feat: agent deploys — passwordless ssh key (alarm/desk/blanc-nas + gitea), write-scope gitea token, secrets mounts, gitconfig, APPEND_SYSTEM deploy guide

docker/agent-append-system.md

@@ -0,0 +1,52 @@
+# lvmh agent deployment guide
+
+You are running inside an lvmh worker container with deployment capabilities.
+
+## Deploy hosts (SSH, passwordless key at /root/.ssh/id_ed25519)
+
+- `alarm` — the main server. Services live in `/zdata/root/dockerFiles/<name>`
+  (docker compose). lvmh itself: `/zdata/root/dockerFiles/lvmh`.
+- `desk` — desktop machine.
+- `blanc-nas` — NAS.
+
+SSH works directly: `ssh alarm 'sudo docker compose -f /zdata/root/dockerFiles/empstream/docker-compose.yml up -d --build'`.
+The key is also registered in Gitea (but Gitea has no SSH port — use HTTPS+token for git, see below).
+
+## Git pushes and pull requests
+
+Your Gitea token is in `$LVMH_GITEA_TOKEN` (scopes: write repository + user).
+Gitea: `https://git.westphal.fr` (user `buenosair`).
+
+Clone/push with the token — NEVER put it in a URL that gets written to disk:
+
+```
+git -c http.extraHeader="Authorization: token $LVMH_GITEA_TOKEN" clone https://git.westphal.fr/<owner>/<repo>.git
+git -c http.extraHeader="Authorization: token $LVMH_GITEA_TOKEN" push origin <branch>
+```
+
+(For pulls from an existing clone, the same `-c` flag works with `pull`/`fetch`/`push`.)
+
+Create a pull request:
+
+```
+curl -s -X POST -H "Authorization: token $LVMH_GITEA_TOKEN" -H 'Content-Type: application/json' \
+  -d '{"title":"<title>","head":"<branch>","base":"<base>","body":"<description>"}' \
+  https://git.westphal.fr/api/v1/repos/<owner>/<repo>/pulls
+```
+
+Comment, list PRs, merge — same `/api/v1/repos/<owner>/<repo>/pulls` resource family.
+
+## Known repo deploy targets
+
+- `buenosair/ezrpc`, `buenosair/empstream`, `buenosair/mev` — docker-compose services on
+  `alarm` under `/zdata/root/dockerFiles/`. Typical flow: push branch/merge to main →
+  `ssh alarm` → `git -C /zdata/root/dockerFiles/<dir> pull` (or clone if missing) →
+  `sudo docker compose up -d --build`.
+- Check what's running: `ssh alarm 'sudo docker ps'`.
+
+## Rules
+
+- Never print or commit `$LVMH_GITEA_TOKEN` or the contents of `/root/.ssh/id_ed25519`.
+- Prefer PRs for non-trivial changes; ask in chat before force-pushing or touching main.
+- On deploy hosts, `sudo` is available for this key where needed; use it only for
+  service management (docker/systemctl), not for arbitrary system changes.

docker/gitconfig

@@ -0,0 +1,7 @@
+[user]
+	name = buenosair
+	email = x3nx@hotmail.fr
+[commit]
+	gpgsign = false
+[tag]
+	gpgsign = false

docker/ssh-config

@@ -0,0 +1,6 @@
+Host alarm desk blanc-nas
+  IdentityFile /root/.ssh/id_ed25519
+  IdentitiesOnly yes
+  StrictHostKeyChecking yes
+  UserKnownHostsFile /root/.ssh/known_hosts
+  ConnectTimeout 8

docker/ssh-known_hosts

@@ -0,0 +1,8 @@
+# blanc-nas:22 SSH-2.0-OpenSSH_10.4
+blanc-nas ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7CmHNP4LxohSCJY1acgMqPPb0hvjlbDzzvf1oqPLcaGs+KsRL2+OfMbNHOMBz4XfM5WN5DANOCuOBJBtn1vyAu83JXLx0XTl6pEnmaBm6Wjs05zmI1fliGJHgbPsPCz8Y+kRNY1Z01VWWsanr7Yu9LStcyKY1v2i2DqQ9i3WdTzWyE9Tkt3540/49LFVjkRR6lGeh2G0/ppM3utM2Rg/CGMjbmYV9LBtU5CTtrEWiGLyDwxuXNyk6BcQkxOHZf76W05/FwvHRv15mwF0RxkDitmfzWMEQ/+paUcDMRgLKF1j2mBtR2UdR3z7m4q46PiXKAjyJAG7tIfJqwr1jSRYXn6+bEV5tK6VJkc2+0viMoQYrnBBxL676rShECG27Ib8loUk2PuhXUSVWiLY+/BvRyXETIZxgoF53LCO5Z0Wh91Dp2OMfO0EajfRc83FfqOFgwhGpVk27r+LcLjYzqz5BUIy58HtSpZEQRr1KJuagZFfnLDRtY9ovn3uBDQhpX0k=
+# blanc-nas:22 SSH-2.0-OpenSSH_10.4
+blanc-nas ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFB7p37Rxw6tW2rUpoECwtXLBnU179CxiwTNtwJQs7Sp
+# alarm:22 SSH-2.0-OpenSSH_10.4
+alarm ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCwjQpOAwCL0AIGeJzI99CoOFTxUFUd2+DCveZKeBfCpdyZAtrPTd5310VjyAH0HWXd3c4fZvgPcrjSzzbygpSroZD9zQh6zadp+yCXZNoLrc2iT8CkSngw24QpvOfdkunJiwnRjKLflYrCvzu0BHAoDKHq8XjpTpwfN0BH/eoIIqcoDnmF9KrTUQRbEzwg+xc1T41ByjIalqHfrdNxV0S8xv+sQ7/YvGmi4YVZJ5ElqEEgGtyBDJE3WuveH5sA+YkdoMMEm9Xf+xlgO6uwhaYAKbG29Rkq9Ot8N7NSf3mu00XVK5wHvHLYqFBhA24Pw5fuDp0ohbhHKIbpumS5GP8Ow3eR/bLIesSGkaPnB4o6t8HiQ3TKfdCO8UAvH85j6gXDiPmFXybOmxQMB+oWo+zdOYa8XVryHB3CJ+4yBmJU03dzNwpV+93uVoW9jmjElRwZx9c+gqSBUWgWlaVF1AFdVT2swzKIBTJg2ZXjoqLphuWfnewhPKPt48Fr5B0OAYk=
+# alarm:22 SSH-2.0-OpenSSH_10.4
+alarm ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGIoBFYAfkN1Q8XsjwsJZ2mLIQi9XQ9M03zEENW8Injq