EPIC: ONEDB target flip — telemetry consolidation onto venus-pg (supersede whey-pg)

VENUSINF-1 venusinfra Backlog urgent

└─ pg_hba + network: allow whey + lezama as remote writers to venus-pg

VENUSINF-8 venusinfra Backlog

└─ Repoint venus-kpi-collect + whey/lezama remote writers to venus-pg

VENUSINF-9 venusinfra Backlog

└─ Provision postgres17 on venus (data dir, listen_addresses, telemetry db + telemetry_rw role)

VENUSINF-7 venusinfra Backlog

└─ Cross-update ONEDB WIs (ONEDB-12 ingestion, ONEDB-10 pg-write flip) for new target host

VENUSINF-10 venusinfra Backlog

└─ Confirm + record: venus-pg is the consolidation target; supersede whey-pg in ONEDB-12/10 + one-db/DESIGN.md

VENUSINF-6 venusinfra Backlog

EPIC: venus hardening (public-IP attack surface) — GATES service exposure

VENUSINF-4 venusinfra Backlog high

└─ nftables/ufw default-deny + per-service allow rules

VENUSINF-19 venusinfra Backlog

└─ ssh lockdown (key-only, no root login) + fail2ban

VENUSINF-20 venusinfra Backlog

└─ Per-service bind/least-exposure audit (pg/hub/smtp listen only where needed)

VENUSINF-21 venusinfra Backlog

└─ unattended-upgrades + basic intrusion/monitoring on venus

VENUSINF-22 venusinfra Backlog low

EPIC: llmmsg hub + runtime DB → venus

VENUSINF-2 venusinfra Backlog high

└─ Repoint whey + lezama MCP shim + bootstrap to venus hub endpoint

VENUSINF-13 venusinfra Backlog

└─ Point llmmsg-hub.pensanta.com (DNS) at venus public IP

VENUSINF-14 venusinfra Backlog

└─ Stand up llmmsg hub service on venus (v2-hub.mjs, port 9703, systemd)

VENUSINF-11 venusinfra Backlog

└─ Migrate runtime DB v2.sqlite whey→venus (quiesce, copy, integrity-check)

VENUSINF-12 venusinfra Backlog

└─ Burn-in then decommission whey hub

VENUSINF-15 venusinfra Backlog low

EPIC: Self-hosted SMTP on venus

VENUSINF-3 venusinfra Backlog

└─ Repoint notify-elazar.sh to venus SMTP; verify delivery to Elazar inbox

VENUSINF-18 venusinfra Backlog

EPIC: whey + lezama thin-client cutover

VENUSINF-5 venusinfra Backlog

└─ whey → thin client (hub/pg/smtp point to venus)

VENUSINF-23 venusinfra Backlog

└─ lezama → thin client via public venus (simplify the whey-VPN dependency)

VENUSINF-24 venusinfra Backlog

└─ Define what stays local on whey vs moves to venus (role redefinition)

VENUSINF-25 venusinfra Backlog

└─ Per-cutover rollback plan + burn-in verification gates

VENUSINF-26 venusinfra Backlog

Stop bash-first file I/O under --dangerously-skip-permissions fleet-wide

VENUSINF-28 venusinfra Backlog low