feat: provision Alpine LXC 136 running Atheos, wired to Gitea
Provisions a LAN-only browser code editor (Atheos) in an Alpine 3.23 LXC on the scotty PVE node, with armistace/blog cloned and ready to edit. Built via the AI-DLC workflow; the full process trail is in aidlc-docs/. Deliverables - scripts/provision.sh rebuild the guest from scratch (re-runnable) - scripts/update-atheos.sh move Atheos to latest upstream and RE-PIN - scripts/build-and-test.sh captures evidence for every acceptance criterion - files/atheos.conf nginx vhost (socket path byte-matches the FPM pool) - files/ssh-config ~atheos/.ssh/config deploy-key alias - RUNBOOK.md operational guide (START AT STEP 1) - docs/security-notes.md credential model + wider-web hardening TODOs - docs/resiliency-notes.md what a non-PoC deployment would need Design decisions - D1 no git identity is configured by the agent; the operator sets it. Git will refuse the first commit until then, which is deliberate (requirement FR-11). - D2 Atheos pinned to commit f90cd18 (build 611) with a verified tarball sha256, plus update-atheos.sh as the deliberate escape hatch. - D3 nginx :80, web root /var/www/atheos, php-fpm over a unix socket. - D6 git auth is a per-repository DEPLOY KEY scoped to armistace/blog, not a personal access token (a PAT's write:repository scope reaches every repo the account can write). Verified on the live guest (40 checks, 0 failures) - AC-2 Atheos served over HTTP 200 by nginx+php-fpm; socket paths byte-match - AC-3 20 posts + themes/cleanblog present; owned by the php-fpm user - AC-4 all five writable paths writable as the service user - AC-5 remote targets armistace/blog; deploy key authenticates over SSH - AC-6 survival proven with a real container restart, marker byte-identical - AC-8 no python/pelican/pip/make and no DB engine - scope boundary enforced - FR-11 git identity is empty; deploy key mode 600 owned by the service user Traps documented in the RUNBOOK (each cost real debugging time) - The Gitea SSH user is `gitea`, NOT `git` (app.ini SSH_USER=gitea). With `git`, sshd answers "Invalid user git" and rejects before reading authorized_keys, which is indistinguishable from a bad key. - The Gitea SSH endpoint is the LAN address (:22 is not forwarded publicly). - `uptime` and `free` report the PVE HOST inside an LXC without lxcfs, so a container that just restarted can claim days of uptime.
This commit is contained in:
@@ -0,0 +1,128 @@
|
||||
#!/bin/sh
|
||||
# ==============================================================================
|
||||
# build-and-test.sh — captures evidence for every acceptance criterion (AC-1..AC-8)
|
||||
# Run ON THE GUEST: ssh root@192.168.178.57 'sh -s' < build-and-test.sh
|
||||
# ==============================================================================
|
||||
W=/var/www/atheos
|
||||
B=$W/workspace/blog
|
||||
pass=0; fail=0
|
||||
ok() { echo " PASS $1"; pass=$((pass+1)); }
|
||||
bad() { echo " FAIL $1"; fail=$((fail+1)); }
|
||||
chk() { if [ "$2" = "$3" ]; then ok "$1 ($2)"; else bad "$1 (got '$2', want '$3')"; fi; }
|
||||
asuser() { su -s /bin/sh atheos -c "$1"; }
|
||||
|
||||
echo "=============================================================="
|
||||
echo "AC-2 Atheos is served by nginx+PHP (not 502/404)"
|
||||
echo "=============================================================="
|
||||
CODE=$(wget -qO /tmp/idx.html --server-response http://127.0.0.1/ 2>&1 | sed -n 's/.*HTTP\/1\.[01] \([0-9]*\).*/\1/p' | head -1)
|
