hermes
a6fb61d0ea
Provisions a LAN-only browser code editor (Atheos) in an Alpine 3.23 LXC on the scotty PVE node, with armistace/blog cloned and ready to edit. Built via the AI-DLC workflow; the full process trail is in aidlc-docs/. Deliverables - scripts/provision.sh rebuild the guest from scratch (re-runnable) - scripts/update-atheos.sh move Atheos to latest upstream and RE-PIN - scripts/build-and-test.sh captures evidence for every acceptance criterion - files/atheos.conf nginx vhost (socket path byte-matches the FPM pool) - files/ssh-config ~atheos/.ssh/config deploy-key alias - RUNBOOK.md operational guide (START AT STEP 1) - docs/security-notes.md credential model + wider-web hardening TODOs - docs/resiliency-notes.md what a non-PoC deployment would need Design decisions - D1 no git identity is configured by the agent; the operator sets it. Git will refuse the first commit until then, which is deliberate (requirement FR-11). - D2 Atheos pinned to commit f90cd18 (build 611) with a verified tarball sha256, plus update-atheos.sh as the deliberate escape hatch. - D3 nginx :80, web root /var/www/atheos, php-fpm over a unix socket. - D6 git auth is a per-repository DEPLOY KEY scoped to armistace/blog, not a personal access token (a PAT's write:repository scope reaches every repo the account can write). Verified on the live guest (40 checks, 0 failures) - AC-2 Atheos served over HTTP 200 by nginx+php-fpm; socket paths byte-match - AC-3 20 posts + themes/cleanblog present; owned by the php-fpm user - AC-4 all five writable paths writable as the service user - AC-5 remote targets armistace/blog; deploy key authenticates over SSH - AC-6 survival proven with a real container restart, marker byte-identical - AC-8 no python/pelican/pip/make and no DB engine - scope boundary enforced - FR-11 git identity is empty; deploy key mode 600 owned by the service user Traps documented in the RUNBOOK (each cost real debugging time) - The Gitea SSH user is `gitea`, NOT `git` (app.ini SSH_USER=gitea). With `git`, sshd answers "Invalid user git" and rejects before reading authorized_keys, which is indistinguishable from a bad key. - The Gitea SSH endpoint is the LAN address (:22 is not forwarded publicly). - `uptime` and `free` report the PVE HOST inside an LXC without lxcfs, so a container that just restarted can claim days of uptime.
65 lines
3.6 KiB
Markdown
65 lines
3.6 KiB
Markdown
# AI-DLC State Tracking
|
|
|
|
## Project Information
|
|
- **Project**: atheos-blog-lxc
|
|
- **Start Date**: 2026-09-29T05:05:05Z
|
|
- **Current Stage**: INCEPTION — Workspace Detection (complete) → Requirements Analysis
|
|
- **Deploy Target**: Proxmox LXC (Alpine 3.23) — NOT the K3s cluster. Deploy-target flavour:
|
|
"self-hosted LXC", so `k3s-flavor.md` does NOT apply and no CI/registry pipeline is wired.
|
|
|
|
## Workspace State
|
|
- **Existing Code**: No (greenfield repo; the blog being edited is a separate existing repo)
|
|
- **Programming Languages**: none yet (deliverable is provisioning/docs; target app is PHP)
|
|
- **Build System**: none (Alpine + nginx/php-fpm provisioning; Makefile-driven install script)
|
|
- **Reverse Engineering Needed**: N/A for the repo; brownfield recon done on the *estate*
|
|
(blog repo, Gitea, PVE templates) — see audit.md Workspace Detection entry.
|
|
- **Workspace Root**: /home/hermes/dev/atheos-blog-lxc
|
|
|
|
## Existing Estate Facts (load-bearing — verify before trusting)
|
|
- **Atheos** (Atheos/Atheos, 677★, MIT, active): PHP web IDE, **no database**. Install = drop
|
|
files in a web root + make `config.php`, `data/`, `workspace/`, `plugins/`, `themes/` writable.
|
|
Optional PHP extensions for the plugin marketplace: **ZIP, OPENSSL, MBSTRING**, and
|
|
`allow_url_fopen=On`. Has git integration via its **codegit** component.
|
|
- **blog repo** = `armistace/blog` (public, default branch `master`). It is a **Pelican static
|
|
site**, not plain content:
|
|
- `src/content/*.md` (~20 posts) + `src/content/images/`
|
|
- `src/themes/cleanblog/`
|
|
- `src/pelicanconf.py`, `src/devpelconf.py`, `src/publishconf.py`, `src/Makefile`, `src/tasks.py`
|
|
- `requirements.txt`: `pelican[markdown]`, `markdown-markup-emoji`
|
|
- Root: `Dockerfile` (python:slim → `make html` → `make serve-global`), `kube/`, `.gitea/workflows/build_push.yml`
|
|
- **Implication**: to *regenerate/publish* the site you need Python+pelican (`make html`, `make github`).
|
|
Atheos alone edits the markdown + git and cannot build it.
|
|
- **PVE**: template `alpine-3.23-default_20260116_amd64.tar.xz` available (must download first).
|
|
Node `janeway` (.225) = 15.9 GB RAM (3.3 GB free), storage `extra` 874 GB free.
|
|
Node `data` (.42) = 7.9 GB RAM (only ~0.95 GB free) — avoid heavy guests.
|
|
- **Gitea**: LXC 109 on data (.42), guest .155, **1.27.3** (post-CVE-2026-60004 remediation).
|
|
`.151` = LXC 110 **nginxpm (NPM)** which fronts it; runners are on k3s nodes .161/.162.
|
|
- **Access**: `root@<pve-node>` + `pct exec`. Gitea token in `~/.hermes/credentials/gitea-api.env`.
|
|
|
|
## Code Location Rules
|
|
- **Application Code**: Workspace root (NEVER in aidlc-docs/)
|
|
- **Documentation**: aidlc-docs/ only
|
|
- **Structure patterns**: See code-generation.md Critical Rules
|
|
|
|
## Extension Configuration
|
|
| Extension | Enabled | Decided At |
|
|
|---|---|---|
|
|
| security-baseline | ❌ No (opt-out; TODOs documented in docs/security-notes.md) | Requirements Analysis |
|
|
| resiliency-baseline | ❌ No (opt-out; TODOs documented in docs/resiliency-notes.md) | Requirements Analysis |
|
|
| property-based-testing | ❌ No | Requirements Analysis |
|
|
|
|
## Stage Progress
|
|
### 🔵 INCEPTION PHASE
|
|
- [x] Workspace Detection
|
|
- [ ] Reverse Engineering (brownfield only — N/A; estate recon done inline)
|
|
- [x] Requirements Analysis
|
|
- [x] User Stories (SKIPPED — user-confirmed; substituted with a requirement→unit map)
|
|
- [x] Workflow Planning
|
|
- [x] Application Design (minimal depth — 5 design artifacts; D6 deploy-key model)
|
|
- [x] Units Generation (5 units; requirement→unit map substitutes the story map)
|
|
### 🟢 CONSTRUCTION PHASE
|
|
- [ ] Per-Unit Loop
|
|
- [ ] Build and Test
|
|
### 🟡 OPERATIONS PHASE
|
|
- [ ] Operations (placeholder)
|