Windmill + LogMCP decommission — host-side runbook

Windmill + LogMCP decommission — host-side runbook

Status: repo-side deletion landed first (WS4, 2026-08-26); host steps below
are PENDING and must be run by an operator session with SSH access to the
VPS.

Repo-side, this branch removed: u/admin/**, wmill.yaml, AGENTS.wmill.md,
deploy/windmill/**, deploy/scripts/install-windmill{,-db}.sh,
install-nsjail.sh, deploy/systemd/brioso-windmill*, the
brioso-logmcp.service unit, deploy/logmcp/**, deploy/sudoers/logmcp, and
the admin./logs. Caddy blocks. The pre-removal tree is preserved on local
branch archive/windmill at caf8ea81 (not pushed).

All commands below assume root on the VPS (sudo -i).

1. Windmill

# Stop and disable the services
systemctl disable --now brioso-windmill
runuser -u web-services -- env XDG_RUNTIME_DIR=/run/user/$(id -u web-services) \
  systemctl --user disable --now brioso-windmill-db

# Remove the quadlet-managed container + volume (as web-services)
runuser -u web-services -- env XDG_RUNTIME_DIR=/run/user/$(id -u web-services) \
  podman rm -f brioso-windmill-db
runuser -u web-services -- env XDG_RUNTIME_DIR=/run/user/$(id -u web-services) \
  podman volume rm brioso-windmill-db-data   # drops Windmill's Postgres data — intentional

# Remove unit files and env files
rm -f /etc/systemd/system/brioso-windmill.service
rm -f ~web-services/.config/containers/systemd/brioso-windmill-db.container \
      ~web-services/.config/containers/systemd/brioso-windmill-db-data.volume
rm -f /etc/brioso/windmill.env /etc/brioso/windmill-db.env
systemctl daemon-reload
runuser -u web-services -- env XDG_RUNTIME_DIR=/run/user/$(id -u web-services) \
  systemctl --user daemon-reload

# Remove the windmill system user and its home (adjust paths if customized)
userdel -r windmill 2>/dev/null || true

# Optional: remove the Windmill binary and nsjail (deployed by the deleted
# install scripts) — find their locations with:
#   grep -rn "ExecStart" /etc/systemd/system/brioso-windmill.service  # before rm
#   ls /usr/local/bin | grep -Ei 'windmill|nsjail'

2. LogMCP

systemctl disable --now brioso-logmcp
rm -f /etc/systemd/system/brioso-logmcp.service
rm -rf /etc/logmcp
userdel -r logmcp 2>/dev/null || true   # if the logmcp service user exists

# Sudoers files (the diag one STAYS — it is the replacement restart surface)
rm -f /etc/sudoers.d/logmcp
visudo -c   # must print no parse errors — a broken sudoers.d file locks out sudo

3. Shared surfaces (Caddy)

The admin.usebrioso.com and logs.usebrioso.com blocks were removed from
deploy/caddy/Caddyfile repo-side. After the next deploy the reconciled file
lands on the VPS; or reconcile immediately:

# Reconcile Caddy config now (same as deploy does):
install -m 644 /opt/brioso/repo/deploy/caddy/Caddyfile /etc/caddy/Caddyfile
systemctl restart brioso-caddy

Optionally drop LOGMCP_API_KEY and the WINDMILL_* secrets from Infisical
(/infra/caddy, /infra) once confirmed unused.

4. Verify

# No windmill/logmcp processes listening
ss -tlnp | grep -E ':8010|:5433|:4985'   # expect no output
systemctl list-units --all | grep -Ei 'windmill|logmcp'   # expect no output
pgrep -af windmill; pgrep -af logmcp     # expect no output

# Reset failed-state accounting so stale failures don't linger
systemctl reset-failed

# Caddy no longer serves the removed subdomains
curl -sI https://db.usebrioso.com/ | head -1   # still Live: 200/30x
curl -sI https://admin.usebrioso.com/ | head -1 # gone: no route / timeout

Pending integration-session steps (owned by other agents’ dirs)

• deploy/pyinfra/**: remove any windmill/logmcp provision references
  (provision/logmcp.py, windmill units/env sync, nsjail) — off-limits in
  the WS4 repo-side pass.
• .github/workflows/**: drop windmill-related deploy steps if referenced.