From 0a8e69db3d4096ad0b2610bd32e3c979ba4342f5 Mon Sep 17 00:00:00 2001
From: "Scott \"R00tPiG Security\" Lindsey" <rootpig@georgelambert.org>
Date: Fri, 11 Sep 2026 23:36:07 -0400
Subject: [PATCH 1/4] Proxmox worker, uptime, backup, tagged deploy

---
 NATS.md           |  3 +++
 README.md         | 20 ++++++++++++++++++
 SUMMARY.md        |  3 +++
 package.json      | 10 +++++++++
 scripts/deploy.sh | 54 +++++++++++++++++++++++++++++++++++++++++++++++
 scripts/test.sh   |  6 ++++++
 6 files changed, 96 insertions(+)
 create mode 100644 NATS.md
 create mode 100644 README.md
 create mode 100644 SUMMARY.md
 create mode 100644 package.json
 create mode 100755 scripts/deploy.sh
 create mode 100755 scripts/test.sh

diff --git a/NATS.md b/NATS.md
new file mode 100644
index 0000000..243c3eb
--- /dev/null
+++ b/NATS.md
@@ -0,0 +1,3 @@
+# NATS — verae-deploy
+
+Deploy does not start nats-server or open client connections. Archive types still need `nats-server` from `verae-bootstrap/scripts/host-deps.sh --nats`.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..5667263
--- /dev/null
+++ b/README.md
@@ -0,0 +1,20 @@
+# verae-deploy
+
+Upgrade cloned Forgejo modules **on the machine that runs them**. Order: `host-deps.sh` → `git fetch` → checkout tag/branch → `npm ci` (or `npm install`) → `npm rebuild`.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-deploy  
+**SSH:** `ssh://git@git.georgelambert.org:2223/marchon/verae-deploy.git`
+
+```bash
+export VERAE_SRC=$HOME/verae-src
+export VERAE_BOOTSTRAP=$HOME/verae-src/verae-bootstrap   # or sibling clone
+export DEPLOY_TYPE=ns1-all-in-one
+bash scripts/deploy.sh main
+# then: systemctl --user restart verae-keep-guard verae-fleet
+```
+
+Writes `$VERAE_SRC/<repo>/.deployed-ref` and `$VERAE_SRC/.deployed`. Does **not** force-push. Prefer tags (`v2026-09-12`) once you cut them.
+
+Do **not** copy `node_modules` from macOS. Rebuild `better-sqlite3` on Linux.
+
+Does not speak NATS.
diff --git a/SUMMARY.md b/SUMMARY.md
new file mode 100644
index 0000000..ac69361
--- /dev/null
+++ b/SUMMARY.md
@@ -0,0 +1,3 @@
+# verae-deploy
+
+Tagged/branch checkout of every cloned module plus npm ci/rebuild on the target OS.
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..2d7d8e8
--- /dev/null
+++ b/package.json
@@ -0,0 +1,10 @@
+{
+  "name": "verae-deploy",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Tagged checkout + npm ci + rebuild on the target OS for Verae module repos",
+  "scripts": {
+    "deploy": "bash scripts/deploy.sh",
+    "test": "bash scripts/test.sh"
+  }
+}
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
new file mode 100755
index 0000000..44103ff
--- /dev/null
+++ b/scripts/deploy.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# host-deps → git fetch → checkout ref → npm ci → npm rebuild
+# Does not start processes; restart with fleet/keep after.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+BOOT="${VERAE_BOOTSTRAP:-$ROOT/../verae-bootstrap}"
+SRC="${VERAE_SRC:-$HOME/verae-src}"
+REF="${1:-}"
+TYPE="${DEPLOY_TYPE:-}"
+if [[ -z "$REF" ]]; then
+  echo "usage: deploy.sh <tag-or-branch>   # e.g. deploy.sh v2026-09-12 or main" >&2
+  exit 1
+fi
+if [[ -x "$BOOT/scripts/host-deps.sh" ]]; then
+  if [[ -n "$TYPE" ]]; then
+    bash "$BOOT/scripts/host-deps.sh" --type "$TYPE"
+  else
+    bash "$BOOT/scripts/host-deps.sh"
+  fi
+fi
+LIST="$BOOT/repos.txt"
+[[ -n "$TYPE" && -f "$BOOT/types/$TYPE/repos.txt" ]] && LIST="$BOOT/types/$TYPE/repos.txt"
+[[ -f "$LIST" ]] || { echo "no repo list $LIST" >&2; exit 1; }
+export GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o StrictHostKeyChecking=accept-new -p 2223}"
+failed=0
+while read -r name; do
+  [[ -z "$name" || "$name" == \#* ]] && continue
+  dir="$SRC/$name"
+  if [[ ! -d "$dir/.git" ]]; then
+    echo "skip not cloned $name"
+    continue
+  fi
+  echo "deploy $name @ $REF"
+  git -C "$dir" fetch --prune origin
+  if ! git -C "$dir" checkout -q "$REF" 2>/dev/null; then
+    echo "  no ref $REF, staying on $(git -C "$dir" rev-parse --abbrev-ref HEAD)"
+  fi
+  if [[ -f "$dir/package.json" ]]; then
+    (
+      cd "$dir"
+      if [[ -f package-lock.json ]]; then
+        npm ci --no-audit --no-fund || npm install --no-audit --no-fund
+      else
+        npm install --no-audit --no-fund
+      fi
+      npm rebuild --no-audit --no-fund >/dev/null || true
+    ) || { echo "  npm failed $name"; failed=1; }
+  fi
+  git -C "$dir" rev-parse --short HEAD >"$dir/.deployed-ref"
+  echo "  $(cat "$dir/.deployed-ref")"
+done < "$LIST"
+echo "$REF $(date -u +%Y-%m-%dT%H:%M:%SZ)" >"$SRC/.deployed"
+[[ $failed -eq 0 ]] || exit 1
+echo "deployed $REF under $SRC — restart keep/fleet yourself"
diff --git a/scripts/test.sh b/scripts/test.sh
new file mode 100755
index 0000000..4b26376
--- /dev/null
+++ b/scripts/test.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+bash -n "$ROOT/scripts/deploy.sh"
+grep -q host-deps.sh "$ROOT/scripts/deploy.sh"
+echo OK