||||
chk "HTTP status for /" "$CODE" "200"
|
||||
if grep -qi '<title>Atheos IDE</title>' /tmp/idx.html 2>/dev/null; then ok "served page is the Atheos IDE"; else bad "served page is not Atheos"; fi
|
||||
if grep -qiE 'install|setup' /tmp/idx.html 2>/dev/null; then ok "first-run installer/login markers present"; else bad "no installer markers"; fi
|
||||
SOCK=$(sed -n 's/^listen = //p' /etc/php83/php-fpm.d/www.conf | head -1)
|
||||
NGX=$(sed -n 's/.*fastcgi_pass unix:\([^;]*\);.*/\1/p' /etc/nginx/http.d/atheos.conf | head -1)
|
||||
echo " --- socket contract (I-1):"
|
||||
echo " php-fpm listen : $SOCK"
|
||||
echo " nginx fastcgi : $NGX"
|
||||
chk "socket paths byte-match" "$NGX" "$SOCK"
|
||||
|
||||
echo
|
||||
echo "=============================================================="
|
||||
echo "AC-3 'blog' is present with files that can be opened"
|
||||
echo "=============================================================="
|
||||
chk "posts found" "$(ls $B/src/content/*.md 2>/dev/null | wc -l | tr -d ' ')" "20"
|
||||
if [ -d "$W/workspace/blog/.git" ]; then ok "it is a git working copy"; else bad "not a git working copy"; fi
|
||||
chk "theme present" "$(ls $B/src/themes 2>/dev/null | tr -d ' ')" "cleanblog"
|
||||
chk "workspace owner" "$(stat -c '%U' $W/workspace/blog)" "atheos"
|
||||
|
||||
echo
|
||||
echo "=============================================================="
|
||||
echo "AC-4 An edit persists to disk (as the FPM user)"
|
||||
echo "=============================================================="
|
||||
asuser "printf 'x\n' > $B/.ac4-probe" >/dev/null 2>&1
|
||||
if [ "$(asuser "cat $B/.ac4-probe" 2>/dev/null)" = "x" ]; then ok "write+read back as 'atheos'"; else bad "cannot write as atheos"; fi
|
||||
asuser "rm -f $B/.ac4-probe" >/dev/null 2>&1
|
||||
for p in config.php data workspace plugins themes; do
|
||||
if asuser "test -w $W/$p" 2>/dev/null; then ok "writable: $p"; else bad "NOT writable: $p"; fi
|
||||
done
|
||||
|
||||
echo
|
||||
echo "=============================================================="
|
||||
echo "AC-5 Remote points at Gitea; the SSH switch is documented"
|
||||
echo "=============================================================="
|
||||
REMOTE=$(asuser "git -C $B remote get-url origin" 2>/dev/null)
|
||||
echo " remote now: $REMOTE"
|
||||
case "$REMOTE" in
|
||||
*aridgwayweb.com*armistace/blog*) ok "remote targets armistace/blog on Gitea (HTTPS)" ;;
|
||||
gitea-blog:armistace/blog*) ok "remote targets armistace/blog via the deploy-key alias" ;;
|
||||
*) bad "remote does not target the blog repo" ;;
|
||||
esac
|
||||
chk "branch" "$(asuser "git -C $B rev-parse --abbrev-ref HEAD" 2>/dev/null)" "master"
|
||||
|
||||
# Phase 2: once the SSH alias is in use, prove the transport actually authenticates
|
||||
case "$REMOTE" in
|
||||
gitea-blog:*)
|
||||
AUTH=$(asuser 'ssh -o BatchMode=yes -o ConnectTimeout=8 -T gitea-blog 2>&1' | head -1)
|
||||
case "$AUTH" in
|
||||
*successfully\ authenticated*) ok "deploy key authenticates over SSH" ;;
|
||||
*) bad "deploy key does NOT authenticate: $AUTH" ;;
|
||||
esac
|
||||
;;
|
||||
esac
|
||||
|
||||
echo
|
||||
echo "=============================================================="
|
||||
echo "AC-6 Survives reboot (services enabled, data intact)"
|
||||
echo "=============================================================="
|
||||
echo " container uptime: $(cut -d. -f1 /proc/uptime)s (reboot was issued during the test)"
|
||||
for s in nginx php-fpm83 sshd; do
