Everything on, phase 1: geolocation fetches itself, the deploy signs in as @thepra, the crawler is on, sign-up by invitation

Owner decisions (2026-10-04, recorded in docs/ROADMAP.md): production runs everything that is built, and nothing waits
on a person running a command.

- Geolocation updates itself. GeoUpdater, a hosted service, checks daily whether each DB-IP Lite database was built this
  month. If not, it fetches this month's, or last month's early in the month. It installs a file only once it opens as
  the right kind of database, then swaps it in atomically, and the locator reloads at once. Lookups now run under the
  lock, so a reload can no longer dispose a reader mid-lookup. The systemd timer, its script and their setup.sh lines
  are gone: the root step they needed never happened, and none is needed now. /stargazing names the database in use.
- The admin CLI runs after the app is built, with every service and nothing started.
  - `create-root <login> [--admin]` takes the password on stdin; it is how the first login is made while sign-up is
    closed.
  - `smoke <persona>` keeps the root `deploy-smoke` and an undiscoverable persona, and gives the root a new password
    on every run.
- The deploy signs in as @thepra. It runs the CLI, gets a token through the real OAuth flow (tools/smoke/oauth.sh,
  moved out of the pasture's privapub_token, which now uses it), checks the signed-in API and that @thepra is
  undiscoverable, then revokes the token. PRIVAPUB_SMOKE_TOKEN is gone.
- The deploy also fails when:
  - NodeInfo and the instance API disagree about registrations;
  - /stargazing does not say the crawler is on;
  - the geolocation databases are missing or more than 40 days old.
- The crawler is on in production, seeded with ten large servers of different kinds. FEDERATION.md now describes it
  and how to opt out.
- One registrations switch (Registrations:Mode, default Invitations; Open in tests and the pasture). It is read by
  open sign-up (403 when closed), NodeInfo `openRegistrations`, and v1 and v2 of the instance API, so they can no longer
  disagree. Before, NodeInfo said open and the instance API said closed. Group invitations always work, so
  invites_enabled is true.
- A persona edit through /clientapi no longer resets what the Mastodon API set (discoverable, locked, quote policy…):
  the theme is merged into the settings instead of replacing them.

650 tests pass. The deploy's smoke step was rehearsed against the pasture's PrivaPub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2

PrivaPub.Tests/Infrastructure/AdminCommandsTests.cs

@@ -1,3 +1,5 @@
+using Microsoft.Extensions.DependencyInjection;
+
 using MongoDB.Entities;
 
 using PrivaPub.ClientModels;
@@ -37,8 +39,8 @@ namespace PrivaPub.Tests.Infrastructure
 		{
 			var root = await _host.SignUp("promote");
 
-			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName.ToUpperInvariant() }));
-			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName }));
+			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName.ToUpperInvariant() }, _host.Services));
+			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName }, _host.Services));
 
 			Assert.Equal(new[] { Policies.IsAdmin, Policies.IsModerator, Policies.IsUser }.Order(), await StoredPolicies(root));
 		}
@@ -47,10 +49,10 @@ namespace PrivaPub.Tests.Infrastructure
 		public async Task Demote_leaves_a_plain_user()
 		{
 			var root = await _host.SignUp("demote");
-			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName }));
+			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName }, _host.Services));
 
-			Assert.Equal(0, await AdminCommands.Run(new[] { "demote", root.UserName }));
-			Assert.Equal(0, await AdminCommands.Run(new[] { "demote", root.UserName }));
+			Assert.Equal(0, await AdminCommands.Run(new[] { "demote", root.UserName }, _host.Services));
+			Assert.Equal(0, await AdminCommands.Run(new[] { "demote", root.UserName }, _host.Services));
 
 			Assert.Equal(new[] { Policies.IsUser }, await StoredPolicies(root));
 		}
@@ -58,8 +60,8 @@ namespace PrivaPub.Tests.Infrastructure
 		[Fact]
 		public async Task An_unknown_root_exits_1()
 		{
-			Assert.Equal(1, await AdminCommands.Run(new[] { "promote", $"nobody{Guid.NewGuid():N}" }));
-			Assert.Equal(1, await AdminCommands.Run(new[] { "demote", $"nobody{Guid.NewGuid():N}" }));
+			Assert.Equal(1, await AdminCommands.Run(new[] { "promote", $"nobody{Guid.NewGuid():N}" }, _host.Services));
+			Assert.Equal(1, await AdminCommands.Run(new[] { "demote", $"nobody{Guid.NewGuid():N}" }, _host.Services));
 		}
 
 		public static TheoryData<string[]> Misuses() => new()
@@ -75,7 +77,7 @@ namespace PrivaPub.Tests.Infrastructure
 		[MemberData(nameof(Misuses))]
 		public async Task Misuse_exits_2(string[] args)
 		{
-			Assert.Equal(2, await AdminCommands.Run(args));
+			Assert.Equal(2, await AdminCommands.Run(args, _host.Services));
 		}
 
