Validation: #479 Vast.ai Bootstrap
Validation: #479 Vast.ai Bootstrap
PR
PR #481 merged to main via squash. CI pipeline #929 passed (clone step only — Salt-only changes, no tofu plan).
Deliverables
- docker-compose.yml.j2 — GOW 4-container stack (xorg, pulseaudio, sunshine, steam) with NVIDIA runtime, shared pulse-socket volume, persistent /workspace storage
- onstart.sh.j2 — Tailscale install + ephemeral auth, docker compose up, logging
- start.sh.j2 — Updated with template passing (docker_compose + onstart params), Tailscale MagicDNS resolution for Moonlight, session timeout watchdog
- init.sls — New states for compose template and onstart script deployment, dead tailscale-key state removed
- gaming.sls — Sunshine credentials, Tailscale hostname, Moonlight defaults, 100GB persistent disk
- secrets/gaming.sls — SOPS placeholders for sunshine_password and tailscale_auth_key
QA
Two independent QA passes (dev agent self-QA + dedicated QA agent). First pass found 3 blockers:
- PulseAudio socket sharing broken (IPC namespace ≠ shared filesystem) — fixed with shared volume
- Tailscale IP never discovered by client — fixed with MagicDNS hostname resolution
- Sunshine password security tradeoff undocumented — documented
All blockers fixed in commit b33b1e8, CI pipeline #929 passed.
Deployment Note
Salt-only change. Requires
salt '*' state.apply gaming-session on archbox to deploy rendered templates. SOPS secrets (sunshine_password, tailscale_auth_key) must be encrypted before first use — placeholders will trigger preflight check failures in start.sh.Verdict
PASS — merged, CI green, QA blockers resolved.