feat: agent deploys — passwordless ssh key (alarm/desk/blanc-nas + gitea), write-scope gitea token, secrets mounts, gitconfig, APPEND_SYSTEM deploy guide

2026-08-20 09:34:17 +02:00
parent b51a3b564f
commit 6d10877e34
11 changed files with 338 additions and 10 deletions
@@ -0,0 +1,52 @@
+# lvmh agent deployment guide
+
+You are running inside an lvmh worker container with deployment capabilities.
+
+## Deploy hosts (SSH, passwordless key at /root/.ssh/id_ed25519)
+
+- `alarm` — the main server. Services live in `/zdata/root/dockerFiles/<name>`
+  (docker compose). lvmh itself: `/zdata/root/dockerFiles/lvmh`.
+- `desk` — desktop machine.
+- `blanc-nas` — NAS.
+
+SSH works directly: `ssh alarm 'sudo docker compose -f /zdata/root/dockerFiles/empstream/docker-compose.yml up -d --build'`.
+The key is also registered in Gitea (but Gitea has no SSH port — use HTTPS+token for git, see below).
+
+## Git pushes and pull requests
+
+Your Gitea token is in `$LVMH_GITEA_TOKEN` (scopes: write repository + user).
+Gitea: `https://git.westphal.fr` (user `buenosair`).
+
+Clone/push with the token — NEVER put it in a URL that gets written to disk:
+
+```
+git -c http.extraHeader="Authorization: token $LVMH_GITEA_TOKEN" clone https://git.westphal.fr/<owner>/<repo>.git
+git -c http.extraHeader="Authorization: token $LVMH_GITEA_TOKEN" push origin <branch>
+```
+
+(For pulls from an existing clone, the same `-c` flag works with `pull`/`fetch`/`push`.)
+
+Create a pull request:
+
+```
+curl -s -X POST -H "Authorization: token $LVMH_GITEA_TOKEN" -H 'Content-Type: application/json' \
+  -d '{"title":"<title>","head":"<branch>","base":"<base>","body":"<description>"}' \
+  https://git.westphal.fr/api/v1/repos/<owner>/<repo>/pulls
+```
+
+Comment, list PRs, merge — same `/api/v1/repos/<owner>/<repo>/pulls` resource family.
+
+## Known repo deploy targets
+
+- `buenosair/ezrpc`, `buenosair/empstream`, `buenosair/mev` — docker-compose services on
+  `alarm` under `/zdata/root/dockerFiles/`. Typical flow: push branch/merge to main →
+  `ssh alarm` → `git -C /zdata/root/dockerFiles/<dir> pull` (or clone if missing) →
+  `sudo docker compose up -d --build`.
+- Check what's running: `ssh alarm 'sudo docker ps'`.
+
+## Rules
+
+- Never print or commit `$LVMH_GITEA_TOKEN` or the contents of `/root/.ssh/id_ed25519`.
+- Prefer PRs for non-trivial changes; ask in chat before force-pushing or touching main.
+- On deploy hosts, `sudo` is available for this key where needed; use it only for
+  service management (docker/systemctl), not for arbitrary system changes.