From e01f10ff0b36603ccf6b940797a0ea37fbffc8de Mon Sep 17 00:00:00 2001
From: "Scott \"R00tPiG Security\" Lindsey (r00tpig)"
 <r00tpig@georgelambert.org>
Date: Fri, 11 Sep 2026 23:36:07 -0400
Subject: [PATCH 2/4] Proxmox worker, uptime, backup, tagged deploy

---
 NATS.md           |  3 +++
 README.md         | 20 ++++++++++++++++++
 SUMMARY.md        |  3 +++
 package.json      | 10 +++++++++
 scripts/deploy.sh | 54 +++++++++++++++++++++++++++++++++++++++++++++++
 scripts/test.sh   |  6 ++++++
 6 files changed, 96 insertions(+)
 create mode 100644 NATS.md
 create mode 100644 README.md
 create mode 100644 SUMMARY.md
 create mode 100644 package.json
 create mode 100755 scripts/deploy.sh
 create mode 100755 scripts/test.sh

diff --git a/NATS.md b/NATS.md
new file mode 100644
index 0000000..243c3eb
--- /dev/null
+++ b/NATS.md
@@ -0,0 +1,3 @@
+# NATS — verae-deploy
+
+Deploy does not start nats-server or open client connections. Archive types still need `nats-server` from `verae-bootstrap/scripts/host-deps.sh --nats`.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..5667263
--- /dev/null
+++ b/README.md
@@ -0,0 +1,20 @@
+# verae-deploy
+
+Upgrade cloned Forgejo modules **on the machine that runs them**. Order: `host-deps.sh` → `git fetch` → checkout tag/branch → `npm ci` (or `npm install`) → `npm rebuild`.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-deploy  
+**SSH:** `ssh://git@git.georgelambert.org:2223/marchon/verae-deploy.git`
+
+```bash
+export VERAE_SRC=$HOME/verae-src
+export VERAE_BOOTSTRAP=$HOME/verae-src/verae-bootstrap   # or sibling clone
+export DEPLOY_TYPE=ns1-all-in-one
+bash scripts/deploy.sh main
+# then: systemctl --user restart verae-keep-guard verae-fleet
+```
+
+Writes `$VERAE_SRC/<repo>/.deployed-ref` and `$VERAE_SRC/.deployed`. Does **not** force-push. Prefer tags (`v2026-09-12`) once you cut them.
+
+Do **not** copy `node_modules` from macOS. Rebuild `better-sqlite3` on Linux.
+
+Does not speak NATS.
diff --git a/SUMMARY.md b/SUMMARY.md
new file mode 100644
index 0000000..ac69361
--- /dev/null
+++ b/SUMMARY.md
@@ -0,0 +1,3 @@
+# verae-deploy
+
+Tagged/branch checkout of every cloned module plus npm ci/rebuild on the target OS.
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..2d7d8e8
--- /dev/null
+++ b/package.json
@@ -0,0 +1,10 @@
+{
+  "name": "verae-deploy",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Tagged checkout + npm ci + rebuild on the target OS for Verae module repos",
+  "scripts": {
