feat: agent deploys — passwordless ssh key (alarm/desk/blanc-nas + gitea), write-scope gitea token, secrets mounts, gitconfig, APPEND_SYSTEM deploy guide

daemon/docker.go

@@ -40,16 +40,19 @@ const (
 	stateRunning  string = "running"
 	stateError    string = "error"
 
-	imageRefWorker    string = "lvmh-worker:latest"
-	labelSession      string = "lvmh.session"
-	volumeRepoPrefix  string = "lvmh-repo-"
-	volumeSessions    string = "lvmh-sessions"
-	volumePiCache     string = "lvmh-pi-cache" // pi package cache (git:/npm:), shared across spawns
-	cacheMount        string = "/root/.pi/agent/cache"
-	authMountTarget   string = "/root/.pi/agent/auth.json"
-	envHostPiAgentDir string = "LVMH_HOST_PI_AGENT_DIR"
-	workspaceMount    string = "/workspace"
-	sessionsMount     string = "/pi-sessions"
+	imageRefWorker       string = "lvmh-worker:latest"
+	labelSession         string = "lvmh.session"
+	volumeRepoPrefix     string = "lvmh-repo-"
+	volumeSessions       string = "lvmh-sessions"
+	volumePiCache        string = "lvmh-pi-cache" // pi package cache (git:/npm:), shared across spawns
+	cacheMount           string = "/root/.pi/agent/cache"
+	authMountTarget      string = "/root/.pi/agent/auth.json"
+	envHostPiAgentDir    string = "LVMH_HOST_PI_AGENT_DIR"
+	envSecretsDir        string = "LVMH_SECRETS_DIR"
+	sshMountTarget       string = "/root/.ssh"
+	gitconfigMountTarget string = "/root/.gitconfig"
+	workspaceMount       string = "/workspace"
+	sessionsMount        string = "/pi-sessions"
 
 	envWorkerDockerfile   string = "LVMH_WORKER_DOCKERFILE"
 	defaultDockerfile     string = "/app/build/docker/worker.Dockerfile"
@@ -522,6 +525,16 @@ func (s *Spawner) createAndStart(ctx context.Context, repo, slug, sessionID stri
 	if hostAgent := os.Getenv(envHostPiAgentDir); hostAgent != "" {
 		binds = append(binds, hostAgent+"/auth.json:"+authMountTarget+":ro")
 	}
+	// Deploy secrets (ssh key + known_hosts + config, gitconfig), read-only.
+	// Bind sources resolve on the HOST (docker.sock semantics), so this env
+	// must carry the host path of the secrets dir.
+	if sec := os.Getenv(envSecretsDir); sec != "" {
+		binds = append(
+			binds,
+			sec+":"+sshMountTarget+":ro",
+			sec+"/gitconfig:"+gitconfigMountTarget+":ro",
+		)
+	}
 	cfg := &container.Config{
 		Image: image,
 		Env: []string{

daemon/docker_test.go

@@ -487,3 +487,34 @@ func waitJobState(t *testing.T, sp *Spawner, sessionID, want string) SpawnJob {
 	})
 	return job
 }
+
+func TestSpawnerSecretsBinds(t *testing.T) {
+	useFakeGit(t, fakeGitModeOK)
+	f := newFakeDocker()
+	sp, _ := newTestSpawner(t, f)
+	sec := t.TempDir()
+	t.Setenv(envSecretsDir, sec)
+
+	res, err := sp.Start(context.Background(), "group/project", "")
+	if err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	waitJobState(t, sp, res.SessionID, stateRunning)
+	creates := f.createsByName("lvmh-agent-")
+	if len(creates) != 1 {
+		t.Fatalf("creates = %d", len(creates))
+	}
+	binds := creates[0].HostConfig.Binds
+	ssh, gc := false, false
+	for _, b := range binds {
+		if b == sec+":/root/.ssh:ro" {
+			ssh = true
+		}
+		if b == sec+"/gitconfig:/root/.gitconfig:ro" {
+			gc = true
+		}
+	}
+	if !ssh || !gc {
+		t.Fatalf("secrets binds missing: %v", binds)
+	}
+}