ryan action: Reply approve Week 2 (or note ACL/Tailscale priority).
Known issues / debt¶
- Tailscale ACL:
auth-last1idcannot reachsovereign-db-last1idover Tailscale (100.x); LAN works. Fix ACL before relying on MagicDNS in secrets. - Cloud-init SSH keys: First-boot
--sshkeysunreliable; virt-customize injection documented inprovision-vms.shfollow-up. - Grafana dashboards
postgres-last1id,gotrue-last1id: not yet checked in (metrics wired). - GoTrue/Kong service alerts: Host-down only; add blackbox or textfile probes Week 2.