+    "deploy": "bash scripts/deploy.sh",
+    "test": "bash scripts/test.sh"
+  }
+}
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
new file mode 100755
index 0000000..44103ff
--- /dev/null
+++ b/scripts/deploy.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# host-deps → git fetch → checkout ref → npm ci → npm rebuild
+# Does not start processes; restart with fleet/keep after.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+BOOT="${VERAE_BOOTSTRAP:-$ROOT/../verae-bootstrap}"
+SRC="${VERAE_SRC:-$HOME/verae-src}"
+REF="${1:-}"
+TYPE="${DEPLOY_TYPE:-}"
+if [[ -z "$REF" ]]; then
+  echo "usage: deploy.sh <tag-or-branch>   # e.g. deploy.sh v2026-09-12 or main" >&2
+  exit 1
+fi
+if [[ -x "$BOOT/scripts/host-deps.sh" ]]; then
+  if [[ -n "$TYPE" ]]; then
+    bash "$BOOT/scripts/host-deps.sh" --type "$TYPE"
+  else
+    bash "$BOOT/scripts/host-deps.sh"
+  fi
+fi
+LIST="$BOOT/repos.txt"
+[[ -n "$TYPE" && -f "$BOOT/types/$TYPE/repos.txt" ]] && LIST="$BOOT/types/$TYPE/repos.txt"
+[[ -f "$LIST" ]] || { echo "no repo list $LIST" >&2; exit 1; }
+export GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o StrictHostKeyChecking=accept-new -p 2223}"
+failed=0
+while read -r name; do
+  [[ -z "$name" || "$name" == \#* ]] && continue
+  dir="$SRC/$name"
+  if [[ ! -d "$dir/.git" ]]; then
+    echo "skip not cloned $name"
+    continue
+  fi
+  echo "deploy $name @ $REF"
+  git -C "$dir" fetch --prune origin
+  if ! git -C "$dir" checkout -q "$REF" 2>/dev/null; then
+    echo "  no ref $REF, staying on $(git -C "$dir" rev-parse --abbrev-ref HEAD)"
+  fi
+  if [[ -f "$dir/package.json" ]]; then
+    (
+      cd "$dir"
+      if [[ -f package-lock.json ]]; then
+        npm ci --no-audit --no-fund || npm install --no-audit --no-fund
+      else
+        npm install --no-audit --no-fund
+      fi
+      npm rebuild --no-audit --no-fund >/dev/null || true
+    ) || { echo "  npm failed $name"; failed=1; }
+  fi
+  git -C "$dir" rev-parse --short HEAD >"$dir/.deployed-ref"
+  echo "  $(cat "$dir/.deployed-ref")"
+done < "$LIST"
+echo "$REF $(date -u +%Y-%m-%dT%H:%M:%SZ)" >"$SRC/.deployed"
+[[ $failed -eq 0 ]] || exit 1
+echo "deployed $REF under $SRC — restart keep/fleet yourself"
diff --git a/scripts/test.sh b/scripts/test.sh
new file mode 100755
index 0000000..4b26376
--- /dev/null
+++ b/scripts/test.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+bash -n "$ROOT/scripts/deploy.sh"
+grep -q host-deps.sh "$ROOT/scripts/deploy.sh"
+echo OK

