hermes/atheos-blog-lxc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
master
atheos-blog-lxc/aidlc-docs/aidlc-state.md
T
hermes a6fb61d0ea feat: provision Alpine LXC 136 running Atheos, wired to Gitea 
Provisions a LAN-only browser code editor (Atheos) in an Alpine 3.23 LXC on the
scotty PVE node, with armistace/blog cloned and ready to edit. Built via the
AI-DLC workflow; the full process trail is in aidlc-docs/.

Deliverables
- scripts/provision.sh          rebuild the guest from scratch (re-runnable)
- scripts/update-atheos.sh      move Atheos to latest upstream and RE-PIN
- scripts/build-and-test.sh     captures evidence for every acceptance criterion
- files/atheos.conf             nginx vhost (socket path byte-matches the FPM pool)
- files/ssh-config              ~atheos/.ssh/config deploy-key alias
- RUNBOOK.md                    operational guide (START AT STEP 1)
- docs/security-notes.md        credential model + wider-web hardening TODOs
- docs/resiliency-notes.md      what a non-PoC deployment would need

Design decisions
- D1 no git identity is configured by the agent; the operator sets it. Git will
  refuse the first commit until then, which is deliberate (requirement FR-11).
- D2 Atheos pinned to commit f90cd18 (build 611) with a verified tarball sha256,
  plus update-atheos.sh as the deliberate escape hatch.
- D3 nginx :80, web root /var/www/atheos, php-fpm over a unix socket.
- D6 git auth is a per-repository DEPLOY KEY scoped to armistace/blog, not a
  personal access token (a PAT's write:repository scope reaches every repo the
  account can write).

Verified on the live guest (40 checks, 0 failures)
- AC-2  Atheos served over HTTP 200 by nginx+php-fpm; socket paths byte-match
- AC-3  20 posts + themes/cleanblog present; owned by the php-fpm user
- AC-4  all five writable paths writable as the service user
- AC-5  remote targets armistace/blog; deploy key authenticates over SSH
- AC-6  survival proven with a real container restart, marker byte-identical
- AC-8  no python/pelican/pip/make and no DB engine - scope boundary enforced
- FR-11 git identity is empty; deploy key mode 600 owned by the service user

Traps documented in the RUNBOOK (each cost real debugging time)
- The Gitea SSH user is `gitea`, NOT `git` (app.ini SSH_USER=gitea). With `git`,
  sshd answers "Invalid user git" and rejects before reading authorized_keys,
  which is indistinguishable from a bad key.
- The Gitea SSH endpoint is the LAN address (:22 is not forwarded publicly).
- `uptime` and `free` report the PVE HOST inside an LXC without lxcfs, so a
  container that just restarted can claim days of uptime.
2026-09-29 15:50:34 +10:00

3.6 KiB
Raw Permalink Blame History

AI-DLC State Tracking

Project Information

  • Project: atheos-blog-lxc
  • Start Date: 2026-09-29T05:05:05Z
  • Current Stage: INCEPTION — Workspace Detection (complete) → Requirements Analysis
  • Deploy Target: Proxmox LXC (Alpine 3.23) — NOT the K3s cluster. Deploy-target flavour: "self-hosted LXC", so k3s-flavor.md does NOT apply and no CI/registry pipeline is wired.

Workspace State

  • Existing Code: No (greenfield repo; the blog being edited is a separate existing repo)
  • Programming Languages: none yet (deliverable is provisioning/docs; target app is PHP)
  • Build System: none (Alpine + nginx/php-fpm provisioning; Makefile-driven install script)
  • Reverse Engineering Needed: N/A for the repo; brownfield recon done on the estate (blog repo, Gitea, PVE templates) — see audit.md Workspace Detection entry.
  • Workspace Root: /home/hermes/dev/atheos-blog-lxc

Existing Estate Facts (load-bearing — verify before trusting)

  • Atheos (Atheos/Atheos, 677★, MIT, active): PHP web IDE, no database. Install = drop files in a web root + make config.php, data/, workspace/, plugins/, themes/ writable. Optional PHP extensions for the plugin marketplace: ZIP, OPENSSL, MBSTRING, and allow_url_fopen=On. Has git integration via its codegit component.
  • blog repo = armistace/blog (public, default branch master). It is a Pelican static site, not plain content:
    • src/content/*.md (~20 posts) + src/content/images/
    • src/themes/cleanblog/
    • src/pelicanconf.py, src/devpelconf.py, src/publishconf.py, src/Makefile, src/tasks.py
    • requirements.txt: pelican[markdown], markdown-markup-emoji
    • Root: Dockerfile (python:slim → make html → make serve-global), kube/, .gitea/workflows/build_push.yml
    • Implication: to regenerate/publish the site you need Python+pelican (make html, make github). Atheos alone edits the markdown + git and cannot build it.
  • PVE: template alpine-3.23-default_20260116_amd64.tar.xz available (must download first). Node janeway (.225) = 15.9 GB RAM (3.3 GB free), storage extra 874 GB free. Node data (.42) = 7.9 GB RAM (only ~0.95 GB free) — avoid heavy guests.
  • Gitea: LXC 109 on data (.42), guest .155, 1.27.3 (post-CVE-2026-60004 remediation). .151 = LXC 110 nginxpm (NPM) which fronts it; runners are on k3s nodes .161/.162.
  • Access: root@<pve-node> + pct exec. Gitea token in ~/.hermes/credentials/gitea-api.env.

Code Location Rules

  • Application Code: Workspace root (NEVER in aidlc-docs/)
  • Documentation: aidlc-docs/ only
  • Structure patterns: See code-generation.md Critical Rules

Extension Configuration

Extension Enabled Decided At
security-baseline ❌ No (opt-out; TODOs documented in docs/security-notes.md) Requirements Analysis
resiliency-baseline ❌ No (opt-out; TODOs documented in docs/resiliency-notes.md) Requirements Analysis
property-based-testing ❌ No Requirements Analysis

Stage Progress

🔵 INCEPTION PHASE

  • Workspace Detection
  • Reverse Engineering (brownfield only — N/A; estate recon done inline)
  • Requirements Analysis
  • User Stories (SKIPPED — user-confirmed; substituted with a requirement→unit map)
  • Workflow Planning
  • Application Design (minimal depth — 5 design artifacts; D6 deploy-key model)
  • Units Generation (5 units; requirement→unit map substitutes the story map)

🟢 CONSTRUCTION PHASE

  • Per-Unit Loop
  • Build and Test

🟡 OPERATIONS PHASE

  • Operations (placeholder)
Reference in New Issue View Git Blame Copy Permalink