|
||||
if rc-update show 2>/dev/null | grep -qE "^\s+$s\s+\|\s+default"; then ok "$s enabled at boot"; else bad "$s NOT enabled at boot"; fi
|
||||
if rc-service "$s" status >/dev/null 2>&1; then ok "$s running"; else bad "$s not running"; fi
|
||||
done
|
||||
if [ -S "$SOCK" ]; then ok "fpm socket exists after reboot"; else bad "fpm socket missing"; fi
|
||||
|
||||
echo
|
||||
echo "=============================================================="
|
||||
echo "AC-8 SCOPE GUARD: no build toolchain present (must be ABSENT)"
|
||||
echo "=============================================================="
|
||||
for t in python python3 pelican pip pip3 make; do
|
||||
if command -v "$t" >/dev/null 2>&1; then bad "$t IS present - scope violated!"; else ok "$t absent (correct)"; fi
|
||||
done
|
||||
echo " --- also check no database engine was installed (Atheos needs none):"
|
||||
for d in mysqld mariadbd postgres redis-server; do
|
||||
if command -v "$d" >/dev/null 2>&1; then bad "$d present - unexpected"; else ok "$d absent (correct)"; fi
|
||||
done
|
||||
|
||||
echo
|
||||
echo "=============================================================="
|
||||
echo "FR-11 GUARD: agent created NO identity or armistace credential"
|
||||
echo "=============================================================="
|
||||
chk "git user.name empty" "$(asuser 'git config --get user.name' 2>/dev/null)" ""
|
||||
chk "git user.email empty" "$(asuser 'git config --get user.email' 2>/dev/null)" ""
|
||||
if [ -f /home/atheos/.ssh/id_ed25519_blog ]; then ok "deploy key present"; else bad "deploy key missing"; fi
|
||||
chk "deploy key mode" "$(stat -c '%a' /home/atheos/.ssh/id_ed25519_blog 2>/dev/null)" "600"
|
||||
chk "deploy key owner" "$(stat -c '%U' /home/atheos/.ssh/id_ed25519_blog 2>/dev/null)" "atheos"
|
||||
chk "ssh config mode" "$(stat -c '%a' /home/atheos/.ssh/config 2>/dev/null)" "600"
|
||||
|
||||
echo
|
||||
echo "=============================================================="
|
||||
echo "RESOURCES"
|
||||
echo "=============================================================="
|
||||
echo " rootfs: $(df -hP / | tail -1 | awk '{print $2" total, "$3" used, "$4" avail ("$5")"}')"
|
||||
# NOTE: on Alpine, `free`/`uptime` are BUSYBOX applets that use the sysinfo() syscall, which
|
||||
# lxcfs cannot intercept - so they report the PVE HOST, not this container. procps-ng (installed
|
||||
# by provision.sh) replaces them with binaries that read the lxcfs-virtualised /proc files.
|
||||
# Detect via apk, which is the reliable signal (the binaries are plain files either way).
|
||||
if apk info -e procps-ng >/dev/null 2>&1; then
|
||||
echo " memory: $(/usr/bin/free -m 2>/dev/null | awk 'NR==2{print $3"MB used of "$2"MB"}')"
|
||||
echo " uptime: $(/usr/bin/uptime 2>/dev/null | sed 's/.*up /up /;s/,.*//') (container-accurate)"
|
||||
else
|
||||
echo " memory: (procps-ng NOT installed - busybox free/uptime would report the HOST)"
|
||||
fi
|
||||
echo " lxcfs virtualises /proc: meminfo=$(grep MemTotal /proc/meminfo | awk '{print $2"kB"}') uptime=$(cut -d. -f1 /proc/uptime)s"
|
||||
echo " listening ports: $(netstat -tln 2>/dev/null | awk '/LISTEN/{split($4,a,":"); print a[length(a)]}' | sort -u | tr '\n' ' ')"
|
||||
|
||||
echo
|
||||
echo "=============================================================="
|
||||
printf 'RESULT: %d passed, %d failed\n' "$pass" "$fail"
|
||||
echo "=============================================================="
