kayg/infraternal

Watch

Fork 0

Preview instance of dev for owner review #279

New issue

Open

opened 2026-11-01 07:45:06 +00:00 by kayg · 2 comments

kayg commented

2026-11-01 07:45:06 +00:00

Owner

Request (owner kayg, 2026-11-01): the Frosted preview at ?mock=1&proto=clusters&scene=1 is a static mock scene, not the product: no canvas lock, no Settings, no sideways scroll between Console windows. Give the owner a REAL running instance of current dev to review.

Plan (J53):

Build origin/dev (f4b61cd6c or newer) as a production build (server + web app + infraternal agent) on infraternal-dev-02-std.
Run it as user claude under a systemd --user unit, fresh state dir ~/preview-dev, bound to the VM's NetBird IP 10.69.69.117, with the infraternal agent enrolled for that VM and a few extra terminal sessions.
Verify with Playwright (Chromium, production build): canvas lock, Settings, multiple windows, sideways scroll, Frosted blur.
Stop the old mock preview servers.

Sign-in steps and the URL will be posted here once it is running (no secrets in this public issue).

Request (owner kayg, 2026-11-01): the Frosted preview at `?mock=1&proto=clusters&scene=1` is a static mock scene, not the product: no canvas lock, no Settings, no sideways scroll between Console windows. Give the owner a REAL running instance of current `dev` to review. Plan (J53): - Build origin/dev (f4b61cd6c or newer) as a production build (server + web app + infraternal agent) on infraternal-dev-02-std. - Run it as user `claude` under a `systemd --user` unit, fresh state dir `~/preview-dev`, bound to the VM's NetBird IP 10.69.69.117, with the infraternal agent enrolled for that VM and a few extra terminal sessions. - Verify with Playwright (Chromium, production build): canvas lock, Settings, multiple windows, sideways scroll, Frosted blur. - Stop the old mock preview servers. Sign-in steps and the URL will be posted here once it is running (no secrets in this public issue).

kayg commented

2026-11-01 08:09:15 +00:00

Author

Owner

Preview instance is running (J53)

Real production build of origin/dev f4b61cd6c (server + web app + host payloads, nix build .#packages.aarch64-linux.default, SOURCE = f4b61cd6c3). No mock server involved. It runs on infraternal-dev-02-std as user claude under systemd --user (lingering on).

URL: https://infraternal-dev-02-std.vpn.kayg.org:4443/ (bound to the NetBird IP 10.69.69.117, so you need NetBird up)

Sign-in uses passkeys, and passkeys only work on a trusted HTTPS hostname, never on a bare IP or plain http. The server therefore serves HTTPS with a private certificate authority. Install the public CA certificate once (infraternal-preview-ca.pem, pasted in the next comment: save it as a .pem file) and trust it for websites:
- macOS: double-click it, add to the login keychain, open it in Keychain Access and set Trust → Always Trust.
- iPhone: AirDrop/open the file, install the profile, then Settings → General → About → Certificate Trust Settings → enable it.
- Chrome/Firefox on Linux: import it as a certificate authority in the browser's certificate settings.
Open the URL. Paste the one-time owner setup code (the orchestrator gives it to you privately; it is never posted here), pick a username, create a passkey and save the recovery key.
You land on the canvas with one Console window. Open more with + (top right) or Ctrl+Shift+K → "open shell".

If the setup code was lost or expired: ssh claude@infraternal-dev-02-std, then ~/preview-dev/current/infraternal server --data ~/preview-dev/data setup-token (works only until an owner exists).

What to look at

Canvas lock: the top-right pill next to the views button (Ctrl+Shift+G). It reads "Canvas lock on/off" on hover.
Settings: views button (top right) → Settings, or Ctrl+3. Window transparency → Frosted is in Appearance.
Sideways scroll between Console windows: horizontal wheel/trackpad swipe, or Previous/Next window.

Verified with Playwright (Chromium, production build, real server on the same bundle, throwaway instance with a virtual passkey)

sign-in flow (setup code → passkey → recovery key → canvas) works
the VM host shows "connected"; 4 real shells (hostname = infraternal-dev-02-std, uname -m = aarch64)
canvas lock button present; click toggles "Canvas lock on" ↔ "Canvas lock off"
Settings reachable from the views list; Appearance, Window Sizes, Hosts windows shown
sideways wheel moves the camera one window stop (window centres moved 471 px, i.e. one window pitch); at the last stop, further wheel in that direction is a no-op
Frosted: on-screen windows compute backdrop-filter: blur(24px), the off-screen window has none (by design, #256)
all 4 Console windows are still there after a page reload

Not done / limitations

The 2–3 extra sessions are not pre-created on your instance: sessions belong to a signed-in account and only you can register the owner passkey. Open them with +. I verified that on the throwaway instance (screenshots below).
The server's own host uses the embedded infraternal agent (it spawns agent --fd 3), so no separate enrolment of this VM was needed. The Mesh view is empty (0 hosts) by design.
The certificate authority is private to this preview and valid 365 days; the host certificate 90 days.
Operations notes: ~/preview-dev/README.md on the VM.

