SPRINT-7 T-3 Report — Staging DNS + last1app-edge Public Smoke¶
Date: 2026-08-30
Status: T-3 PASS. STOP — await Ryan review before T-4 (production DNS cutover).
Constraint: No production DNS changes. last1.app / Railway / hosted tcthzakppndkykatoefx untouched.
Executive summary¶
| Workstream | Result |
|---|---|
| Staging DNS (proxied) | Created in zone last1.enterprises |
| Tunnel ingress | Updated on VM 121 (last1app-edge) — dual hostname routing |
| Public smoke (CF proxy) | ALL PASS |
| Cross-routing | Correct — app → monolith; db → Kong |
| Production DNS | Unchanged — last1.app still Railway |
Tunnel: 6b0fa8e8-2eef-4550-9811-12e6ad31d10b (last1app-edge on VM 121 @ 192.168.1.104)
Scripts: t3-configure-tunnel-staging.sh, t3-dns-staging.sh, t3-staging-smoke.sh
1. Staging DNS (NEW — NXDOMAIN before T-3)¶
| Hostname | CNAME target | Proxied | Origin (via tunnel) |
|---|---|---|---|
last1app-app.last1.enterprises |
6b0fa8e8-2eef-4550-9811-12e6ad31d10b.cfargotunnel.com |
Yes | http://192.168.1.104:5000 (monolith) |
last1app-db.last1.enterprises |
same | Yes | http://192.168.1.103:8000 (Kong / Edge / Realtime) |
Zone: last1.enterprises (f13b99308eef77318acf5a9c4b79a69d)
Production hostnames not modified: last1.app, www.last1.app, api.last1.app remain as pre-T-3.
2. Tunnel ingress (last1app-edge)¶
Applied on VM 121 (last1app-app):
- hostname: last1app-app.last1.enterprises
service: http://192.168.1.104:5000
- hostname: last1app-db.last1.enterprises
service: http://192.168.1.103:8000
Existing prod-prep rules retained (no DNS yet):
last1.app/www.last1.app→ monolithapi.last1.app→ Kong
cloudflared tunnel ingress validate → OK. systemctl is-active cloudflared → active.
3. Staging smoke results (public path, through Cloudflare)¶
All requests showed cf-ray + server: cloudflare (proxy confirmed).
| Check | URL | HTTP | Result |
|---|---|---|---|
| Monolith root | https://last1app-app.last1.enterprises/ |
200 | PASS |
| Monolith auth | …/api/auth/user |
200 | PASS — body {"user":null} |
| GoTrue health | https://last1app-db.last1.enterprises/auth/v1/health |
200 | PASS (with apikey: anon — Kong gate) |
| PostgREST anon | …/rest/v1/organizations?select=id&limit=1 |
200 | PASS — RLS-scoped row returned |
| PostgREST no key | …/rest/v1/ |
401 | PASS — auth gate |
| Edge function | …/functions/v1/last1-id-callback |
200 | PASS |
Smoke log: /tmp/last1app-gate-b/t3-staging-smoke-20260830T191509Z.txt
4. Dual-hostname routing (no cross-routing)¶
| Probe | Expected | Observed |
|---|---|---|
last1app-app…/rest/v1/ |
Monolith (SPA), not Kong | 200 HTML SPA (<!DOCTYPE html>) — not Kong JSON |
last1app-db…/ |
Kong, not monolith SPA | 401 Kong/Envoy (Basic realm) — not SPA shell |
Conclusion: App hostname hits monolith only; db hostname hits Kong only. Tunnel dual routing is correct.
5. Production / hosted unchanged¶
| Check | Result |
|---|---|
https://last1.app/ |
Still Railway (x-railway-edge present) |
Hosted Supabase tcthzakppndkykatoefx |
Untouched |
| R940 SMS crons | sms-checkin-cron + org-sms-cron inactive; check-in-proof-events-cron active |
6. T-4 flags (fix or accept before prod DNS)¶
| Flag | Detail | Recommendation |
|---|---|---|
GoTrue /auth/v1/health without apikey |
Returns 401 on sovereign Kong (LAN and staging). With anon apikey → 200 JSON health. |
Document in runbook; health monitors should send apikey header (same as other sovereign stacks). |
| Registry v2 500 | Pre-existing app bug | Repo fix before T-5 (Muster item filed) |
| Pending secret rotations | Stripe SK, Anthropic BWS sync | Pre-teardown checklist |
| Gateway JWT hardening | T2-1 auth table — per-function JWT before public api.last1.app |
T-4/T-5 prep |
Nothing in T-3 smoke blocks staging validation. Registry + JWT hardening are pre-prod-cutover items, not T-3 blockers.
STOP¶
T-3 complete. Staging path proves R940 serving works through Cloudflare proxy + last1app-edge tunnel.
Do not proceed to T-4 (production DNS) until Ryan reviews this report.
Next (after approval): T-4 production DNS cutover per SPRINT-7 gate order (T0 audit §8).