|
||||
[ "$fail" -eq 0 ] || exit 1
|
||||
@@ -0,0 +1,246 @@
|
||||
#!/bin/sh
|
||||
# ==============================================================================
|
||||
# provision.sh — rebuild the Atheos blog editor LXC from scratch
|
||||
# Project: atheos-blog-lxc (AI-DLC)
|
||||
# Target : Proxmox LXC 136 on node scotty (192.168.178.69)
|
||||
#
|
||||
# RUN THIS ON THE PVE NODE (scotty), as root. It is written to be re-runnable:
|
||||
# each step checks state before acting.
|
||||
#
|
||||
# This script reproduces exactly what was executed during the initial build on
|
||||
# 2026-09-29. It deliberately does NOT create any `armistace` credential, git
|
||||
# identity, or Gitea user (requirement FR-11).
|
||||
# ==============================================================================
|
||||
set -eu
|
||||
|
||||
VMID=136
|
||||
NODE_HOST="192.168.178.69"
|
||||
TEMPLATE_STORAGE="LARGE_STORAGE_1"
|
||||
ROOTFS_STORAGE="scotty-local-lvm"
|
||||
TEMPLATE="alpine-3.23-default_20260116_amd64.tar.xz"
|
||||
BRIDGE="vmbr0"
|
||||
ROOTFS_SIZE=20
|
||||
CORES=2
|
||||
MEMORY=1024
|
||||
SWAP=256
|
||||
TZ_NAME="Australia/Brisbane"
|
||||
|
||||
# --- Atheos pin (design decision D2: pinned, not tracking a moving branch) ----
|
||||
# Recorded at build time 2026-09-29 from github.com/Atheos/Atheos (default branch `main`)
|
||||
ATHEOS_SHA="f90cd1806dbe0e25673a77e27390e8b1a240c3f6"
|
||||
ATHEOS_BUILD=611
|
||||
ATHEOS_TARBALL_SHA256="03ebcb1479b59f1898b5fa50808b181750b42211698f7f7b4042cf2514d78b20"
|
||||
|
||||
# --- the blog repo (read-only clone source; agent never pushes) --------------
|
||||
BLOG_REPO="https://git.aridgwayweb.com/armistace/blog.git"
|
||||
GITEA_SSH_HOST="192.168.178.155" # LAN address: Gitea SSH_DOMAIN; public :22 is not forwarded
|
||||
GITEA_SSH_USER="gitea" # !! app.ini SSH_USER=gitea - NOT the usual `git`.
|
||||
# Using `git` yields "Invalid user git" from sshd,
|
||||
# which is rejected BEFORE authorized_keys is read.
|
||||
|
||||
WEBROOT="/var/www/atheos"
|
||||
FPM_USER="atheos"
|
||||
FPM_SOCKET="/run/php-fpm83/php-fpm.sock"
|
||||
|
||||
log() { printf '\n=== %s\n' "$*"; }
|
||||
|
||||
# ==============================================================================
|
||||
log "1/9 verify we are on the PVE node and the VMID is free"
|
||||
hostname
|
||||
pct status "$VMID" >/dev/null 2>&1 && { echo "ERROR: VMID $VMID already exists - aborting"; exit 1; }
|
||||
|
||||
# ==============================================================================
|
||||
log "2/9 ensure the Alpine template is present"
|
||||
pveam update >/dev/null 2>&1 || true
|
||||
if ! pveam list "$TEMPLATE_STORAGE" 2>/dev/null | grep -q "$TEMPLATE"; then
|
||||
pveam download "$TEMPLATE_STORAGE" "$TEMPLATE"
|
||||
else
|
||||
echo "template already present"
|
||||
fi
|
||||
|
||||
# ==============================================================================
|
||||
log "3/9 create the container (U1)"
|
||||
pct create "$VMID" "$TEMPLATE_STORAGE:vztmpl/$TEMPLATE" \
|
||||
--hostname atheos-blog \
|
||||
--cores "$CORES" \
|
||||
--memory "$MEMORY" \
|
||||
--swap "$SWAP" \
|
||||
--rootfs "$ROOTFS_STORAGE:$ROOTFS_SIZE" \
|
||||
--net0 "name=eth0,bridge=$BRIDGE,ip=dhcp" \
|
||||
--unprivileged 1 \
|
||||
--onboot 1 \
|
||||
--ostype alpine \
|
||||
--features "" \
|
||||
--description "Atheos browser editor for armistace/blog (AI-DLC project atheos-blog-lxc). LAN-only. Deploy key auth. See Gitea hermes/atheos-blog-lxc RUNBOOK."
