Tier 3 T3-1 Report — Pre-Migration Setup¶
Date: 2026-08-27
Status: T3-1 COMPLETE. STOP here. Await Ryan authorization for T3-2 (code deploy).
Parent audit: TIER_3_ADMIN_MIGRATION_AUDIT.md
1. Railway env audit (admin.last1.enterprises)¶
Source: Railway GraphQL read-only export via LAST1_PLATFORM_RAILWAY_PROD_API_TOKEN (last1-platform BWS).
Project: disciplined-beauty / production
Service: last1-admin (7c02cdf9-0ecc-4a6c-bb5c-e4c940b37dcf)
Constraint honored: No Railway service changes made.
Finding: LAST1_ID_ISSUER¶
| Variable | Railway prod value |
|---|---|
LAST1_ID_ISSUER |
Not set |
LAST1_ID_API_BASE |
Not set |
Implication: last1-admin server code falls back to default LAST1_ID_API_BASE=https://last1.id (server/proxy.ts). Same class of drift as pre-cutover LastVet provider portal.
T3-2/T3-5 action: Set on R940 deploy env (BWS LAST1ADMIN_R940_* render):
Do not change Railway prod during parallel soak unless Ryan explicitly approves early coordination.
Other relevant Railway vars (non-secret URLs only)¶
| Variable | Value |
|---|---|
VITE_API_BASE |
https://last1.app |
REALOUTCOMES_API_BASE |
https://realoutcomes.app |
LASTVET_API_BASE |
https://api.last.vet |
ANGEL_API_BASE |
https://api.angel.report |
PUBLIC_URL |
(set; domain admin.last1.enterprises) |
Total Railway var count: 48 keys (includes Railway-injected RAILWAY_* metadata).
Railway compute sizing (estimated)¶
Railway API did not return memory/replica limits with current token scopes. Sizing based on live analogs:
| Reference | Spec | Observed |
|---|---|---|
| n8n-r940 (VM 112) | 2 vCPU, 4 GB | ~948 MB used at idle |
| last1id-app container (VM 114) | 2 vCPU, 8 GB host | ~44 MB container at idle |
| last1-admin Railway | Node 22 monolith, internal-only | Low steady-state; burst during deploy/build |
Recommended R940 spec: 2 vCPU, 4 GB RAM, 50 GB boot disk (no data disk). Matches n8n Tier 1 pattern; sufficient headroom for Docker image build + Node BFF.
2. VM provisioning (admin-r940)¶
| Property | Value |
|---|---|
| Hostname | admin-r940 |
| VMID | 115 |
| LAN IP | 192.168.1.97/24 |
| Gateway | 192.168.1.1 |
| Spec | 2 vCPU, 4096 MiB RAM, 50 GB tank-fast |
| OS | Ubuntu 24.04 Noble (cloud image) |
| Tailscale | 100.76.87.21 · admin-r940.tailc3bbdc.ts.net |
| SSH | ryan@192.168.1.97 (Ryan GitHub keys injected via guest agent) |
| Hardening | ufw (SSH only), fail2ban, qemu-guest-agent |
Provision script: lastvet-gates/scripts/last1-admin/provision-vm.sh
Post-provision fixes applied:
- Added missing
scsihw: virtio-scsi-single(required for cloud-init disk boot; same as VMs 112/114). - SSH keys: cloud-init did not apply on first boot; keys injected offline via
qm guest exec(same class of issue as n8n VM 112).
Verification:
ssh ryan@192.168.1.97 'hostname && tailscale ip -4 && sudo -n true'
# admin-r940 / 100.76.87.21 / sudo-ok
3. BWS project recommendation¶
| Option | Verdict |
|---|---|
| New BWS project | Not needed |
Existing last1-admin project (719957e4-e73e-41f1-9b75-b480012d7d96) |
Recommended |
Rationale (per BITWARDEN_NAMING_CONVENTION.md):
LAST1ADMIN_R940_*keys belong in the existinglast1-adminBWS project.- Project already holds 23 live keys (gateway secrets, Supabase SRK, Onset/RadioCheck SRKs, Angel/LastVet admin secrets, Muster MCP tokens,
LAST1_TAILSCALE_API_KEY). - Clean separation from
last1id,lastvet, andlast1-platformwithout cross-project credential inference (Tier 2 lesson).
T3-2 prep (not executed): Add LAST1ADMIN_R940_* keys alongside existing Railway-era keys; render to /opt/last1-admin/.env on VM 115. Do not delete Railway keys until T3-7 teardown.
Ryan decision: Default recommendation is use existing project. No action required unless Ryan wants a dedicated R940-only project.
4. Muster tracker¶
Updated parent item migrate-last1-admin-railway-to-r940 (renamed from migrate-last1-admin-compute-to-r940) with T3 phase breakdown and T3-1 completion note.
STOP — Next gate¶
| Phase | Status | Ryan action |
|---|---|---|
| T3-0 Audit | Done | — |
| T3-1 Pre-migration setup | Done | Approve T3-2 kickoff (code deploy to VM 115) |
| T3-2 Code deploy | Blocked | Authorize |
| T3-3 Parallel soak | Blocked | — |
| T3-4 Browser E2E | Blocked | Ryan present |
| T3-5 DNS cutover | Blocked | — |
| T3-6 Soak 24–48h | Blocked | — |
| T3-7 Railway teardown + docs | Blocked | — |
T3-2 will: clone/build last1-admin Docker image on VM 115, render BWS env with LAST1_ID_API_BASE=https://auth.last1.id, run smoke scripts, without touching Railway or shared Supabase.