The upstream WAF (flights.test.aeroflot.ru) is rate-limiting the corp-
VPN exit IP that pve-201's tunnel uses, returning HTML block-pages or
403s for /api/* requests. Every recent ci-deploy run died in pre-warm
or with cached HTML poisoning the SSR; we've sunk a chunk of time on
WAF mitigations (browser UA, cache-bypass, proxy_no_cache, body
validation) and the WAF still wins. Fixing the WAF is customer-side.
Until that's resolved, the e2e suite is dead weight in CI — every run
fails for upstream-only reasons. Pull it from ci-deploy entirely:
* Removed: tunnel-reachability diagnose, /api pre-warm, Playwright
install, Playwright run, the e2e branch in the rollback condition,
and the playwright-report artifact path.
* Kept: build, deploy, swap, wait-for-health (against the SSR root,
which is local nginx → docker, no upstream involved).
release-verify already had its e2e block removed (commit 36bb2d9);
release.yml comment touched up to match.
Specs and playwright.config.ts stay in the tree — they're still useful
for local runs (`pnpm test:e2e`) once we're back on a network position
the WAF tolerates.
Two CI fixes had been applied to ci-deploy.yml but never propagated:
1. release-verify.yml: install Playwright browsers before e2e
`pnpm install --frozen-lockfile` only fetches the npm package; the
chromium binary needs `playwright install --with-deps`. Without this
the e2e step fails on a fresh runner with "browser not found".
(mirrors ci-deploy commit 6e7e931)
2. release.yml: exclude tests/eslint/** from the paranoid `pnpm test`
typescript-eslint's project cache doesn't see runtime-generated
probe files inside the runner container, so those config-drift
guards pass locally but fail CI-only — same reason ci-deploy uses
the exclude flag. (mirrors ci-deploy commit 3fccd8e)
Other ci-deploy specifics (pve-201 concurrency, /api pre-warm + tunnel
diagnostics, CI_DEPLOY=1 quarantine env) intentionally stay ci-deploy-
only: release-verify runs the full suite by design, and the other
fixes are tied to ci-deploy's host/build path.
Runner advertises ubuntu-latest/24.04/22.04 (not pve-201). Jobs now run
inside docker.gitea.com/runner-images:ubuntu-latest containers.
E2e BASE_URL switches from http://127.0.0.1:3002 (host loopback, not
reachable from runner container) to https://ui-dashboard.gnerim.ru with
basic-auth httpCredentials. Tests now traverse the full nginx + auth +
container path, which is what we want anyway.
Two design pivots discovered during Phase B prerequisites:
Routing: Replace static-route + NAT plan with persistent ssh -L tunnel
from pve-201 to webzavod (deployment/systemd/flights-tim-tunnel.service).
nginx proxies /api/ and /map/api/ to https://127.0.0.1:8443 with SNI/Host
overrides so cert validation still targets the real hostname. No webzavod
kernel changes (no ip_forward/MASQUERADE), no /etc/hosts pin needed.
Workflow B: Drop Jenkins trigger/poll automation (operator lacks Jenkins
job-configure access and user API token access). release.yml now stops
after MR merge with a Telegram message containing the Jenkins job URL.
release-verify.yml (new, workflow_dispatch only) runs the customer-URL
e2e suite once the operator has triggered Jenkins manually and it has
completed.
Other:
- SSR loopback port 8081 -> 3002 (8081 was taken by openwebui on pve-201)
- notify-telegram.sh skips cleanly when TG secrets unset (was: hard-fail)
- README + spec addendum cover the new prereqs and removed steps
gnezim