|
||||
|
||||
pct start "$VMID"
|
||||
sleep 8
|
||||
pct status "$VMID"
|
||||
|
||||
# ==============================================================================
|
||||
log "4/9 base configuration (U1): timezone, ssh, apt/apk index"
|
||||
pct exec "$VMID" -- sh -c "
|
||||
apk update >/dev/null 2>&1
|
||||
apk add --no-cache tzdata openssh >/dev/null 2>&1
|
||||
cp /usr/share/zoneinfo/$TZ_NAME /etc/localtime
|
||||
echo $TZ_NAME > /etc/timezone
|
||||
rc-update add sshd default >/dev/null 2>&1
|
||||
rc-service sshd start >/dev/null 2>&1
|
||||
date
|
||||
"
|
||||
|
||||
# ==============================================================================
|
||||
log "5/9 web stack (U2): nginx + php83 + extensions"
|
||||
pct exec "$VMID" -- sh -c '
|
||||
apk add --no-cache nginx php83 php83-fpm \
|
||||
php83-session php83-zip php83-openssl php83-mbstring php83-ctype php83-curl \
|
||||
php83-dom php83-json php83-iconv php83-fileinfo php83-simplexml php83-xml \
|
||||
php83-tokenizer procps-ng >/dev/null 2>&1
|
||||
# procps-ng (NOT lxcfs) is what makes free/uptime report the CONTAINER rather than the host.
|
||||
# busybox applets use the sysinfo() syscall, which lxcfs cannot intercept; procps-ng reads the
|
||||
# lxcfs-virtualised /proc/meminfo and /proc/uptime. Verified: procps free -> 1024MB, busybox -> host.
|
||||
# dedicated service user (I-4: FPM user == file owner == key owner)
|
||||
adduser -D -s /sbin/nologin -h /home/atheos atheos 2>/dev/null || true
|
||||
mkdir -p /var/www/atheos/workspace /run/php-fpm83 /var/log/nginx
|
||||
chown nginx:nginx /run/php-fpm83
|
||||
chmod 755 /run/php-fpm83
|
||||
chown -R atheos:atheos /var/www/atheos /home/atheos
|
||||
# timezone (NFR-5)
|
||||
sed -i "s|^;\?date.timezone =.*|date.timezone = Australia/Brisbane|" /etc/php83/php.ini
|
||||
# --- the socket contract (I-1): pool listen MUST byte-match nginx fastcgi_pass ---
|
||||
cp -n /etc/php83/php-fpm.d/www.conf /etc/php83/php-fpm.d/www.conf.orig 2>/dev/null || true
|
||||
sed -i "s|^user = .*|user = atheos|" /etc/php83/php-fpm.d/www.conf
|
||||
sed -i "s|^group = .*|group = atheos|" /etc/php83/php-fpm.d/www.conf
|
||||
sed -i "s|^listen = .*|listen = '"$FPM_SOCKET"'|" /etc/php83/php-fpm.d/www.conf
|
||||
grep -q "^listen.owner" /etc/php83/php-fpm.d/www.conf || echo "listen.owner = nginx" >> /etc/php83/php-fpm.d/www.conf
|
||||
grep -q "^listen.group" /etc/php83/php-fpm.d/www.conf || echo "listen.group = nginx" >> /etc/php83/php-fpm.d/www.conf
|
||||
grep -q "^listen.mode" /etc/php83/php-fpm.d/www.conf || echo "listen.mode = 0660" >> /etc/php83/php-fpm.d/www.conf
|
||||
rc-update add nginx default >/dev/null 2>&1
|
||||
rc-update add php-fpm83 default >/dev/null 2>&1
|
||||
'
|
||||
|
||||
# --- nginx vhost: installed BY THE SCRIPT so provisioning is repeatable end-to-end -----------
|
||||
# (review finding: leaving this as a manual "see README" step broke the project's own
|
||||
# repeatability requirement FR-9 — a rebuild from scratch would serve the distro default page)
|
||||
pct exec "$VMID" -- sh -c "cat > /etc/nginx/http.d/atheos.conf" <<'NGINXCONF'
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
server_name _;
|
||||
root /var/www/atheos;
|
||||
index index.php index.html;
|
||||
access_log /var/log/nginx/atheos.access.log;
|
||||
error_log /var/log/nginx/atheos.error.log;
