Skip to content

Konstant operations

Operating knowledge for konstant-server (host.konstant). Harvested from hector-sanchez-eu/konstant-server (selective — not a wholesale copy). Canonical policy stays in Conductor; the GitHub repo remains a convenient clone for workstation lab notes until fully superseded.

Purpose

Establish secure, repeatable remote access and day-to-day management of the Ubuntu evaluation host, then grow dual-run workloads on *-konstant.hectorsanchez.eu without flipping production nameservers until cutover sign-off.

Dual-run model

Role Host Notes
Workstation Operator PC Management client (SSH + secret-gate)
Eval / default self-host konstant-server Prove workloads; Funnel / *-konstant hostnames
Production public edge (interim) ai-sandbox Unchanged until cutover

Management approach: SSH-first (plus Tailscale). Prefer Tailscale when off LAN.

Connect from any machine

  1. Install secret-gate; unlock Bitwarden; export needed SSH/DNS/tunnel secret names as env (never paste values into docs or chat).
  2. Configure SSH aliases (see hosts).
  3. Prefer Tailscale: ssh konstant-ts or ssh konstant-deploy.
  4. Health / MCP smoke when Conductor is installed:
curl -fsS https://conductor-konstant.hectorsanchez.eu/health
curl -fsS https://conductor-konstant.hectorsanchez.eu/connect/mcp-smoke.sh | bash

Tailscale Funnel fallback (Host header), when documented on the host:

curl -fsS -H 'Host: conductor-konstant.hectorsanchez.eu' \
  https://konstant-server.tail64860f.ts.net/health

Connect hub for agents: Connecting.

Bootstrap checklist (host)

Order of concerns (idempotent where possible):

  1. SSH hardening + deploy user + sudoers for deploy paths
  2. Bitwarden / secret-gate on operator machine (not secrets in git)
  3. Tailscale join
  4. UFW + fail2ban baseline (mirror hardened posture from vps-legacy where appropriate)
  5. nginx + TLS path (tunnel and/or certbot per current edge decision)
  6. cloudflared tunnel for konstant-server
  7. Platform Control (optional until mutations enabled)
  8. App layout under /srv/apps/<slug>/ with current symlink releases
  9. Socket activation for MCP/HTTP apps (socket activation)

Detailed historical procedures lived in konstant-server runbooks/00–12. Prefer this page + Deploying for Conductor; use the repo only as recovery evidence.

Runbook map (source → Conductor)

Former konstant-server path Topic Conductor home
runbooks/00-connect-from-any-machine.md SSH / TS / Funnel This page + hosts
runbooks/01-ssh-access.md SSH hosts
runbooks/02-bitwarden.md Secrets tooling § secret-gate
runbooks/03-tailscale-ssh.md Mesh SSH hosts
runbooks/04-host-bootstrap.md First boot Bootstrap checklist above
runbooks/05-platform-control-on-konstant.md Control plane tooling § platform-control
runbooks/06-app-cutover-checklist.md Per-app flip cutover
runbooks/07-docker-socket-activation.md Containers + sockets socket activation
runbooks/08-cutover-decommission.md Retire VPS cutover
runbooks/09-standalone-acceptance.md Acceptance Evidence on Operate workstream
runbooks/10-parallel-evaluation.md Dual-run This page + cutover
runbooks/11-mcp-gateway-konstant.md MCP gateway tooling § mcp-gateway
runbooks/12-conductor-konstant.md Conductor deploy Deploying

Edge: Cloudflare Tunnel

Eval ingress uses cloudflare-tunnel-cli (API token ≠ connector token).

Secret name (Bitwarden via secret-gate) Use
CLOUDFLARE_API_TOKEN Tunnel Edit (+ Zone DNS when using CF DNS)
CLOUDFLARE_ACCOUNT_ID Optional default account
CLOUDFLARE_TUNNEL_ID Optional default tunnel UUID
HETZNER_DNS_TOKEN Only for --dns-mode hetzner interim CNAMEs

Never reuse production CLOUDFLARE_TUNNEL_TOKEN (connector) as the API token.

Until hectorsanchez.eu is fully on Cloudflare as planned in cutover, public HTTPS may rely on Funnel or interim VPS TLS proxy for some names.

Platform Control on konstant

When mutations are enabled:

PLATFORM_CONTROL_EDGE_PROVIDER=cloudflare-tunnel
PLATFORM_CONTROL_CF_TUNNEL_EXECUTABLE=/usr/local/bin/cloudflare-tunnel
PLATFORM_CONTROL_CF_TUNNEL_DNS_MODE=none  # or cloudflare when zone ready

VPS production historically used PLATFORM_CONTROL_EDGE_PROVIDER=hetzner with Hetzner A records. Do not run the production tunnel connector token on konstant while the VPS still owns that tunnel.

Capacity note

Treat konstant as the default self-host for new Lab/Portfolio work. Capacity and workload placement (what stays on the workstation vs konstant vs VPS during dual-run) should be recorded on the Operate workstream / Initiative — do not overload the CPX22 without an Observe/Change.

  • GitHub: https://github.com/hector-sanchez-eu/konstant-server (private) — keep until cutover complete; then archive after confirming Conductor coverage.