Skip to main content

Deploy ontology catalog on a box

Runbook 27. Two halves: the service (automated) and the public edge (human DNS + identity provider (OIDC) + edge proxy).

1. Service on sis-interna (not exposed)​

tools/ops/desplegar-ontology-catalog.sh <ssh-host> <Name>

Sends source (~14 MB), not the image (~6.6 GB). Builds on the box with python:3.12. Generates the key on the box. ontology-catalog_ALLOW_ANONYMOUS=false. Neither explorer nor graph store publishes a port.

The script's result is what verification found, not that the commands ran.

2. Wire SIS​

  1. Copy the key from /opt/ontology-catalog/.env to /opt/sis/.env as SOCIETY_ontology-catalog_API_KEY.

  2. Send already-built images (containers save | gzip → containers load). Client boxes do not build SIS services.

  3. Add the variables to the box compose with tools/ops/anadir_ontology-catalog_compose.py (inserts into the society-telemetry block). Editing the repo compose does nothing on the client. Symptom of skipping this: 503 on /ontology-catalog/link.

  4. Recreate:

    tools/ops/desplegar-servicio.sh --remoto <host> --sin-build \
      --permitir-sin-cambio society-telemetry society-graph-ui

  5. tools/ops/verificar-ontology-catalog.sh <host> <Name> <hosts> <models> — includes three cases that must fail (401 without credential / without signature / forged signature). Canaries: hosts in the graph and LLM Router models (recreating telemetry drops chatgpt/* if the ChatGPT account is not connected).

3. Edge onto.<client>.do (already live on both)​

Order matters:

  1. Register the onto.* OIDC application in the identity provider (bundled ops script under tools/ops/, one app per client).
  2. Bring up infra/onto-edge/containers-compose.yml → /opt/oauth2-proxy-onto/. Cookie secret: 32 URL-safe characters (head -c 24 | base64 | tr '+/' '-_' | tr -d '='). A 44-character head -c 32 | base64 sometimes starts and sometimes restart-loops.
  3. Give edge proxy the key (edge-proxy.env mode 600) and recreate edge proxy. Verify the usual domains come back before touching the edge proxy config.
  4. Add the block, edge-proxy validate, edge-proxy reload (hot). Write the edge proxy config by truncate, never mv.
  5. SOCIETY_ontology-catalog_PUBLIC_URL in .env and the box compose.

ontology-catalog-rele publishes 127.0.0.1:8010 because sis-interna is internal: true and container orchestrator ignores ports: there.

DNS: A record by hand (no doctl on the boxes). Do not add the edge proxy vhost before DNS points — Let's Encrypt 429.

Day-to-day use: Ontology.