|
||||
|
||||
# The socket path here MUST byte-match the pool's `listen =` in
|
||||
# /etc/php83/php-fpm.d/www.conf (interface I-1 - a mismatch yields a bare 502).
|
||||
location ~ \.php$ {
|
||||
try_files $uri =404;
|
||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
fastcgi_pass unix:/run/php-fpm83/php-fpm.sock;
|
||||
fastcgi_index index.php;
|
||||
include fastcgi.conf;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
}
|
||||
location / { try_files $uri $uri/ =404; }
|
||||
|
||||
# never serve the VCS dir, the app's private data, or dotfiles
|
||||
location ~ /\.git { deny all; }
|
||||
location ~ /\.ssh { deny all; }
|
||||
location ~ /\. { deny all; }
|
||||
location ~ ^/data/ { deny all; }
|
||||
location ~ ^/(config\.php|common\.php|controller\.php|traits/) { deny all; }
|
||||
location ~* \.(md|py|sh|log|conf|ini|sql|bak|orig)$ { deny all; }
|
||||
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||||
|
||||
client_max_body_size 64m;
|
||||
}
|
||||
NGINXCONF
|
||||
# remove the distro default vhost so ours is authoritative, then start the stack
|
||||
pct exec "$VMID" -- sh -c '
|
||||
rm -f /etc/nginx/http.d/default.conf
|
||||
rc-service php-fpm83 restart >/dev/null 2>&1
|
||||
rc-service nginx restart >/dev/null 2>&1
|
||||
sleep 2
|
||||
# prove the socket contract holds BEFORE Atheos is installed, so a 502 can only ever
|
||||
# mean an nginx/php-fpm problem and never be confused with an Atheos problem
|
||||
SOCK=$(sed -n "s/^listen = //p" /etc/php83/php-fpm.d/www.conf | head -1)
|
||||
NGX=$(sed -n "s/.*fastcgi_pass unix:\([^;]*\);.*/\1/p" /etc/nginx/http.d/atheos.conf | head -1)
|
||||
if [ "$SOCK" = "$NGX" ]; then echo "socket contract OK: $SOCK"; else echo "SOCKET MISMATCH: pool=$SOCK nginx=$NGX"; exit 1; fi
|
||||
'
|
||||
|
||||
# ==============================================================================
|
||||
log "6/9 Atheos install at the pinned commit (U3)"
|
||||
pct exec "$VMID" -- sh -c "
|
||||
cd /tmp
|
||||
wget -q -O atheos.tar.gz https://codeload.github.com/Atheos/Atheos/tar.gz/$ATHEOS_SHA
|
||||
echo '$ATHEOS_TARBALL_SHA256 atheos.tar.gz' | sha256sum -c - || { echo 'CHECKSUM MISMATCH - abort'; exit 1; }
|
||||
rm -rf /tmp/atheos-extract && mkdir -p /tmp/atheos-extract
|
||||
tar xzf atheos.tar.gz -C /tmp/atheos-extract
|
||||
cd /tmp/atheos-extract/Atheos-$ATHEOS_SHA
|
||||
for f in \$(ls -A); do
|
||||
[ \"\$f\" = workspace ] && continue
|
||||
cp -a \"\$f\" $WEBROOT/ 2>/dev/null || true
|
||||
done
|
||||
cd $WEBROOT
|
||||
touch config.php && chmod 664 config.php
|
||||
for d in data workspace plugins themes; do mkdir -p \$d; chmod 775 \$d; done
|
||||
chown -R atheos:atheos $WEBROOT
|
||||
echo \"Atheos build: \$(cat .version)\"
|
||||
"
|
||||
|
||||
# ==============================================================================
|
||||
log "7/9 git + clone + deploy key (U4)"
|
||||
pct exec "$VMID" -- sh -c "
|
||||
apk add --no-cache git openssh-client >/dev/null 2>&1
|
||||
cd $WEBROOT/workspace
|
||||
su -s /bin/sh atheos -c 'git config --global --add safe.directory $WEBROOT/workspace'
|
||||
su -s /bin/sh atheos -c 'git config --global --add safe.directory $WEBROOT/workspace/blog'
|
||||
# clone over HTTPS (public repo => no credential at this stage; U4 phase 1)
|
||||
su -s /bin/sh atheos -c 'test -d blog/.git || git clone $BLOG_REPO blog'
|
||||
# deploy keypair: private key stays on the guest, owned by the FPM user
|
||||
mkdir -p /home/atheos/.ssh && chmod 700 /home/atheos/.ssh && chown atheos:atheos /home/atheos/.ssh
|
||||
su -s /bin/sh atheos -c 'test -f /home/atheos/.ssh/id_ed25519_blog || ssh-keygen -t ed25519 -f /home/atheos/.ssh/id_ed25519_blog -N \"\" -C \"atheos-blog-lxc deploy key (armistace/blog)\"'
|
||||
chmod 600 /home/atheos/.ssh/id_ed25519_blog
|
||||
chmod 644 /home/atheos/.ssh/id_ed25519_blog.pub
|
||||
chown atheos:atheos /home/atheos/.ssh/id_ed25519_blog /home/atheos/.ssh/id_ed25519_blog.pub
|
||||
"
