marchon/system-git-sync
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

S26: deploy generates nats.env PSK, FORBID_PLAIN, rebuilt pfc-repl
Some checks are pending
review / inventory (push) Waiting to run
Details

Browse source 
PDF bundle rsync so relative PDF links resolve on docs.pfc.
This commit is contained in:
George Lambert 2026-09-15 23:29:25 -04:00
parent aa7c837493
commit 185cdaabdb
4 changed files with 49 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

42
cicd/deploy-ns1.sh
View file

@ -12,10 +12,13 @@ bash "$ROOT/system-git-sync/cicd/run-review.sh"
echo "=== linux sm-leaf ==="
mkdir -p "$ROOT/secure-messaging/go/bin"
( cd "$ROOT/secure-messaging/go" && GOOS=linux GOARCH=amd64 go build -o bin/sm-leaf-linux ./cmd/sm-leaf )
echo "=== linux pfc-repl ==="
( cd "$ROOT/peergos-compliance-go" && GOOS=linux GOARCH=amd64 go build -o /tmp/pfc-repl-linux ./cmd/pfc-repl )
echo "=== rsync ==="
ssh "$HOST" 'sudo mkdir -p /opt/pfc/bin /opt/pfc/python/secure_messaging /opt/pfc/python/admin /opt/pfc/python/lib /opt/pfc/etc /opt/pfc/data/admin/admin-history /opt/pfc/docs/html/sync /opt/pfc/docs/html/nats-service-endpoints'
rsync -az "$ROOT/secure-messaging/go/bin/sm-leaf-linux" "$HOST:/tmp/sm-leaf-linux"
rsync -az /tmp/pfc-repl-linux "$HOST:/tmp/pfc-repl-linux"
rsync -az --exclude '__pycache__' "$ROOT/secure-messaging/python/secure_messaging/" "$HOST:/tmp/secure_messaging/"
rsync -az "$ROOT/secure-messaging/deploy/pfc-sm-leaf.service" "$HOST:/tmp/pfc-sm-leaf.service"
rsync -az "$ROOT/system-git-sync/" --exclude '.git' --exclude '.forgejo' "$HOST:/tmp/system-git-sync/"
@ -33,6 +36,9 @@ fi
if [[ -f "$ROOT/peergos-compliance-docs/build/latex/peergos-for-compliance.pdf" ]]; then
rsync -az "$ROOT/peergos-compliance-docs/build/latex/peergos-for-compliance.pdf" "$HOST:/tmp/pfc-docs.pdf"
fi
if [[ -d "$ROOT/peergos-compliance-docs/build/pdf-bundle" ]]; then
rsync -az "$ROOT/peergos-compliance-docs/build/pdf-bundle/" "$HOST:/tmp/pdf-bundle/"
fi
if [[ -d "$ROOT/secure-messaging/build/html" ]]; then
rsync -az "$ROOT/secure-messaging/build/html/" "$HOST:/tmp/sm-html/"
fi
@ -46,9 +52,36 @@ rsync -az "$ROOT/system-git-sync/docs/" --exclude pfc-site "$HOST:/tmp/sync-docs
echo "=== install on host ==="
ssh "$HOST" 'bash -s' << "EOF"
set -e
sudo systemctl stop pfc-sm-leaf || true
sudo systemctl stop pfc-sm-leaf pfc-repl pfc-repl-a pfc-repl-b || true
sudo cp /tmp/sm-leaf-linux /opt/pfc/bin/sm-leaf
sudo chmod +x /opt/pfc/bin/sm-leaf
if [ -f /tmp/pfc-repl-linux ]; then
sudo cp /tmp/pfc-repl-linux /opt/pfc/bin/pfc-repl
sudo chmod +x /opt/pfc/bin/pfc-repl
fi
# bus PSK: never plaintext PHI on NATS (broker remains untrusted)
if [ ! -f /opt/pfc/etc/nats.env ]; then
k=$(python3 -c 'import secrets; print(secrets.token_hex(32))')
printf 'PFC_NATS_KEY=%s\nPFC_FORBID_PLAIN=1\n' "$k" | sudo tee /opt/pfc/etc/nats.env >/dev/null
sudo chmod 600 /opt/pfc/etc/nats.env
fi
sudo mkdir -p /etc/systemd/system/pfc-py-admin.service.d /etc/systemd/system/pfc-repl.service.d /etc/systemd/system/pfc-repl-a.service.d /etc/systemd/system/pfc-repl-b.service.d
sudo tee /etc/systemd/system/pfc-py-admin.service.d/nats-psk.conf >/dev/null << 'UNIT'
[Service]
EnvironmentFile=-/opt/pfc/etc/nats.env
UNIT
sudo tee /etc/systemd/system/pfc-repl.service.d/nats-psk.conf >/dev/null << 'UNIT'
[Service]
EnvironmentFile=-/opt/pfc/etc/nats.env
UNIT
sudo tee /etc/systemd/system/pfc-repl-a.service.d/nats-psk.conf >/dev/null << 'UNIT'
[Service]
EnvironmentFile=-/opt/pfc/etc/nats.env
UNIT
sudo tee /etc/systemd/system/pfc-repl-b.service.d/nats-psk.conf >/dev/null << 'UNIT'
[Service]
EnvironmentFile=-/opt/pfc/etc/nats.env
UNIT
sudo mkdir -p /opt/pfc/python/secure_messaging /opt/pfc/python/admin/pfc_admin /opt/pfc/python/lib
sudo rsync -a /tmp/secure_messaging/ /opt/pfc/python/secure_messaging/
sudo rsync -a /tmp/pfc_admin/ /opt/pfc/python/admin/pfc_admin/
@ -144,6 +177,12 @@ fi
if [ -f /tmp/pfc-docs.pdf ]; then
sudo cp /tmp/pfc-docs.pdf /opt/pfc/docs/html/peergos-for-compliance.pdf
fi
if [ -d /tmp/pdf-bundle ]; then
sudo cp /tmp/pdf-bundle/*.pdf /opt/pfc/docs/html/
sudo cp /tmp/pdf-bundle/*.pdf /opt/pfc/docs/html/nats-service-endpoints/ 2>/dev/null || true
sudo mkdir -p /opt/pfc/docs/html/secure-messaging
sudo cp /tmp/pdf-bundle/*.pdf /opt/pfc/docs/html/secure-messaging/ 2>/dev/null || true
fi
if [ -d /tmp/sm-html ]; then
sudo mkdir -p /opt/pfc/docs/html/secure-messaging
sudo rsync -a /tmp/sm-html/ /opt/pfc/docs/html/secure-messaging/
@ -165,6 +204,7 @@ if [ -f /tmp/system-git-sync/../peergos-compliance-go/deploy/pfc.georgelambert.o
fi
sudo systemctl daemon-reload
sudo systemctl enable --now pfc-sm-leaf
sudo systemctl start pfc-repl pfc-repl-a pfc-repl-b
sudo systemctl restart pfc-py-admin
sleep 2
systemctl is-active pfc-sm-leaf pfc-py-admin pfc-connector pfc-peergos-bridge