Tier 3 T3-2 Report — Code deploy (admin-r940)¶
Date: 2026-08-28
Status: T3-2 COMPLETE. STOP here. Await Ryan authorization for T3-3 (parallel soak + Cloudflare Tunnel route).
Parent: TIER_3_ADMIN_T3-1_REPORT.md
1. BWS — LAST1ADMIN_R940_PROD_* keys¶
Project: last1-admin (719957e4-e73e-41f1-9b75-b480012d7d96)
| Action | Result |
|---|---|
| Source | Railway GraphQL read-only (disciplined-beauty / production / last1-admin service) |
| Keys synced | 36 LAST1ADMIN_R940_PROD_* secrets created |
| Legacy unprefixed keys | Retained (parallel soak) |
| Railway vars | Unchanged |
Override applied (T3-1 finding):
Derived at render time:
LAST1_API_BASE/VITE_LAST1_API_BASEfrom RailwayVITE_API_BASE(https://last1.app)
Script: scripts/last1-admin/sync-r940-bws-from-railway.py
2. Rendered env on VM 115¶
| Path | Keys |
|---|---|
/opt/last1-admin/.env |
40 (mode 600, owner ryan) |
Script: scripts/last1-admin/render-last1admin-env-r940.sh (operator render + scp)
3. Docker deploy (VM 115 / admin-r940)¶
| Item | Value |
|---|---|
| Host | admin-r940 · 192.168.1.97 · VMID 115 |
| Repo on VM | /opt/last1-admin/src (rsync from operator; VM has no GitHub deploy key yet) |
| Image | last1admin-r940:prod |
| Container | last1admin-app |
| Bind | 127.0.0.1:5000 → 5000 (localhost only) |
| Docker | Installed (docker.io 29.x) |
Script: scripts/last1-admin/deploy-last1admin-r940.sh
Build note: Source cloned on operator via gh auth token HTTPS, rsync'd to VM (same pattern as n8n Tier 1 until VM GitHub key is wired).
4. Health verification (local only)¶
| Check | Result |
|---|---|
| Container running | last1admin-app Up, port 127.0.0.1:5000->5000/tcp |
curl http://127.0.0.1:5000/ |
HTTP 200 (SPA shell) |
| Server log | Admin server listening on port 5000 |
| Env spot-check | LAST1_ID_API_BASE=https://auth.last1.id present |
Not tested in T3-2: Supabase login flow, unit switcher proxies, browser E2E (T3-3/T3-4).
5. Tunnel / DNS prep (NOT applied)¶
Documented only — no Cloudflare Tunnel route created, no DNS change.
Script: scripts/last1-admin/stage-tunnel-prep-r940.sh
| Phase | Target |
|---|---|
| T3-3 | Add tunnel route admin.last1.enterprises → http://192.168.1.97:5000 (parallel with Railway) |
| T3-5 | Cutover DNS to R940 origin |
| T3-7 | Railway teardown |
Constraints honored¶
| Constraint | Status |
|---|---|
| No DNS changes | OK |
| No Railway teardown | OK |
| No Supabase migration | OK |
| No last1.app / RadioCheck / Twilio work | OK |
| No cross-project BWS inference | OK (Railway → same last1-admin project only) |
STOP — Next gate¶
| Phase | Status | Ryan action |
|---|---|---|
| T3-2 Code deploy | Done | Approve T3-3 (parallel soak + tunnel route) |
| T3-3 Parallel soak | Blocked | Authorize |
| T3-4 Browser E2E | Blocked | Ryan present |
| T3-5 DNS cutover | Blocked | — |
T3-3 will: expose R940 via Cloudflare Tunnel (staging path), run curl/smoke against both Railway and R940, keep Railway as production traffic path until T3-5.