 		[Fact]
@@ -84,7 +86,7 @@ namespace PrivaPub.Tests.Infrastructure
 			var root = await _host.SignUp("policies");
 			Assert.Equal(HttpStatusCode.Forbidden, await AdminRoute(root));
 
-			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName }));
+			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName }, _host.Services));
 			Assert.Equal(HttpStatusCode.OK, await AdminRoute(root));
 			using (var client = _host.As(root.Jwt))
 			{
@@ -92,8 +94,54 @@ namespace PrivaPub.Tests.Infrastructure
 				Assert.Contains(Policies.IsAdmin, refreshed["policies"]!.AsArray().Select(p => p!.GetValue<string>()));
 			}
 
-			Assert.Equal(0, await AdminCommands.Run(new[] { "demote", root.UserName }));
+			Assert.Equal(0, await AdminCommands.Run(new[] { "demote", root.UserName }, _host.Services));
 			Assert.Equal(HttpStatusCode.Forbidden, await AdminRoute(root));
 		}
+
+		async Task<HttpStatusCode> LogIn(string login, string password)
+		{
+			using var client = _host.Client();
+			return (await client.PostJson("/clientapi/user/login", new { userName = login, password })).StatusCode;
+		}
+
+		[Fact]
+		public async Task Create_root_makes_a_login_from_a_password_on_standard_input()
+		{
+			using var scope = _host.Services.CreateScope();
+			var login = $"made{Guid.NewGuid():N}"[..20];
+			var output = new StringWriter();
+
+			Assert.Equal(0, await AdminCommands.Run(new[] { "create-root", login, "--admin" }, scope.ServiceProvider, new StringReader("Typed-On-Stdin-1\n"), output));
+			Assert.Equal(1, await AdminCommands.Run(new[] { "create-root", login }, scope.ServiceProvider, new StringReader("Typed-On-Stdin-2\n"), new StringWriter()));
+			Assert.Equal(1, await AdminCommands.Run(new[] { "create-root", $"weak{Guid.NewGuid():N}"[..20] }, scope.ServiceProvider, new StringReader("short\n"), new StringWriter()));
+			Assert.Equal(2, await AdminCommands.Run(new[] { "create-root", login, "--root" }, scope.ServiceProvider, new StringReader("Typed-On-Stdin-3\n"), new StringWriter()));
+
+			Assert.Equal(HttpStatusCode.OK, await LogIn(login, "Typed-On-Stdin-1"));
+			var stored = await DB.Default.Find<RootUser>().Match(u => u.UserName == login).ExecuteFirstAsync(TestContext.Current.CancellationToken);
+			Assert.Contains(Policies.IsAdmin, stored.Policies);
+		}
+
+		[Fact]
+		public async Task Smoke_keeps_one_undiscoverable_persona_and_a_new_password_each_run()
+		{
+			using var scope = _host.Services.CreateScope();
+			var persona = $"smoke{Guid.NewGuid():N}"[..20];
+			var first = new StringWriter();
+			var second = new StringWriter();
+
+			Assert.Equal(0, await AdminCommands.Run(new[] { "smoke", persona }, scope.ServiceProvider, output: first));
+			Assert.Equal(0, await AdminCommands.Run(new[] { "smoke", persona }, scope.ServiceProvider, output: second));
+
+			var (login, oldPassword) = (first.ToString().Trim().Split(' ')[0], first.ToString().Trim().Split(' ')[1]);
+			var newPassword = second.ToString().Trim().Split(' ')[1];
+			Assert.Equal(AdminCommands.SmokeLogin, login);
+			Assert.NotEqual(oldPassword, newPassword);
+			Assert.Equal(HttpStatusCode.OK, await LogIn(login, newPassword));
+			Assert.NotEqual(HttpStatusCode.OK, await LogIn(login, oldPassword));
+			var avatars = await DB.Default.Find<Avatar>().Match(a => a.UserName == persona).ExecuteAsync(TestContext.Current.CancellationToken);
+			var avatar = Assert.Single(avatars);
+			Assert.False(avatar.Settings.IsDiscoverable);
+			Assert.False(avatar.Settings.IsIndexable);
+		}
 	}
 }