marchon/system-git-sync
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

S25: HSM custody, sync.pfc, georgelambert.org/pfc deep links
Some checks are pending
review / inventory (push) Waiting to run
Details

Browse source 
UserReview leftovers implemented without rewriting 70 website repos
and without fail-closing pfc-py-admin.
This commit is contained in:
George Lambert 2026-09-15 23:19:44 -04:00
parent 8c09abecae
commit aa7c837493
9 changed files with 171 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

32
cicd/deploy-ns1.sh
View file

@ -39,6 +39,9 @@ fi
if [[ -d "$ROOT/peergos-compliance-config/web" ]]; then
rsync -az "$ROOT/peergos-compliance-config/web/" "$HOST:/tmp/config-web/"
fi
rsync -az "$ROOT/peergos-compliance-go/deploy/pfc.georgelambert.org.caddy" "$HOST:/tmp/pfc.georgelambert.org.caddy"
rsync -az "$ROOT/system-git-sync/docs/pfc-site/" "$HOST:/tmp/pfc-site/"
rsync -az "$ROOT/system-git-sync/docs/" --exclude pfc-site "$HOST:/tmp/sync-docs-extra/"
echo "=== install on host ==="
ssh "$HOST" 'bash -s' << "EOF"
@ -58,6 +61,7 @@ Environment=PYTHONPATH=/opt/pfc/python/lib:/opt/pfc/python/admin:/opt/pfc/python
Environment=PFC_SIGNED_CONFIG=/opt/pfc/etc/secure-messaging.signed.json
Environment=PFC_CONFIG_KEY_PEM=/opt/pfc/etc/sm-keys/config.ed25519.pem
Environment=PFC_REPL_URL=http://127.0.0.1:18784
Environment=NPE_BIN=/opt/pfc/bin/npe
UNIT
# lab keys on host only — never overwrite an existing private key
sudo mkdir -p /opt/pfc/etc/sm-keys
@ -110,6 +114,23 @@ if [ -d /tmp/system-git-sync ]; then
if [ -f /tmp/system-git-sync/docs/thesaurus.md ]; then
sudo cp /tmp/system-git-sync/docs/thesaurus.md /opt/pfc/docs/html/sync/thesaurus.md
fi
if [ -d /tmp/sync-docs-extra ]; then
sudo cp /tmp/sync-docs-extra/*.md /tmp/sync-docs-extra/*.html /opt/pfc/docs/html/sync/ 2>/dev/null || true
fi
fi
if [ -f /tmp/pfc.georgelambert.org.caddy ]; then
sudo cp /tmp/pfc.georgelambert.org.caddy /etc/caddy/sites/pfc.georgelambert.org.caddy
sudo caddy reload --config /etc/caddy/Caddyfile || sudo systemctl reload caddy || true
fi
if [ -d /tmp/pfc-site ] && [ -d /SSD2/sites/georgelambert.org ]; then
sudo mkdir -p /SSD2/sites/georgelambert.org/pfc
sudo cp /tmp/pfc-site/index.html /SSD2/sites/georgelambert.org/pfc/index.html
fi
if [ -x /opt/pfc/bin/npe ] && [ ! -f /opt/pfc/etc/npe/lab.seed ]; then
sudo mkdir -p /opt/pfc/etc/npe
sudo /opt/pfc/bin/npe keygen --out /opt/pfc/etc/npe/lab
sudo chmod 600 /opt/pfc/etc/npe/lab.seed
sudo chmod 644 /opt/pfc/etc/npe/lab.npeid || true
fi
if [ -d /tmp/nse-html ]; then
sudo rsync -a /tmp/nse-html/ /opt/pfc/docs/html/nats-service-endpoints/
@ -131,6 +152,17 @@ if [ -d /tmp/config-web ]; then
sudo mkdir -p /opt/pfc/config-ui
sudo rsync -a /tmp/config-web/ /opt/pfc/config-ui/
fi
# lab NPE identity on host only (never git)
if [ -x /opt/pfc/bin/npe ] && [ ! -f /opt/pfc/etc/npe/lab.seed ]; then
sudo mkdir -p /opt/pfc/etc/npe
sudo /opt/pfc/bin/npe keygen --out /opt/pfc/etc/npe/lab
sudo chmod 600 /opt/pfc/etc/npe/lab.seed
sudo chmod 644 /opt/pfc/etc/npe/lab.npeid
fi
# Caddy: sync.pfc (DNS already 70.88.205.138)
if [ -f /tmp/system-git-sync/../peergos-compliance-go/deploy/pfc.georgelambert.org.caddy ]; then
true
fi
sudo systemctl daemon-reload
sudo systemctl enable --now pfc-sm-leaf
sudo systemctl restart pfc-py-admin