EPIC: ONEDB target flip — telemetry consolidation onto venus-pg (supersede whey-pg)

VENUSINF-1 venusinfra Backlog urgent

└─ Phase 1: unified agent telemetry schema and dual-run collectors

VENUSINF-29 venusinfra Canceled high

└─ pg_hba + network: allow whey + lezama as remote writers to venus-pg

VENUSINF-8 venusinfra Backlog

└─ Repoint venus-kpi-collect + whey/lezama remote writers to venus-pg

VENUSINF-9 venusinfra Backlog

└─ Provision postgres17 on venus (data dir, listen_addresses, telemetry db + telemetry_rw role)

VENUSINF-7 venusinfra Backlog

└─ Cross-update ONEDB WIs (ONEDB-12 ingestion, ONEDB-10 pg-write flip) for new target host

VENUSINF-10 venusinfra Backlog

└─ Confirm + record: venus-pg is the consolidation target; supersede whey-pg in ONEDB-12/10 + one-db/DESIGN.md

VENUSINF-6 venusinfra Backlog

EPIC: venus hardening (public-IP attack surface) — GATES service exposure

VENUSINF-4 venusinfra Backlog high

└─ nftables/ufw default-deny + per-service allow rules

VENUSINF-19 venusinfra Backlog

└─ ssh lockdown (key-only, no root login) + fail2ban

VENUSINF-20 venusinfra Backlog

└─ Per-service bind/least-exposure audit (pg/hub/smtp listen only where needed)

VENUSINF-21 venusinfra Backlog

└─ unattended-upgrades + basic intrusion/monitoring on venus

VENUSINF-22 venusinfra Backlog low

EPIC: llmmsg hub + runtime DB → venus

VENUSINF-2 venusinfra Backlog high

└─ Repoint whey + lezama MCP shim + bootstrap to venus hub endpoint

VENUSINF-13 venusinfra Backlog

└─ Point llmmsg-hub.pensanta.com (DNS) at venus public IP

VENUSINF-14 venusinfra Backlog

└─ Stand up llmmsg hub service on venus (v2-hub.mjs, port 9703, systemd)

VENUSINF-11 venusinfra Backlog

└─ Migrate runtime DB v2.sqlite whey→venus (quiesce, copy, integrity-check)

VENUSINF-12 venusinfra Backlog

└─ Burn-in then decommission whey hub

VENUSINF-15 venusinfra Backlog low

getmethaturl.pensanta.com - agent URL fetch/normalize API

VENUSINF-31 venusinfra Canceled

└─ SSRF hardening, api-key auth, rate limiting

VENUSINF-33 venusinfra Canceled high

└─ DNS + TLS + service registration on venus

VENUSINF-34 venusinfra Canceled

└─ Issue api-key to pm-medida-odaia-cc, store in ltm.md

VENUSINF-35 venusinfra Canceled

└─ Fetch + normalize service (html/txt/md/yaml/zip)

VENUSINF-32 venusinfra Canceled

└─ Discoverability: global CLAUDE.md lazy-load entry (nw-whey-cc owns)

VENUSINF-36 venusinfra Canceled low

Finish /data-venus cleanup - kpi-web-migration move/trash decision

VENUSINF-30 venusinfra Done

Orphan-sweep cron for /srv/share/incoming/ dead-letter files

VENUSINF-27 venusinfra Done

EPIC: Self-hosted SMTP on venus

VENUSINF-3 venusinfra Backlog

└─ PTR/reverse-DNS + SPF/DKIM/DMARC for deliverability

VENUSINF-17 venusinfra Todo

└─ Install + configure MTA (postfix) on venus

VENUSINF-16 venusinfra Todo

└─ Repoint notify-elazar.sh to venus SMTP; verify delivery to Elazar inbox

VENUSINF-18 venusinfra Backlog

EPIC: whey + lezama thin-client cutover

VENUSINF-5 venusinfra Backlog

└─ whey → thin client (hub/pg/smtp point to venus)

VENUSINF-23 venusinfra Backlog

└─ lezama → thin client via public venus (simplify the whey-VPN dependency)

VENUSINF-24 venusinfra Backlog

└─ Define what stays local on whey vs moves to venus (role redefinition)

VENUSINF-25 venusinfra Backlog

└─ Per-cutover rollback plan + burn-in verification gates

VENUSINF-26 venusinfra Backlog

Stop bash-first file I/O under --dangerously-skip-permissions fleet-wide

VENUSINF-28 venusinfra Backlog low