Levandor

FaceKom dev/build host — fk-dev (Tailscale VM)

3 min read

Canonical answer to “where do I build/test FaceKom natively?” — the fk-dev Tailscale VM. The old on-prem ssh Facekom box is decommissioned. Verified 2026-07-01.

ssh Facekom is DEAD — do not resurrect it

The old host (Host Facekom → HostName localhost, User lederera, ProxyJump FKJumpBox → root@lederera-447-fk-hardver) is offline since ~2026-06-27 and decommissioned. Tailscale reports lederera-447-fk-hardver as offline. Per the user: “never use the ssh Facekom host again, we need to use the tailscale fk vm”. Any doc still saying “build on ssh Facekom” means fk-dev.

For Agents

  • Host: fk-dev — GCP VM on tailnet taild4189d.ts.net, tailnet IP 100.91.108.61, MagicDNS fk-dev.taild4189d.ts.net.
  • Connect: command ssh ops@fk-dev.taild4189d.ts.net (user ops, Tailscale SSH — no keypair).
  • ssh gotcha: the user’s interactive shell aliases ssh/scp to a _kaku_wrapped_ssh function that is NOT loaded in a non-interactive shell → plain ssh fails with _kaku_wrapped_ssh: command not found. Always use command ssh / command scp for the raw binary.
  • Use a login shell for remote docker work: command ssh ops@fk-dev.taild4189d.ts.net bash -l -s <<'EOF' … EOF.
  • Still true: build native x86_64 on the remote host, NOT emulated on the Mac — qemu/podman emulation gives SIGSEGV (exit 139), overlay-FS I/O errors (exit 125) and repo-metalink 503s. Only the host changed.
  • Operational runbook (deploy a branch by bind-mount, no image rebuild): fk-dev-deploy-smoke-runbook (general recipe + SSH policy + OpenHours setup) / fk-dev-partner-branch-deploy-runbook (partner swap — uid 1001-vs-1000 ownership traps, the read-only per-service config/local.json, per-partner DB, operator users, css asset build) / fk-dev-nusz-deploy-and-8959-verification (NÚSZ/8959-specific). Architecture/provisioning: tailscale-gcp-dev-box-migration.

Which SSH users work — tested 2026-08-12

ops and root both work. The documented command ssh ops@fk-dev.taild4189d.ts.net above is correct; the short ops@fk-dev and root@fk-dev forms work too.

UserResult
opsOK
rootOK
levander, ubuntu, admin, facekom, vuer, dev, techteamerrefused — tailnet policy does not permit you to SSH as user "<u>"

root re-confirmed working 2026-08-18; the extra refused users (vuer, dev, techteamer) were tested then too — see Access. The per-service names (oss-fk-dev, css-fk-dev, …) are Tailscale sidecar containers, not SSH hosts — port 22 is refused there.

Connect by name, not by IP. fk-dev and fk-dev.taild4189d.ts.net are both in known_hosts; 100.91.108.61 is not, and the IP form fails with Host key verification failed even though the IP is correct.

Hosts

HostStatusReach
fk-dev (100.91.108.61)CURRENT — build/test/deploy herecommand ssh ops@fk-dev.taild4189d.ts.net
lederera-447-fk-hardver (ssh Facekom / FKJumpBox)DECOMMISSIONED — offline since ~2026-06-27—

Tailnet peers (per-service sidecars on fk-dev)

oss-fk-dev (100.91.55.42), css-fk-dev, portal-fk-dev, esign-oss-fk-dev, esign-css-fk-dev, esign-api-fk-dev, css-sdk-demo-fk-dev — each a per-service Tailscale sidecar with its own MagicDNS name (e.g. operator UI at https://oss-fk-dev.taild4189d.ts.net). They are not separate build hosts; the docker stack runs on fk-dev itself.

What this replaces

Everything previously done “on ssh Facekom” now happens on fk-dev:

  • Native image builds — UBI10 migration work (FKITDEV-8252), docker compose build of vuer_docker / vuer_build / vuer-release images.
  • Release packaging — vuer_build ./build.sh -b <client>-<ver> + ./sign-partner.sh (see release-automation-design).
  • Runtime/branch testing — bind-mounted /workspace/<repo> checkouts, in-container yarn install && yarn build, supervisorctl restart all.

Historical notes

Investigation notes written before 2026-07-01 (e.g. dev-box-esign-container-startup-failures-2026-06-01, instacash-external-api-esign-headless-test-2026-06-01, FKITDEV-8787, instacash-esign-dev-box-deploy) describe sessions run on the old box. Their findings (container/image gotchas, deploy recipes, command ssh trick) still hold — only substitute the host with fk-dev.

Graph View

Backlinks