|
||||
# NB the ~/.ssh/config alias is written by the install-files step (see files/ssh-config)
|
||||
# IMPORTANT: its User must be "$GITEA_SSH_USER" (gitea), NOT `git`.
|
||||
pct exec "$VMID" -- sh -c "chmod 600 /home/atheos/.ssh/config 2>/dev/null; chown atheos:atheos /home/atheos/.ssh/config 2>/dev/null; true"
|
||||
|
||||
# ==============================================================================
|
||||
log "8/9 PUBLISH the deploy key public half to the operator"
|
||||
pct exec "$VMID" -- sh -c "
|
||||
echo
|
||||
echo ' ----- BEGIN deploy key (public half) -----'
|
||||
cat /home/atheos/.ssh/id_ed25519_blog.pub
|
||||
echo ' ----- END deploy key (public half) -----'
|
||||
ssh-keygen -lf /home/atheos/.ssh/id_ed25519_blog.pub
|
||||
"
|
||||
cat <<'INSTRUCTIONS'
|
||||
|
||||
>>> OPERATOR ACTION: add the key above to Gitea
|
||||
Repo: armistace/blog -> Settings -> Deploy Keys -> Add Deploy Key
|
||||
Title: atheos-blog-lxc
|
||||
TICK "Allow write access" (required for push)
|
||||
Then tell the agent to run phase 2 (switch the remote to SSH):
|
||||
git -C /var/www/atheos/workspace/blog remote set-url origin gitea-blog:armistace/blog.git
|
||||
|
||||
INSTRUCTIONS
|
||||
|
||||
# ==============================================================================
|
||||
log "9/9 smoke test"
|
||||
pct exec "$VMID" -- sh -c '
|
||||
ip -4 addr show eth0 | grep inet
|
||||
rc-service nginx status | head -1
|
||||
rc-service php-fpm83 status | head -1
|
||||
ls -lad /run/php-fpm83/php-fpm.sock
|
||||
'
|
||||
echo
|
||||
echo "Provisioning complete. Now open http://<guest-ip>/ in a browser and complete"
|
||||
echo "the Atheos first-run installer (creates the admin user - operator owned)."
|
||||
echo "IMPORTANT: first action after SSH -> set your git identity. See RUNBOOK.md step 1."
|
||||
@@ -0,0 +1,99 @@
|
||||
#!/bin/sh
|
||||
# ==============================================================================
|
||||
# update-atheos.sh — update the Atheos install on LXC 136 and RE-PIN the commit
|
||||
# Design decision D2: Atheos has no releases, so the install is pinned to a
|
||||
# resolved commit SHA for reproducibility. This script is the deliberate escape
|
||||
# hatch: it fetches the latest upstream commit, updates the install, and
|
||||
# re-pins by rewriting the recorded SHA.
|
||||
#
|
||||
# RUN THIS ON THE GUEST (as root), or via: ssh root@192.168.178.57 'sh -s' < update-atheos.sh
|
||||
#
|
||||
# It does NOT touch your git identity, your deploy key, the blog clone, or
|
||||
# anything under workspace/. Only the Atheos application files are replaced.
|
||||
# ==============================================================================
|
||||
set -eu
|
||||
|
||||
WEBROOT="/var/www/atheos"
|
||||
FPM_USER="atheos"
|
||||
STATE_FILE="/etc/atheos-blog-lxc.pin"
|
||||
|
||||
log() { printf '\n=== %s\n' "$*"; }
|
||||
|
||||
log "current pin"
|
||||
[ -f "$STATE_FILE" ] && cat "$STATE_FILE" || echo "(no pin recorded - first run)"
|
||||
echo "installed build: $(cat $WEBROOT/.version 2>/dev/null || echo unknown)"
|
||||
|
||||
log "resolve latest upstream commit (branch: main)"
|
||||
LATEST_SHA=$(wget -qO- https://api.github.com/repos/Atheos/Atheos/commits/main \
|
||||
| sed -n 's/.*"sha": *"\([a-f0-9]\{40\}\)".*/\1/p' | head -1)
|
||||
if [ -z "$LATEST_SHA" ]; then
|
||||
echo "ERROR: could not resolve the upstream SHA (network or rate limit). Aborting."
