feat: provision Alpine LXC 136 running Atheos, wired to Gitea
Provisions a LAN-only browser code editor (Atheos) in an Alpine 3.23 LXC on the scotty PVE node, with armistace/blog cloned and ready to edit. Built via the AI-DLC workflow; the full process trail is in aidlc-docs/. Deliverables - scripts/provision.sh rebuild the guest from scratch (re-runnable) - scripts/update-atheos.sh move Atheos to latest upstream and RE-PIN - scripts/build-and-test.sh captures evidence for every acceptance criterion - files/atheos.conf nginx vhost (socket path byte-matches the FPM pool) - files/ssh-config ~atheos/.ssh/config deploy-key alias - RUNBOOK.md operational guide (START AT STEP 1) - docs/security-notes.md credential model + wider-web hardening TODOs - docs/resiliency-notes.md what a non-PoC deployment would need Design decisions - D1 no git identity is configured by the agent; the operator sets it. Git will refuse the first commit until then, which is deliberate (requirement FR-11). - D2 Atheos pinned to commit f90cd18 (build 611) with a verified tarball sha256, plus update-atheos.sh as the deliberate escape hatch. - D3 nginx :80, web root /var/www/atheos, php-fpm over a unix socket. - D6 git auth is a per-repository DEPLOY KEY scoped to armistace/blog, not a personal access token (a PAT's write:repository scope reaches every repo the account can write). Verified on the live guest (40 checks, 0 failures) - AC-2 Atheos served over HTTP 200 by nginx+php-fpm; socket paths byte-match - AC-3 20 posts + themes/cleanblog present; owned by the php-fpm user - AC-4 all five writable paths writable as the service user - AC-5 remote targets armistace/blog; deploy key authenticates over SSH - AC-6 survival proven with a real container restart, marker byte-identical - AC-8 no python/pelican/pip/make and no DB engine - scope boundary enforced - FR-11 git identity is empty; deploy key mode 600 owned by the service user Traps documented in the RUNBOOK (each cost real debugging time) - The Gitea SSH user is `gitea`, NOT `git` (app.ini SSH_USER=gitea). With `git`, sshd answers "Invalid user git" and rejects before reading authorized_keys, which is indistinguishable from a bad key. - The Gitea SSH endpoint is the LAN address (:22 is not forwarded publicly). - `uptime` and `free` report the PVE HOST inside an LXC without lxcfs, so a container that just restarted can claim days of uptime.
This commit is contained in:
@@ -0,0 +1,99 @@
|
||||
#!/bin/sh
|
||||
# ==============================================================================
|
||||
# update-atheos.sh — update the Atheos install on LXC 136 and RE-PIN the commit
|
||||
# Design decision D2: Atheos has no releases, so the install is pinned to a
|
||||
# resolved commit SHA for reproducibility. This script is the deliberate escape
|
||||
# hatch: it fetches the latest upstream commit, updates the install, and
|
||||
# re-pins by rewriting the recorded SHA.
|
||||
#
|
||||
# RUN THIS ON THE GUEST (as root), or via: ssh root@192.168.178.57 'sh -s' < update-atheos.sh
|
||||
#
|
||||
# It does NOT touch your git identity, your deploy key, the blog clone, or
|
||||
# anything under workspace/. Only the Atheos application files are replaced.
|
||||
# ==============================================================================
|
||||
set -eu
|
||||
|
||||
WEBROOT="/var/www/atheos"
|
||||
FPM_USER="atheos"
|
||||
STATE_FILE="/etc/atheos-blog-lxc.pin"
|
||||
|
||||
log() { printf '\n=== %s\n' "$*"; }
|
||||
|
||||
log "current pin"
|
||||
[ -f "$STATE_FILE" ] && cat "$STATE_FILE" || echo "(no pin recorded - first run)"
|
||||
echo "installed build: $(cat $WEBROOT/.version 2>/dev/null || echo unknown)"
|
||||
|
||||
log "resolve latest upstream commit (branch: main)"
|
||||
LATEST_SHA=$(wget -qO- https://api.github.com/repos/Atheos/Atheos/commits/main \
|
||||
| sed -n 's/.*"sha": *"\([a-f0-9]\{40\}\)".*/\1/p' | head -1)
|
||||
if [ -z "$LATEST_SHA" ]; then
|
||||
echo "ERROR: could not resolve the upstream SHA (network or rate limit). Aborting."
