feat: agent deploys — passwordless ssh key (alarm/desk/blanc-nas + gitea), write-scope gitea token, secrets mounts, gitconfig, APPEND_SYSTEM deploy guide

daemon/docker_test.go

@@ -487,3 +487,34 @@ func waitJobState(t *testing.T, sp *Spawner, sessionID, want string) SpawnJob {
 	})
 	return job
 }
+
+func TestSpawnerSecretsBinds(t *testing.T) {
+	useFakeGit(t, fakeGitModeOK)
+	f := newFakeDocker()
+	sp, _ := newTestSpawner(t, f)
+	sec := t.TempDir()
+	t.Setenv(envSecretsDir, sec)
+
+	res, err := sp.Start(context.Background(), "group/project", "")
+	if err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	waitJobState(t, sp, res.SessionID, stateRunning)
+	creates := f.createsByName("lvmh-agent-")
+	if len(creates) != 1 {
+		t.Fatalf("creates = %d", len(creates))
+	}
+	binds := creates[0].HostConfig.Binds
+	ssh, gc := false, false
+	for _, b := range binds {
+		if b == sec+":/root/.ssh:ro" {
+			ssh = true
+		}
+		if b == sec+"/gitconfig:/root/.gitconfig:ro" {
+			gc = true
+		}
+	}
+	if !ssh || !gc {
+		t.Fatalf("secrets binds missing: %v", binds)
+	}
+}