thepraandClaude Opus 5.5
5f56681c01
Owner decisions (2026-10-04, recorded in docs/ROADMAP.md): production runs everything that is built, and nothing waits
on a person running a command.
- Geolocation updates itself. GeoUpdater, a hosted service, checks daily whether each DB-IP Lite database was built this
month. If not, it fetches this month's, or last month's early in the month. It installs a file only once it opens as
the right kind of database, then swaps it in atomically, and the locator reloads at once. Lookups now run under the
lock, so a reload can no longer dispose a reader mid-lookup. The systemd timer, its script and their setup.sh lines
are gone: the root step they needed never happened, and none is needed now. /stargazing names the database in use.
- The admin CLI runs after the app is built, with every service and nothing started.
- `create-root <login> [--admin]` takes the password on stdin; it is how the first login is made while sign-up is
closed.
- `smoke <persona>` keeps the root `deploy-smoke` and an undiscoverable persona, and gives the root a new password
on every run.
- The deploy signs in as @thepra. It runs the CLI, gets a token through the real OAuth flow (tools/smoke/oauth.sh,
moved out of the pasture's privapub_token, which now uses it), checks the signed-in API and that @thepra is
undiscoverable, then revokes the token. PRIVAPUB_SMOKE_TOKEN is gone.
- The deploy also fails when:
- NodeInfo and the instance API disagree about registrations;
- /stargazing does not say the crawler is on;
- the geolocation databases are missing or more than 40 days old.
- The crawler is on in production, seeded with ten large servers of different kinds. FEDERATION.md now describes it
and how to opt out.
- One registrations switch (Registrations:Mode, default Invitations; Open in tests and the pasture). It is read by
open sign-up (403 when closed), NodeInfo `openRegistrations`, and v1 and v2 of the instance API, so they can no longer
disagree. Before, NodeInfo said open and the instance API said closed. Group invitations always work, so
invites_enabled is true.
- A persona edit through /clientapi no longer resets what the Mastodon API set (discoverable, locked, quote policy…):
the theme is merged into the settings instead of replacing them.
650 tests pass. The deploy's smoke step was rehearsed against the pasture's PrivaPub.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2
54 lines
2.2 KiB
Bash
Executable File
54 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# One-time root setup on Max for PrivaPub at privapub.thepra.dev. Idempotent.
|
|
# rsync -a -e $MAX/ssh.sh deploy/ root@nuvola.xyz:/root/privapub-deploy/
|
|
# $MAX/run.sh bash /root/privapub-deploy/max/setup.sh
|
|
set -euo pipefail
|
|
SRC="${1:-/root/privapub-deploy}"
|
|
HOST=privapub.thepra.dev
|
|
UNIT=privapub
|
|
RUNNER=build-runner
|
|
ACME=/root/.acme.sh/acme.sh
|
|
|
|
echo "== directories"
|
|
install -d -o "$RUNNER" -g www-data -m 755 /var/www/$HOST
|
|
install -d -o "$RUNNER" -g "$RUNNER" -m 750 /var/backups/$HOST
|
|
install -d -o www-data -g www-data -m 750 /var/lib/privapub /var/lib/privapub/mongo
|
|
|
|
echo "== sudoers"
|
|
SUDOERS=/etc/sudoers.d/$RUNNER
|
|
touch "$SUDOERS"; chmod 440 "$SUDOERS"
|
|
grep -qF "systemctl start $UNIT," "$SUDOERS" || echo "$RUNNER ALL=(root) NOPASSWD: /usr/bin/systemctl start $UNIT, /usr/bin/systemctl stop $UNIT, /usr/bin/systemctl restart $UNIT, /usr/bin/systemctl is-active $UNIT, /usr/bin/systemctl show $UNIT*, /usr/bin/systemctl status $UNIT*" >> "$SUDOERS"
|
|
visudo -cf "$SUDOERS"
|
|
|
|
echo "== units"
|
|
install -m 644 "$SRC/systemd/privapub-mongod.service" /etc/systemd/system/privapub-mongod.service
|
|
install -m 644 "$SRC/systemd/$UNIT.service" /etc/systemd/system/$UNIT.service
|
|
systemctl daemon-reload
|
|
systemctl enable --now privapub-mongod >/dev/null
|
|
systemctl enable $UNIT >/dev/null
|
|
systemctl is-active privapub-mongod
|
|
|
|
echo "== nginx snippet and bootstrap vhost"
|
|
install -m 644 "$SRC/nginx/privapub-headers.conf" /etc/nginx/snippets/privapub-headers.conf
|
|
if [ -f /root/.acme.sh/${HOST}_ecc/fullchain.cer ]; then
|
|
install -m 644 "$SRC/nginx/$HOST.conf" /etc/nginx/sites-available/$HOST.conf
|
|
else
|
|
awk '/^server \{/{n++} n==1' "$SRC/nginx/$HOST.conf" > /etc/nginx/sites-available/$HOST.conf
|
|
fi
|
|
ln -sf /etc/nginx/sites-available/$HOST.conf /etc/nginx/sites-enabled/$HOST.conf
|
|
nginx -t
|
|
systemctl reload nginx
|
|
|
|
echo "== certificate"
|
|
if [ -f /root/.acme.sh/${HOST}_ecc/fullchain.cer ]; then
|
|
echo "$HOST: certificate present"
|
|
else
|
|
$ACME --issue --server letsencrypt -d $HOST -w /var/www/acme --renew-hook "systemctl reload nginx"
|
|
fi
|
|
|
|
echo "== full vhost"
|
|
install -m 644 "$SRC/nginx/$HOST.conf" /etc/nginx/sites-available/$HOST.conf
|
|
nginx -t
|
|
systemctl reload nginx
|
|
echo "setup complete"
|