|
||||
exit 1
|
||||
fi
|
||||
echo "latest: $LATEST_SHA"
|
||||
|
||||
CURRENT_SHA=$(sed -n 's/^SHA=//p' "$STATE_FILE" 2>/dev/null || true)
|
||||
if [ "$LATEST_SHA" = "$CURRENT_SHA" ]; then
|
||||
echo "Already at the latest pin ($LATEST_SHA). Nothing to do."
|
||||
exit 0
|
||||
fi
|
||||
echo "updating: $CURRENT_SHA -> $LATEST_SHA"
|
||||
|
||||
log "download + extract to a staging dir (install is NOT touched until verified)"
|
||||
rm -rf /tmp/atheos-update && mkdir -p /tmp/atheos-update
|
||||
cd /tmp/atheos-update
|
||||
wget -q -O atheos.tar.gz "https://codeload.github.com/Atheos/Atheos/tar.gz/$LATEST_SHA"
|
||||
sha256sum atheos.tar.gz | sed 's/^/ tarball sha256: /'
|
||||
tar xzf atheos.tar.gz
|
||||
SRC="/tmp/atheos-update/Atheos-$LATEST_SHA"
|
||||
test -d "$SRC" || { echo "ERROR: extract produced no $SRC"; exit 1; }
|
||||
|
||||
log "sanity-check the staged tree looks like Atheos"
|
||||
for f in index.php common.php controller.php classes; do
|
||||
test -e "$SRC/$f" || { echo "ERROR: staged tree is missing $f - refusing to install"; exit 1; }
|
||||
done
|
||||
echo "staged tree looks sane"
|
||||
|
||||
log "back up the current app files (excluding workspace/)"
|
||||
BK="/root/atheos-backup-$(date +%Y%m%d-%H%M%S)"
|
||||
mkdir -p "$BK"
|
||||
for f in $(ls -A "$WEBROOT"); do
|
||||
[ "$f" = workspace ] && continue
|
||||
cp -a "$WEBROOT/$f" "$BK/" 2>/dev/null || true
|
||||
done
|
||||
echo "backup: $BK"
|
||||
|
||||
log "install the new files (workspace/ preserved)"
|
||||
cd "$SRC"
|
||||
for f in $(ls -A); do
|
||||
[ "$f" = workspace ] && continue
|
||||
rm -rf "$WEBROOT/$f"
|
||||
cp -a "$f" "$WEBROOT/" 2>/dev/null || true
|
||||
done
|
||||
chown -R "$FPM_USER:$FPM_USER" "$WEBROOT"
|
||||
echo "new build: $(cat $WEBROOT/.version 2>/dev/null || echo unknown)"
|
||||
|
||||
log "re-pin"
|
||||
{
|
||||
echo "# atheos-blog-lxc Atheos pin - managed by scripts/update-atheos.sh"
|
||||
echo "# Updated: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||
echo "SHA=$LATEST_SHA"
|
||||
} > "$STATE_FILE"
|
||||
cat "$STATE_FILE"
|
||||
|
||||
log "restart + smoke test"
|
||||
rc-service php-fpm83 restart >/dev/null 2>&1 || true
|
||||
rc-service nginx restart >/dev/null 2>&1 || true
|
||||
sleep 2
|
||||
CODE=$(wget -qO- --server-response http://127.0.0.1/ 2>&1 | sed -n 's/.*HTTP\/1\.[01] \([0-9]*\).*/\1/p' | head -1)
|
||||
echo "local HTTP status: ${CODE:-unknown}"
|
||||
if [ "${CODE:-000}" != "200" ]; then
|
||||
echo
|
||||
echo "WARNING: the app did not return 200."
|
||||
echo "Roll back with: rm -rf $WEBROOT/* (except workspace/) && cp -a $BK/* $WEBROOT/"
|
||||
exit 1
|
||||
fi
|
||||
echo
|
||||
echo "Update complete and re-pinned to $LATEST_SHA."
|
||||
echo "NOTE: re-run your verification (open the UI). If Atheos changed its installer/config"
|
||||
echo " semantics, the web UI will tell you - this script only replaces application files."
|
||||
Reference in New Issue
Block a user