commit d6a2391be05bb3dbf794e65b5077268b1aa616f8
Author: George Lambert <marchon@gmail.com>
Date:   Fri Sep 11 23:36:07 2026 -0400

    Proxmox worker, uptime, backup, tagged deploy

diff --git a/NATS.md b/NATS.md
new file mode 100644
index 0000000..243c3eb
--- /dev/null
+++ b/NATS.md
@@ -0,0 +1,3 @@
+# NATS — verae-deploy
+
+Deploy does not start nats-server or open client connections. Archive types still need `nats-server` from `verae-bootstrap/scripts/host-deps.sh --nats`.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..5667263
--- /dev/null
+++ b/README.md
@@ -0,0 +1,20 @@
+# verae-deploy
+
+Upgrade cloned Forgejo modules **on the machine that runs them**. Order: `host-deps.sh` → `git fetch` → checkout tag/branch → `npm ci` (or `npm install`) → `npm rebuild`.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-deploy  
+**SSH:** `ssh://git@git.georgelambert.org:2223/marchon/verae-deploy.git`
+
+```bash
+export VERAE_SRC=$HOME/verae-src
+export VERAE_BOOTSTRAP=$HOME/verae-src/verae-bootstrap   # or sibling clone
+export DEPLOY_TYPE=ns1-all-in-one
+bash scripts/deploy.sh main
+# then: systemctl --user restart verae-keep-guard verae-fleet
+```
+
+Writes `$VERAE_SRC/<repo>/.deployed-ref` and `$VERAE_SRC/.deployed`. Does **not** force-push. Prefer tags (`v2026-09-12`) once you cut them.
+
+Do **not** copy `node_modules` from macOS. Rebuild `better-sqlite3` on Linux.
+
+Does not speak NATS.
diff --git a/SUMMARY.md b/SUMMARY.md
new file mode 100644
index 0000000..ac69361
--- /dev/null
+++ b/SUMMARY.md
@@ -0,0 +1,3 @@
+# verae-deploy
+
+Tagged/branch checkout of every cloned module plus npm ci/rebuild on the target OS.
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..2d7d8e8
--- /dev/null
+++ b/package.json
@@ -0,0 +1,10 @@
+{
+  "name": "verae-deploy",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Tagged checkout + npm ci + rebuild on the target OS for Verae module repos",
+  "scripts": {
+    "deploy": "bash scripts/deploy.sh",
+    "test": "bash scripts/test.sh"
+  }
+}
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
new file mode 100755
index 0000000..44103ff
--- /dev/null
+++ b/scripts/deploy.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# host-deps → git fetch → checkout ref → npm ci → npm rebuild
+# Does not start processes; restart with fleet/keep after.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+BOOT="${VERAE_BOOTSTRAP:-$ROOT/../verae-bootstrap}"
+SRC="${VERAE_SRC:-$HOME/verae-src}"
+REF="${1:-}"
+TYPE="${DEPLOY_TYPE:-}"
+if [[ -z "$REF" ]]; then
+  echo "usage: deploy.sh <tag-or-branch>   # e.g. deploy.sh v2026-09-12 or main" >&2
+  exit 1
+fi
+if [[ -x "$BOOT/scripts/host-deps.sh" ]]; then
+  if [[ -n "$TYPE" ]]; then
+    bash "$BOOT/scripts/host-deps.sh" --type "$TYPE"
+  else
+    bash "$BOOT/scripts/host-deps.sh"
+  fi
+fi
+LIST="$BOOT/repos.txt"
+[[ -n "$TYPE" && -f "$BOOT/types/$TYPE/repos.txt" ]] && LIST="$BOOT/types/$TYPE/repos.txt"
+[[ -f "$LIST" ]] || { echo "no repo list $LIST" >&2; exit 1; }
+export GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o StrictHostKeyChecking=accept-new -p 2223}"
+failed=0
+while read -r name; do
+  [[ -z "$name" || "$name" == \#* ]] && continue
+  dir="$SRC/$name"
+  if [[ ! -d "$dir/.git" ]]; then
+    echo "skip not cloned $name"
+    continue
+  fi
+  echo "deploy $name @ $REF"
+  git -C "$dir" fetch --prune origin
+  if ! git -C "$dir" checkout -q "$REF" 2>/dev/null; then
+    echo "  no ref $REF, staying on $(git -C "$dir" rev-parse --abbrev-ref HEAD)"
+  fi
+  if [[ -f "$dir/package.json" ]]; then
+    (
+      cd "$dir"
+      if [[ -f package-lock.json ]]; then
+        npm ci --no-audit --no-fund || npm install --no-audit --no-fund
+      else
+        npm install --no-audit --no-fund
+      fi
+      npm rebuild --no-audit --no-fund >/dev/null || true
+    ) || { echo "  npm failed $name"; failed=1; }
+  fi
+  git -C "$dir" rev-parse --short HEAD >"$dir/.deployed-ref"
+  echo "  $(cat "$dir/.deployed-ref")"
+done < "$LIST"
+echo "$REF $(date -u +%Y-%m-%dT%H:%M:%SZ)" >"$SRC/.deployed"
+[[ $failed -eq 0 ]] || exit 1
+echo "deployed $REF under $SRC — restart keep/fleet yourself"
diff --git a/scripts/test.sh b/scripts/test.sh
new file mode 100755
index 0000000..4b26376
--- /dev/null
+++ b/scripts/test.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+bash -n "$ROOT/scripts/deploy.sh"
+grep -q host-deps.sh "$ROOT/scripts/deploy.sh"
+echo OK