Everything on, phase 1: geolocation fetches itself, the deploy signs in as @thepra, the crawler is on, sign-up by invitation

Owner decisions (2026-10-04, recorded in docs/ROADMAP.md): production runs everything that is built, and nothing waits
on a person running a command.

- Geolocation updates itself. GeoUpdater, a hosted service, checks daily whether each DB-IP Lite database was built this
  month. If not, it fetches this month's, or last month's early in the month. It installs a file only once it opens as
  the right kind of database, then swaps it in atomically, and the locator reloads at once. Lookups now run under the
  lock, so a reload can no longer dispose a reader mid-lookup. The systemd timer, its script and their setup.sh lines
  are gone: the root step they needed never happened, and none is needed now. /stargazing names the database in use.
- The admin CLI runs after the app is built, with every service and nothing started.
  - `create-root <login> [--admin]` takes the password on stdin; it is how the first login is made while sign-up is
    closed.
  - `smoke <persona>` keeps the root `deploy-smoke` and an undiscoverable persona, and gives the root a new password
    on every run.
- The deploy signs in as @thepra. It runs the CLI, gets a token through the real OAuth flow (tools/smoke/oauth.sh,
  moved out of the pasture's privapub_token, which now uses it), checks the signed-in API and that @thepra is
  undiscoverable, then revokes the token. PRIVAPUB_SMOKE_TOKEN is gone.
- The deploy also fails when:
  - NodeInfo and the instance API disagree about registrations;
  - /stargazing does not say the crawler is on;
  - the geolocation databases are missing or more than 40 days old.
- The crawler is on in production, seeded with ten large servers of different kinds. FEDERATION.md now describes it
  and how to opt out.
- One registrations switch (Registrations:Mode, default Invitations; Open in tests and the pasture). It is read by
  open sign-up (403 when closed), NodeInfo `openRegistrations`, and v1 and v2 of the instance API, so they can no longer
  disagree. Before, NodeInfo said open and the instance API said closed. Group invitations always work, so
  invites_enabled is true.
- A persona edit through /clientapi no longer resets what the Mastodon API set (discoverable, locked, quote policy…):
  the theme is merged into the settings instead of replacing them.

650 tests pass. The deploy's smoke step was rehearsed against the pasture's PrivaPub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2

deploy/max/geo-update.sh

@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-# Fetches the month's DB-IP Lite city and ASN databases (CC BY 4.0, https://db-ip.com) into the directory PrivaPub reads
-# them from (Statistics:GeoDirectory). The app swaps to new files on its own; a failed download leaves the old ones.
-set -euo pipefail
-dir="${GEO_DIR:-/var/lib/privapub/geo}"
-tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT
-this=$(date -u +%Y-%m)
-last=$(date -u -d "$(date -u +%Y-%m-15) -1 month" +%Y-%m)
-for kind in city asn; do
-	got=""
-	for month in "$this" "$last"; do
-		if curl -fsS --max-time 900 -o "$tmp/$kind.gz" "https://download.db-ip.com/free/dbip-$kind-lite-$month.mmdb.gz"; then
-			got=$month; break
-		fi
-	done
-	[ -n "$got" ] || { echo "no $kind database for $this or $last" >&2; exit 1; }
-	gunzip -t "$tmp/$kind.gz"
-	gunzip -c "$tmp/$kind.gz" > "$tmp/dbip-$kind-lite.mmdb"
-	[ "$(stat -c %s "$tmp/dbip-$kind-lite.mmdb")" -gt 1000000 ] || { echo "the $kind database is too small" >&2; exit 1; }
-	install -m 640 "$tmp/dbip-$kind-lite.mmdb" "$dir/.dbip-$kind-lite.mmdb.new"
-	mv -f "$dir/.dbip-$kind-lite.mmdb.new" "$dir/dbip-$kind-lite.mmdb"
-	echo "$kind: DB-IP Lite $got"
-done

deploy/max/setup.sh

@@ -12,7 +12,7 @@ ACME=/root/.acme.sh/acme.sh
 echo "== directories"
 install -d -o "$RUNNER" -g www-data -m 755 /var/www/$HOST
 install -d -o "$RUNNER" -g "$RUNNER" -m 750 /var/backups/$HOST
-install -d -o www-data -g www-data -m 750 /var/lib/privapub /var/lib/privapub/mongo /var/lib/privapub/geo
+install -d -o www-data -g www-data -m 750 /var/lib/privapub /var/lib/privapub/mongo
 
 echo "== sudoers"
 SUDOERS=/etc/sudoers.d/$RUNNER
@@ -23,15 +23,10 @@ visudo -cf "$SUDOERS"
 echo "== units"
 install -m 644 "$SRC/systemd/privapub-mongod.service" /etc/systemd/system/privapub-mongod.service
 install -m 644 "$SRC/systemd/$UNIT.service" /etc/systemd/system/$UNIT.service
-install -m 755 "$SRC/max/geo-update.sh" /usr/local/bin/privapub-geo-update
-install -m 644 "$SRC/systemd/privapub-geo.service" /etc/systemd/system/privapub-geo.service
-install -m 644 "$SRC/systemd/privapub-geo.timer" /etc/systemd/system/privapub-geo.timer
 systemctl daemon-reload
 systemctl enable --now privapub-mongod >/dev/null
 systemctl enable $UNIT >/dev/null
-systemctl enable --now privapub-geo.timer >/dev/null
 systemctl is-active privapub-mongod
-[ -f /var/lib/privapub/geo/dbip-city-lite.mmdb ] || systemctl start privapub-geo.service || echo "geolocation databases not fetched yet; the timer retries"
 
 echo "== nginx snippet and bootstrap vhost"
 install -m 644 "$SRC/nginx/privapub-headers.conf" /etc/nginx/snippets/privapub-headers.conf

deploy/systemd/privapub-geo.service

@@ -1,15 +0,0 @@
-[Unit]
-Description=PrivaPub: fetch the DB-IP Lite geolocation databases
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=oneshot
-User=www-data
-Group=www-data
-ExecStart=/usr/local/bin/privapub-geo-update
-NoNewPrivileges=true
-ProtectSystem=strict
-ProtectHome=true
-PrivateTmp=true
-ReadWritePaths=/var/lib/privapub/geo

deploy/systemd/privapub-geo.timer

@@ -1,10 +0,0 @@
-[Unit]
-Description=PrivaPub: refresh the geolocation databases monthly
-
-[Timer]
-OnCalendar=*-*-03 04:00:00
-RandomizedDelaySec=6h
-Persistent=true
-
-[Install]
-WantedBy=timers.target