## Preview instance is running (J53) Real production build of `origin/dev` **f4b61cd6c** (server + web app + host payloads, `nix build .#packages.aarch64-linux.default`, `SOURCE` = f4b61cd6c3f52078cad7573c5367d7a6e75f84f0). No mock server involved. It runs on `infraternal-dev-02-std` as user `claude` under `systemd --user` (lingering on). **URL:** https://infraternal-dev-02-std.vpn.kayg.org:4443/ (bound to the NetBird IP 10.69.69.117, so you need NetBird up) ### Sign in (first time) 1. Sign-in uses passkeys, and passkeys only work on a trusted HTTPS hostname, never on a bare IP or plain http. The server therefore serves HTTPS with a private certificate authority. Install the public CA certificate once (`infraternal-preview-ca.pem`, pasted in the next comment: save it as a `.pem` file) and trust it for websites: - macOS: double-click it, add to the *login* keychain, open it in Keychain Access and set *Trust → Always Trust*. - iPhone: AirDrop/open the file, install the profile, then Settings → General → About → Certificate Trust Settings → enable it. - Chrome/Firefox on Linux: import it as a certificate authority in the browser's certificate settings. 2. Open the URL. Paste the **one-time owner setup code** (the orchestrator gives it to you privately; it is never posted here), pick a username, create a passkey and save the recovery key. 3. You land on the canvas with one Console window. Open more with `+` (top right) or `Ctrl+Shift+K` → "open shell". If the setup code was lost or expired: `ssh claude@infraternal-dev-02-std`, then `~/preview-dev/current/infraternal server --data ~/preview-dev/data setup-token` (works only until an owner exists). ### What to look at - **Canvas lock:** the top-right pill next to the views button (`Ctrl+Shift+G`). It reads "Canvas lock on/off" on hover. - **Settings:** views button (top right) → Settings, or `Ctrl+3`. Window transparency → Frosted is in Appearance. - **Sideways scroll between Console windows:** horizontal wheel/trackpad swipe, or Previous/Next window. ### Verified with Playwright (Chromium, production build, real server on the same bundle, throwaway instance with a virtual passkey) - sign-in flow (setup code → passkey → recovery key → canvas) works - the VM host shows "connected"; 4 real shells (`hostname` = infraternal-dev-02-std, `uname -m` = aarch64) - canvas lock button present; click toggles "Canvas lock on" ↔ "Canvas lock off" - Settings reachable from the views list; Appearance, Window Sizes, Hosts windows shown - sideways wheel moves the camera one window stop (window centres moved 471 px, i.e. one window pitch); at the last stop, further wheel in that direction is a no-op - Frosted: on-screen windows compute `backdrop-filter: blur(24px)`, the off-screen window has `none` (by design, #256) - all 4 Console windows are still there after a page reload ### Not done / limitations - The 2–3 extra sessions are **not** pre-created on your instance: sessions belong to a signed-in account and only you can register the owner passkey. Open them with `+`. I verified that on the throwaway instance (screenshots below). - The server's own host uses the embedded infraternal agent (it spawns `agent --fd 3`), so no separate enrolment of this VM was needed. The Mesh view is empty (0 hosts) by design. - The certificate authority is private to this preview and valid 365 days; the host certificate 90 days. - Operations notes: `~/preview-dev/README.md` on the VM.

12-lock-toggled.png

49 KiB

13-scrolled-sideways.png

41 KiB

15b-settings-scrolled.png

88 KiB

17-frosted-mesh.png

157 KiB

18-after-reload.png

153 KiB

11-four-windows.png

41 KiB

kayg commented

2026-11-01 08:09:25 +00:00

Author

Owner

Public CA certificate for the preview (certificate only, no key). Save as infraternal-preview-ca.pem:

Public CA certificate for the preview (certificate only, no key). Save as `infraternal-preview-ca.pem`: ``` -----BEGIN CERTIFICATE----- MIIBqjCCAVCgAwIBAgIUBUmGmH+I1fV2ImkGd6C4/ET07XcwCgYIKoZIzj0EAwIw ITEfMB0GA1UEAwwWaW5mcmF0ZXJuYWwgcHJldmlldyBDQTAeFw0yNjExMDEwNzUw MDZaFw0yNzExMDEwNzUwMDZaMCExHzAdBgNVBAMMFmluZnJhdGVybmFsIHByZXZp ZXcgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARoOQAsc0SVND8MXQm9fLgH ++QKOmUeb6lP2bJut3lXh3bKxIsCPMhJbtbd2DV7yfBZsMTHHtZ8mZnvzANb9kpG o2YwZDAdBgNVHQ4EFgQUcJsx17emLIoxoGbsK1cszb/xdRIwHwYDVR0jBBgwFoAU cJsx17emLIoxoGbsK1cszb/xdRIwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8B Af8EBAMCAQYwCgYIKoZIzj0EAwIDSAAwRQIhAKNcA10dB2tZ4rQygbTRZXIadd8v SUKpOYW6yL9K+zg1AiBXx9rbz1oPfO301whC0jANmf6LVGLjx+KS2om+i+hXRA== -----END CERTIFICATE----- ```

No labels

launch-qa

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kayg/infraternal#279

No description provided.

Rows
Columns