|
||||
exit 1
|
||||
fi
|
||||
echo "latest: $LATEST_SHA"
|
||||
|
||||
CURRENT_SHA=$(sed -n 's/^SHA=//p' "$STATE_FILE" 2>/dev/null || true)
|
||||
if [ "$LATEST_SHA" = "$CURRENT_SHA" ]; then
|
||||
echo "Already at the latest pin ($LATEST_SHA). Nothing to do."
|
||||
exit 0
|
||||
fi
|
||||
echo "updating: $CURRENT_SHA -> $LATEST_SHA"
|
||||
|
||||
log "download + extract to a staging dir (install is NOT touched until verified)"
|
||||
rm -rf /tmp/atheos-update && mkdir -p /tmp/atheos-update
|
||||
cd /tmp/atheos-update
|
||||
wget -q -O atheos.tar.gz "https://codeload.github.com/Atheos/Atheos/tar.gz/$LATEST_SHA"
|
||||
sha256sum atheos.tar.gz | sed 's/^/ tarball sha256: /'
|
||||
tar xzf atheos.tar.gz
|
||||
SRC="/tmp/atheos-update/Atheos-$LATEST_SHA"
|
||||
test -d "$SRC" || { echo "ERROR: extract produced no $SRC"; exit 1; }
|
||||
|
||||
log "sanity-check the staged tree looks like Atheos"
|
||||
for f in index.php common.php controller.php classes; do
|
||||
test -e "$SRC/$f" || { echo "ERROR: staged tree is missing $f - refusing to install"; exit 1; }
|
||||
done
|
||||
echo "staged tree looks sane"
|
||||
|
||||
log "back up the current app files (excluding workspace/)"
|
||||
BK="/root/atheos-backup-$(date +%Y%m%d-%H%M%S)"
|
||||
mkdir -p "$BK"
|
||||
for f in $(ls -A "$WEBROOT"); do
|
||||
[ "$f" = workspace ] && continue
|
||||
cp -a "$WEBROOT/$f" "$BK/" 2>/dev/null || true
|
||||
done
|
||||
echo "backup: $BK"
|
||||
|
||||
log "install the new files (workspace/ preserved)"
|
||||
cd "$SRC"
|
||||
for f in $(ls -A); do
|
||||
[ "$f" = workspace ] && continue
|
||||
rm -rf "$WEBROOT/$f"
|
||||
cp -a "$f" "$WEBROOT/" 2>/dev/null || true
|
||||
done
|
||||
chown -R "$FPM_USER:$FPM_USER" "$WEBROOT"
|
||||
echo "new build: $(cat $WEBROOT/.version 2>/dev/null || echo unknown)"
|
||||
|
||||
log "re-pin"
|
||||
{
|
||||
echo "# atheos-blog-lxc Atheos pin - managed by scripts/update-atheos.sh"
|
||||
echo "# Updated: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||
echo "SHA=$LATEST_SHA"
|
||||
} > "$STATE_FILE"
|
||||
cat "$STATE_FILE"
|
||||
|
||||
log "restart + smoke test"
|
||||
rc-service php-fpm83 restart >/dev/null 2>&1 || true
|
||||
rc-service nginx restart >/dev/null 2>&1 || true
|
||||
sleep 2
|
||||
CODE=$(wget -qO- --server-response http://127.0.0.1/ 2>&1 | sed -n 's/.*HTTP\/1\.[01] \([0-9]*\).*/\1/p' | head -1)
|
||||
echo "local HTTP status: ${CODE:-unknown}"
|
||||
if [ "${CODE:-000}" != "200" ]; then
|
||||
echo
|
||||
echo "WARNING: the app did not return 200."
|
||||
echo "Roll back with: rm -rf $WEBROOT/* (except workspace/) && cp -a $BK/* $WEBROOT/"
|
||||
exit 1
|
||||
fi
|
||||
echo
|
||||
echo "Update complete and re-pinned to $LATEST_SHA."
|
||||
echo "NOTE: re-run your verification (open the UI). If Atheos changed its installer/config"
|
||||
echo " semantics, the web UI will tell you - this script only replaces application files."
|
||||
Reference in New Issue
Block a user