Lab: remember-me, Grafana proxy fix, builder cache dirs, branded QR alerts.

Grafana auth restore + nginx proxy_cookie_path; alert-notifier branded QR; prepare-be-builder-dirs shared ccache/gradle; bump ac-scripts for Docker DLC maintenance.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/scripts/configure-docker-storage.sh

@@ -0,0 +1,83 @@
+#!/bin/sh
+# Docker storage for cast01 builder: dedicated local xvdb + NFS cold backup.
+#
+# /var/lib/docker on /dev/xvdb1 (64G ext4). Do NOT bind-mount NFS for live
+# docker root (vfs + NFS = hung container creates). Optional rsync to
+# /shared/docker for archive/restore only.
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=/dev/null
+. "$ROOT/scripts/lib/common.sh"
+load_cluster_env
+
+DOCKER_BACKUP="${DOCKER_NFS_DIR:-${SHARED_MOUNT}/docker}"
+DOCKER_DST="/var/lib/docker"
+DOCKER_DISK="${DOCKER_DATA_DISK:-/dev/xvdb1}"
+DOCKER_LABEL="${DOCKER_DATA_LABEL:-docker-data}"
+FSTAB="/etc/fstab"
+
+log "configure docker storage (disk ${DOCKER_DISK}, NFS backup ${DOCKER_BACKUP})"
+
+mount | grep -q " ${SHARED_MOUNT} " || die "/shared not mounted"
+mkdir -p "${DOCKER_BACKUP}" "${DOCKER_DST}"
+
+# Remove obsolete NFS bind mount if present.
+if mount | grep -q "${DOCKER_BACKUP} on ${DOCKER_DST}"; then
+  log "removing NFS bind from ${DOCKER_DST}"
+  rc-service docker stop 2>/dev/null || true
+  sleep 2
+  umount -l "${DOCKER_DST}" 2>/dev/null || true
+fi
+sed -i "/\\/shared\\/docker \\/var\\/lib\\/docker/d" "${FSTAB}" 2>/dev/null || true
+
+ensure_docker_disk() {
+  if [ ! -b "${DOCKER_DISK}" ]; then
+    log "WARN ${DOCKER_DISK} missing — using existing ${DOCKER_DST} mount"
+    return 0
+  fi
+  mdev -s 2>/dev/null || true
+  if ! blkid "${DOCKER_DISK}" 2>/dev/null | grep -q ext4; then
+    log "format ${DOCKER_DISK} ext4 label=${DOCKER_LABEL}"
+    rc-service docker stop 2>/dev/null || true
+    sleep 2
+    mkfs.ext4 -L "${DOCKER_LABEL}" -F "${DOCKER_DISK}"
+  fi
+  uuid="$(blkid -s UUID -o value "${DOCKER_DISK}" 2>/dev/null || true)"
+  if [ -n "${uuid}" ]; then
+    sed -i "\|${DOCKER_DST}|d" "${FSTAB}" 2>/dev/null || true
+    if ! grep -q "${uuid}" "${FSTAB}" 2>/dev/null; then
+      echo "UUID=${uuid}  ${DOCKER_DST}  ext4  defaults,noatime,nofail  0  2" >> "${FSTAB}"
+      log "fstab: UUID=${uuid} → ${DOCKER_DST}"
+    fi
+  fi
+  if ! mount | grep -q " on ${DOCKER_DST} "; then
+    log "mount ${DOCKER_DISK} → ${DOCKER_DST}"
+    mount "${DOCKER_DISK}" "${DOCKER_DST}" 2>/dev/null || mount "${DOCKER_DST}" 2>/dev/null || true
+  fi
+}
+
+ensure_docker_disk
+
+if [ "${DOCKER_RESTORE_FROM_NFS:-0}" = "1" ] && [ -d "${DOCKER_BACKUP}/vfs" ]; then
+  log "restore: rsync ${DOCKER_BACKUP} → ${DOCKER_DST}"
+  rc-service docker stop 2>/dev/null || true
+  sleep 2
+  rsync -a "${DOCKER_BACKUP}/" "${DOCKER_DST}/"
+fi
+
+if [ "${DOCKER_BACKUP_TO_NFS:-0}" = "1" ] && [ -d "${DOCKER_DST}/vfs" ]; then
+  log "backup: rsync ${DOCKER_DST} → ${DOCKER_BACKUP}"
+  rsync -a "${DOCKER_DST}/" "${DOCKER_BACKUP}/"
+fi
+
+rc-service docker start 2>/dev/null || rc-service docker restart 2>/dev/null || true
+sleep 2
+if docker info >/dev/null 2>&1; then
+  log "docker OK root=$(docker info 2>/dev/null | awk -F': ' '/Docker Root Dir/{print $2}')"
+  docker system df 2>/dev/null || true
+else
+  log "WARN docker info failed"
+fi
+
+df -h / "${DOCKER_DST}" 2>/dev/null || true
+log "configure-docker-storage_ok $(host_short)"

sim/cluster0/scripts/prune-builder-artifacts.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+# Prune obsolete Docker layers and old build artifact trees on builder nodes.
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=/dev/null
+. "$ROOT/scripts/lib/common.sh"
+load_cluster_env
+
+KEEP_BUILDS="${KEEP_BUILDS:-5}"
+BUILDS="${BUILDER_BUILDS_DIR:-/var/www/ac/broadcast/builds}"
+
+log "prune docker build cache + dangling images"
+docker builder prune -af 2>/dev/null || true
+docker image prune -af 2>/dev/null || true
+
+if [ -d "${BUILDS}" ]; then
+  log "prune build dirs under ${BUILDS} (keep newest ${KEEP_BUILDS})"
+  # Numeric build IDs only; sort descending, drop oldest beyond KEEP_BUILDS.
+  ls -1 "${BUILDS}" 2>/dev/null | awk '/^[0-9]+$/' | sort -rn | tail -n +"$((KEEP_BUILDS + 1))" | while read -r id; do
+    log "  remove builds/${id}"
+    rm -rf "${BUILDS}/${id}"
+  done
+fi
+
+docker system df 2>/dev/null || true
+df -h / /shared 2>/dev/null || true
+log "prune-builder-artifacts_ok $(host_short)"