r3dr: retire the Go service and its serving stack (#1359 chunk 3)

[aaylward]

Closes the last chunk of #1359. v2 has soaked behind api.muchq.com and i.iili.uk has answered the short links since #1432, so the Go shortener retires whole rather than in pieces.

Retired

• domains/r3dr/apis/r3dr — the Go service and its ssh ubuntu@r3dr.net deploy script.
• domains/r3dr/apps/r3dr_web — the old static frontend, plus the r3dr-assets scp and /var/www/r3dr copy that put it on the host (deploy.sh, local_deploy.sh).
• The r3dr compose service and its ghcr.io/muchq/r3dr image pin.
• initialize_host.sh's db_config argument and /etc/r3dr provisioning — the Neon credential's only surface in this repo. The script now takes no arguments.

Docs follow: the deploy README (inventory, init steps, deploy step numbering, rollback config list, /etc list, and the "Go r3dr is the exception" paragraph under Database URLs), the domain README, the root README's project table (r3dr.net → iili.uk), mucks's example pointing at the deleted package, and the hardening plan's r3dr sections.

Test

TestNoDeployConfigNamesTheGoR3drStack pins each surface out of compose.yaml, both Caddyfiles, and the three deploy scripts — service key, image ref, /var/www/r3dr, r3dr-assets, r3dr_web, /etc/r3dr — with r3dr_v2 spellings rewritten away first so the replacement never trips it. Mutation-checked against the pre-change compose.yaml: it fails on all three surfaces there and passes here.

The three files it newly reads (Caddyfile.local, initialize_host.sh, local_deploy.sh) joined the go_test data list. That is not incidental — go test reads the working tree and passed, while Bazel reads the runfiles tree and failed on the missing file. The guard reads named files rather than globbing so an absent one is a runfiles error, not a silent pass.

No coverage is lost with the deleted Go tests: r3dr_v2/encoding_test.cc carries all five of encoding_test.go's slug vectors plus five more at the width transitions and int64 max, and ANegativeIdIsRefused covers the negative-input rejection.

Verified

bazel test //deploy/... //domains/r3dr/... //bazel/rules:rules_test — 22 targets green (the deploy target red first, per above). scripts/test-deploy passes, which executes deploy.sh end-to-end including the edited ssh heredoc. bash -n clean on all three scripts; docker compose config valid on both the plain and the merged observability form; gofmt/buildifier clean.

Review panel ran three lenses. The ops lens confirmed deploy.sh enumerates services and pin variables dynamically out of compose.yaml, so r3dr drops out of --services, the image pre-flight, and pin rewriting without a hardcoded list to edit; the only &caddy_ip anchor is defined in the caddy service well above the deletion site and all four consumers still resolve; nothing had depends_on: r3dr. The completeness lens turned up three stale references — r3dr_v2's README introducing itself as running beside the Go binary, the migrations floor rationale saying r3dr.net "dies with v1", and scripts/test-deploy building its git fixture under the now-deleted r3dr_web path.

The last two commits are comment work only: the retirement had been narrated in the config and READMEs rather than described, and then over-explained. What survives is the two things the code doesn't say — why the host guard matches on Contains, and why r3dr_v2 is rewritten away before the token scan.

Host steps this PR cannot do

1. Deploy full, not --service. deploy.sh passes --remove-orphans only on a full deploy; the old container is restart: always on port 8085 and keeps running until then.
2. sudo rm -rf /etc/r3dr — holds db_config, the live Neon connection string.
3. Revoke the Neon credential and decommission that database. The data was never migrated; r3dr.net links are already dead.
4. sudo rm -rf /var/www/r3dr and rm -rf ~/r3dr-assets.
5. Optional: drop any stale R3DR_SHA= line from the host ~/.env (the pin-clearing loop only iterates variables the current compose.yaml reads), and prune cached ghcr.io/muchq/r3dr images. Future publishes stop on their own — publish.yml enumerates oci_push targets by query, and r3dr's died with its BUILD file.

Left for the #373 sweep and the parked follow-ups (per-op rate budgets, the Cloudflare-KV edge idea) as the issue describes. hashicorp/golang-lru/v2 and lib/pq stay in go.mod — nothing else in the repo imports them now, but pruning them is a dependency change that wants its own PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ST7XLGWstRE4CfUF84ijKD

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	1d4-web	87f4bb2	Commit Preview URL Branch Preview URL	Aug 22 2026, 01:01 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	iili	87f4bb2	Commit Preview URL Branch Preview URL	Aug 22 2026, 01:01 PM

[cursor]

Review

Verdict: Approve. This is a clean, complete retirement of the Go r3dr stack. The diff removes every surface — compose service, OCI image, static frontend, deploy scripts, host provisioning, and docs — and adds a guard test so none of it can creep back unnoticed.

What looks good

Scope is thorough. The Go service (domains/r3dr/apis/r3dr), static frontend (r3dr_web), compose entry, deploy asset copies, /etc/r3dr provisioning, and all related docs are gone. The second commit catches the panel sweep leftovers (r3dr_v2 README tense, migrations comment, test-deploy fixture path).

TestR3drGoServiceStackIsRetired is the right pattern. Pinning each retired token across compose, both Caddyfiles, and all three deploy scripts — with r3dr_v2 rewritten away first — prevents both false negatives and false positives from the replacement service. Adding Caddyfile.local, initialize_host.sh, and local_deploy.sh to the Bazel data list is the correct fix for the runfiles-vs-working-tree gap the PR description calls out.

No coverage lost. r3dr_v2/encoding_test.cc carries all five Go encoding vectors plus width-transition cases; the DTO/shortener behavior was service-specific and doesn't need porting.

Deploy plumbing drops out dynamically. Removing the compose service is enough — deploy.sh derives its service list and image pin variables from compose.yaml, so no hardcoded r3dr references remain to miss.

Host steps are documented honestly. The PR description's post-merge checklist (full deploy with --remove-orphans, revoke Neon credential, clean /etc/r3dr and /var/www/r3dr, optional image prune) is the right handoff.

Non-blocking notes

1. Orphaned go.mod deps (hashicorp/golang-lru/v2, lib/pq) — fine to defer to a separate PR as noted.
2. Guard scope is deploy-config only — READMEs and domain docs may still mention r3dr.net in historical context (e.g. migration floor rationale). That's intentional and correct.
3. build-and-test was still running at review time; all other checks (test-deploy, format-check, sanitizers, CodeQL) were green.

Post-merge reminder

Don't --service r3dr_v2 alone for the first deploy after merge — a full deploy is needed to --remove-orphans the old restart: always container on port 8085.