hermes
c2897ed660
Provisions a LAN-only browser code editor (Atheos) in an Alpine 3.23 LXC on the scotty PVE node, with armistace/blog cloned and ready to edit. Built via the AI-DLC workflow; the full process trail is in aidlc-docs/. Deliverables - scripts/provision.sh rebuild the guest from scratch (re-runnable) - scripts/update-atheos.sh move Atheos to latest upstream and RE-PIN - scripts/build-and-test.sh captures evidence for every acceptance criterion - files/atheos.conf nginx vhost (socket path byte-matches the FPM pool) - files/ssh-config ~atheos/.ssh/config deploy-key alias - RUNBOOK.md operational guide (START AT STEP 1) - docs/security-notes.md credential model + wider-web hardening TODOs - docs/resiliency-notes.md what a non-PoC deployment would need Design decisions - D1 no git identity is configured by the agent; the operator sets it. Git will refuse the first commit until then, which is deliberate (requirement FR-11). - D2 Atheos pinned to commit f90cd18 (build 611) with a verified tarball sha256, plus update-atheos.sh as the deliberate escape hatch. - D3 nginx :80, web root /var/www/atheos, php-fpm over a unix socket. - D6 git auth is a per-repository DEPLOY KEY scoped to armistace/blog, not a personal access token (a PAT's write:repository scope reaches every repo the account can write). Verified on the live guest (40 checks, 0 failures) - AC-2 Atheos served over HTTP 200 by nginx+php-fpm; socket paths byte-match - AC-3 20 posts + themes/cleanblog present; owned by the php-fpm user - AC-4 all five writable paths writable as the service user - AC-5 remote targets armistace/blog; deploy key authenticates over SSH - AC-6 survival proven with a real container restart, marker byte-identical - AC-8 no python/pelican/pip/make and no DB engine - scope boundary enforced - FR-11 git identity is empty; deploy key mode 600 owned by the service user Traps documented in the RUNBOOK (each cost real debugging time) - The Gitea SSH user is `gitea`, NOT `git` (app.ini SSH_USER=gitea). With `git`, sshd answers "Invalid user git" and rejects before reading authorized_keys, which is indistinguishable from a bad key. - The Gitea SSH endpoint is the LAN address (:22 is not forwarded publicly). - `uptime` and `free` report the PVE HOST inside an LXC without lxcfs, so a container that just restarted can claim days of uptime.
3.6 KiB
3.6 KiB
AI-DLC State Tracking
Project Information
- Project: atheos-blog-lxc
- Start Date: 2026-09-29T05:05:05Z
- Current Stage: INCEPTION — Workspace Detection (complete) → Requirements Analysis
- Deploy Target: Proxmox LXC (Alpine 3.23) — NOT the K3s cluster. Deploy-target flavour:
"self-hosted LXC", so
k3s-flavor.mddoes NOT apply and no CI/registry pipeline is wired.
Workspace State
- Existing Code: No (greenfield repo; the blog being edited is a separate existing repo)
- Programming Languages: none yet (deliverable is provisioning/docs; target app is PHP)
- Build System: none (Alpine + nginx/php-fpm provisioning; Makefile-driven install script)
- Reverse Engineering Needed: N/A for the repo; brownfield recon done on the estate (blog repo, Gitea, PVE templates) — see audit.md Workspace Detection entry.
- Workspace Root: /home/hermes/dev/atheos-blog-lxc
Existing Estate Facts (load-bearing — verify before trusting)
- Atheos (Atheos/Atheos, 677★, MIT, active): PHP web IDE, no database. Install = drop
files in a web root + make
config.php,data/,workspace/,plugins/,themes/writable. Optional PHP extensions for the plugin marketplace: ZIP, OPENSSL, MBSTRING, andallow_url_fopen=On. Has git integration via its codegit component. - blog repo =
armistace/blog(public, default branchmaster). It is a Pelican static site, not plain content:src/content/*.md(~20 posts) +src/content/images/src/themes/cleanblog/src/pelicanconf.py,src/devpelconf.py,src/publishconf.py,src/Makefile,src/tasks.pyrequirements.txt:pelican[markdown],markdown-markup-emoji- Root:
Dockerfile(python:slim →make html→make serve-global),kube/,.gitea/workflows/build_push.yml - Implication: to regenerate/publish the site you need Python+pelican (
make html,make github). Atheos alone edits the markdown + git and cannot build it.
- PVE: template
alpine-3.23-default_20260116_amd64.tar.xzavailable (must download first). Nodejaneway(.225) = 15.9 GB RAM (3.3 GB free), storageextra874 GB free. Nodedata(.42) = 7.9 GB RAM (only ~0.95 GB free) — avoid heavy guests. - Gitea: LXC 109 on data (.42), guest .155, 1.27.3 (post-CVE-2026-60004 remediation).
.151= LXC 110 nginxpm (NPM) which fronts it; runners are on k3s nodes .161/.162. - Access:
root@<pve-node>+pct exec. Gitea token in~/.hermes/credentials/gitea-api.env.
Code Location Rules
- Application Code: Workspace root (NEVER in aidlc-docs/)
- Documentation: aidlc-docs/ only
- Structure patterns: See code-generation.md Critical Rules
Extension Configuration
| Extension | Enabled | Decided At |
|---|---|---|
| security-baseline | ❌ No (opt-out; TODOs documented in docs/security-notes.md) | Requirements Analysis |
| resiliency-baseline | ❌ No (opt-out; TODOs documented in docs/resiliency-notes.md) | Requirements Analysis |
| property-based-testing | ❌ No | Requirements Analysis |
Stage Progress
🔵 INCEPTION PHASE
- Workspace Detection
- Reverse Engineering (brownfield only — N/A; estate recon done inline)
- Requirements Analysis
- User Stories (SKIPPED — user-confirmed; substituted with a requirement→unit map)
- Workflow Planning
- Application Design (minimal depth — 5 design artifacts; D6 deploy-key model)
- Units Generation (5 units; requirement→unit map substitutes the story map)
🟢 CONSTRUCTION PHASE
- Per-Unit Loop
- Build and Test
🟡 OPERATIONS PHASE
- Operations (placeholder)