hermes
a6fb61d0ea
Provisions a LAN-only browser code editor (Atheos) in an Alpine 3.23 LXC on the scotty PVE node, with armistace/blog cloned and ready to edit. Built via the AI-DLC workflow; the full process trail is in aidlc-docs/. Deliverables - scripts/provision.sh rebuild the guest from scratch (re-runnable) - scripts/update-atheos.sh move Atheos to latest upstream and RE-PIN - scripts/build-and-test.sh captures evidence for every acceptance criterion - files/atheos.conf nginx vhost (socket path byte-matches the FPM pool) - files/ssh-config ~atheos/.ssh/config deploy-key alias - RUNBOOK.md operational guide (START AT STEP 1) - docs/security-notes.md credential model + wider-web hardening TODOs - docs/resiliency-notes.md what a non-PoC deployment would need Design decisions - D1 no git identity is configured by the agent; the operator sets it. Git will refuse the first commit until then, which is deliberate (requirement FR-11). - D2 Atheos pinned to commit f90cd18 (build 611) with a verified tarball sha256, plus update-atheos.sh as the deliberate escape hatch. - D3 nginx :80, web root /var/www/atheos, php-fpm over a unix socket. - D6 git auth is a per-repository DEPLOY KEY scoped to armistace/blog, not a personal access token (a PAT's write:repository scope reaches every repo the account can write). Verified on the live guest (40 checks, 0 failures) - AC-2 Atheos served over HTTP 200 by nginx+php-fpm; socket paths byte-match - AC-3 20 posts + themes/cleanblog present; owned by the php-fpm user - AC-4 all five writable paths writable as the service user - AC-5 remote targets armistace/blog; deploy key authenticates over SSH - AC-6 survival proven with a real container restart, marker byte-identical - AC-8 no python/pelican/pip/make and no DB engine - scope boundary enforced - FR-11 git identity is empty; deploy key mode 600 owned by the service user Traps documented in the RUNBOOK (each cost real debugging time) - The Gitea SSH user is `gitea`, NOT `git` (app.ini SSH_USER=gitea). With `git`, sshd answers "Invalid user git" and rejects before reading authorized_keys, which is indistinguishable from a bad key. - The Gitea SSH endpoint is the LAN address (:22 is not forwarded publicly). - `uptime` and `free` report the PVE HOST inside an LXC without lxcfs, so a container that just restarted can claim days of uptime.
2.2 KiB
2.2 KiB
Components — atheos-blog-lxc
Stage: INCEPTION — Application Design (minimal depth) Note: This project has no application code to design. "Components" here are the runtime pieces of the provisioned guest and their interfaces, recorded so unit boundaries are defensible and a later agent inherits the map.
Provisioned by the agent
| ID | Component | Purpose | Responsibilities |
|---|---|---|---|
| C1 | LXC guest (136 on scotty, Alpine 3.23) |
The isolated runtime | OpenRC init, network (eth0, DHCP/static), 20 GB rootfs, timezone |
| C2 | nginx | HTTP front end | Listen :80; serve static assets; dispatch *.php to C3 over a unix socket |
| C3 | php-fpm (php83) |
PHP FastCGI runtime | Execute Atheos PHP as a dedicated unprivileged user; extensions ZIP/OPENSSL/MBSTRING; allow_url_fopen=On |
| C4 | Atheos (upstream PHP app, pinned SHA) | The browser editor | File tree, editor, and git operations via its codegit component |
| C5 | Atheos workspace (/var/www/atheos/workspace) |
Project storage | Holds working copies Atheos opens as projects; must be writable by C3 |
| C6 | git CLI | VCS client | Invoked by C4's codegit; needs safe.directory, has no configured identity (operator sets it) |
| C7 | blog working copy |
The thing the operator edits | A clone of armistace/blog at C5/blog, on master |
External / not provisioned by the agent
| ID | Component | Relationship |
|---|---|---|
| C8 | Gitea (git.aridgwayweb.com → LXC 109, .155) |
Clone source. Read-only from this project's perspective — the agent never pushes |
| C9 | Operator (human) | SSHes in; owns: SSH key, git identity, Atheos admin account, and switching the remote to SSH |
Explicit non-components (scope guards)
- No database. Atheos is file-backed; nothing is installed for it.
- No Python / pelican /
make html. The build pipeline is out of scope (FR-1 / AC-8). The presence of Python would be a defect, not a bonus. - No NPM proxy host, no DNS, no port-forward (LAN-only, FR-10).
- No Atheos user seeded by the agent — C9 creates the first account via the installer.