From a43959174a46febb69085a7914d04723b3136a24 Mon Sep 17 00:00:00 2001
From: "Scott \"R00tPiG Security\" Lindsey" <rootpig@georgelambert.org>
Date: Mon, 12 Oct 2026 20:02:49 -0400
Subject: [PATCH 3/4] docs: set OWNER/AUTHORS credit to rootpig (Scott R00tPiG
 Lindsey)

---
 AUTHORS  |  1 +
 OWNER.md | 10 ++++++++++
 2 files changed, 11 insertions(+)
 create mode 100644 AUTHORS
 create mode 100644 OWNER.md

diff --git a/AUTHORS b/AUTHORS
new file mode 100644
index 0000000..846a4f5
--- /dev/null
+++ b/AUTHORS
@@ -0,0 +1 @@
+Scott "R00tPiG Security" Lindsey <rootpig@georgelambert.org> (rootpig) — owner
diff --git a/OWNER.md b/OWNER.md
new file mode 100644
index 0000000..e7f075e
--- /dev/null
+++ b/OWNER.md
@@ -0,0 +1,10 @@
+# Repository owner
+
+**Owner / credited author:** Scott "R00tPiG Security" Lindsey (`rootpig`)
+
+Forgejo: https://git.georgelambert.org/rootpig
+
+This repository is owned by **rootpig** for Verae Inc. server maintenance,
+deployment scripting, and related operations work.
+
+Co-contributors may appear in git history; ownership and ops credit belong to rootpig.

From 22726ef9e01d174d4707b857c7b3c43644e51cf1 Mon Sep 17 00:00:00 2001
From: "Scott \"R00tPiG Security\" Lindsey (r00tpig)"
 <r00tpig@georgelambert.org>
Date: Mon, 12 Oct 2026 20:02:49 -0400
Subject: [PATCH 4/4] docs: set OWNER/AUTHORS credit to rootpig (Scott R00tPiG
 Lindsey)

---
 AUTHORS  |  1 +
 OWNER.md | 10 ++++++++++
 2 files changed, 11 insertions(+)
 create mode 100644 AUTHORS
 create mode 100644 OWNER.md

diff --git a/AUTHORS b/AUTHORS
new file mode 100644
index 0000000..846a4f5
--- /dev/null
+++ b/AUTHORS
@@ -0,0 +1 @@
+Scott "R00tPiG Security" Lindsey <rootpig@georgelambert.org> (rootpig) — owner
diff --git a/OWNER.md b/OWNER.md
new file mode 100644
index 0000000..e7f075e
--- /dev/null
+++ b/OWNER.md
@@ -0,0 +1,10 @@
+# Repository owner
+
+**Owner / credited author:** Scott "R00tPiG Security" Lindsey (`rootpig`)
+
+Forgejo: https://git.georgelambert.org/rootpig
+
+This repository is owned by **rootpig** for Verae Inc. server maintenance,
+deployment scripting, and related operations work.
+
+Co-contributors may appear in git history; ownership and ops credit belong to rootpig.