# Components — atheos-blog-lxc

**Stage**: INCEPTION — Application Design (minimal depth)
**Note**: This project has no application code to design. "Components" here are the **runtime
pieces of the provisioned guest and their interfaces**, recorded so unit boundaries are defensible
and a later agent inherits the map.

## Provisioned by the agent

| ID | Component | Purpose | Responsibilities |
|---|---|---|---|
| **C1** | **LXC guest** (`136` on scotty, Alpine 3.23) | The isolated runtime | OpenRC init, network (`eth0`, DHCP/static), 20 GB rootfs, timezone |
| **C2** | **nginx** | HTTP front end | Listen `:80`; serve static assets; dispatch `*.php` to C3 over a unix socket |
| **C3** | **php-fpm (`php83`)** | PHP FastCGI runtime | Execute Atheos PHP as a dedicated unprivileged user; extensions ZIP/OPENSSL/MBSTRING; `allow_url_fopen=On` |
| **C4** | **Atheos** (upstream PHP app, pinned SHA) | The browser editor | File tree, editor, and git operations via its `codegit` component |
| **C5** | **Atheos workspace** (`/var/www/atheos/workspace`) | Project storage | Holds working copies Atheos opens as projects; must be writable by C3 |
| **C6** | **git CLI** | VCS client | Invoked by C4's `codegit`; needs `safe.directory`, has **no configured identity** (operator sets it) |
| **C7** | **`blog` working copy** | The thing the operator edits | A clone of `armistace/blog` at `C5/blog`, on `master` |

## External / not provisioned by the agent

| ID | Component | Relationship |
|---|---|---|
| **C8** | **Gitea** (`git.aridgwayweb.com` → LXC 109, .155) | Clone source. **Read-only** from this project's perspective — the agent never pushes |
| **C9** | **Operator (human)** | SSHes in; **owns**: SSH key, git identity, Atheos admin account, and switching the remote to SSH |

## Explicit non-components (scope guards)

- **No database.** Atheos is file-backed; nothing is installed for it.
- **No Python / pelican / `make html`.** The build pipeline is out of scope (FR-1 / AC-8). The
  presence of Python would be a **defect**, not a bonus.
- **No NPM proxy host, no DNS, no port-forward** (LAN-only, FR-10).
- **No Atheos user seeded by the agent** — C9 creates the first account via the installer.