From 2b72242eb6b8e921e78f8bf223dc7a203d700c77 Mon Sep 17 00:00:00 2001 From: defiQUG Date: Wed, 1 Jul 2026 10:12:27 -0700 Subject: [PATCH] refactor(omnl-portal): retire Ali naming in docs and LXC sync path Redirect legacy ALI_* docs to Zardasht canonical workflow, delegate sync-ali to proxmox zardasht:banking-portal:sync, and align host config with /srv/zardasht-portal deploy root. Co-authored-by: Cursor --- config/omnl-banking-portal-host.v1.json | 2 +- .../ALI_GITEA_TWO_REPO_WORKFLOW.md | 103 +--------------- ...ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md | 71 +---------- .../FORGE_CANONICAL_REGISTRY.md | 22 ++-- .../ZARDASHT_GITEA_TWO_REPO_WORKFLOW.md | 110 ++++++++++++++++++ .../deployment/activate-omnl-production.sh | 1 + .../sync-ali-omnl-banking-portal-lxcs.sh | 82 +------------ 7 files changed, 137 insertions(+), 254 deletions(-) create mode 100644 docs/04-configuration/ZARDASHT_GITEA_TWO_REPO_WORKFLOW.md diff --git a/config/omnl-banking-portal-host.v1.json b/config/omnl-banking-portal-host.v1.json index 9e31ae7..db3c978 100644 --- a/config/omnl-banking-portal-host.v1.json +++ b/config/omnl-banking-portal-host.v1.json @@ -36,7 +36,7 @@ "refreshCommand": "pnpm zardasht:hospitallers:handoff", "verifyCommand": "pnpm zardasht:hospitallers:verify-external", "onboardingDoc": "docs/04-configuration/ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md", - "workflowDoc": "docs/04-configuration/ALI_GITEA_TWO_REPO_WORKFLOW.md", + "workflowDoc": "docs/04-configuration/ZARDASHT_GITEA_TWO_REPO_WORKFLOW.md", "forgeRegistry": "docs/04-configuration/FORGE_CANONICAL_REGISTRY.md" }, "gitea": { diff --git a/docs/04-configuration/ALI_GITEA_TWO_REPO_WORKFLOW.md b/docs/04-configuration/ALI_GITEA_TWO_REPO_WORKFLOW.md index ad95d0d..d426677 100644 --- a/docs/04-configuration/ALI_GITEA_TWO_REPO_WORKFLOW.md +++ b/docs/04-configuration/ALI_GITEA_TWO_REPO_WORKFLOW.md @@ -1,102 +1,7 @@ -# Ali — two-repo Gitea workflow +# Moved -Canonical layout per [FORGE_CANONICAL_REGISTRY.md](./FORGE_CANONICAL_REGISTRY.md). +This document was renamed. -## 1. Cursor Remote-SSH +**Canonical:** [ZARDASHT_GITEA_TWO_REPO_WORKFLOW.md](./ZARDASHT_GITEA_TWO_REPO_WORKFLOW.md) -Connect to **`dev-bis-ali`** → open **`/srv/projects/proxmox`** for ops docs and orchestration scripts. - -## 2. Edit banking app code - -Primary workspace: **`~/smom-dbis-138`** - -```bash -cd ~/smom-dbis-138 -git pull origin main -# edit frontend-dapp/, services/, config/, etc. -``` - -## 3. Build and run on dev VM (`.59`) - -```bash -cd ~/smom-dbis-138 -git pull origin main -bash scripts/deployment/deploy-omnl-bank-production.sh -bash scripts/deployment/deploy-omnl-domains.sh # dev nginx only -``` - -Health checks: - -```bash -curl -sf http://127.0.0.1:3011/api/v1/settlement/health | head -c 120 -curl -sf http://127.0.0.1:3012/api/v1/exchange/health | head -c 120 -curl -s -o /dev/null -w 'frontend=%{http_code}\n' http://127.0.0.1:3002/central-bank -``` - -## 4. Push to Gitea - -```bash -cd ~/smom-dbis-138 -git add -A -git commit -m "feat: your change" -git push origin main -``` - -Remote: `https://gitea.d-bis.org/d-bis/smom-dbis-138.git` -Branch: **`main`** - -## 5. Production banking LXCs (5820–5828) - -First-time / after SSH config changes on dev-bis-ali: - -```bash -bash scripts/deployment/setup-dev1-pve-ssh-access.sh -``` - -Operator sync from LAN (dev-bis-ali or Proxmox host with `pct`): - -```bash -cd ~/smom-dbis-138 -git pull origin main - -# dry-run (default) -bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh - -# deploy all nine LXCs -bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh --apply -``` - -Single LXC: - -```bash -export OMNL_PCT_CTID=5825 -bash scripts/deployment/deploy-omnl-banking-portal-pct.sh -``` - -## Env / secrets - -| File | Contents | -|------|----------| -| `/srv/projects/proxmox/.env` | Proxmox, NPM, Cloudflare, Gitea tokens | -| `~/smom-dbis-138/.env` | `PRIVATE_KEY`, `RPC_URL_138`, `OMNL_API_KEY`, deploy keys | - -Both: `chmod 600` - -## Verify public endpoints - -From operator machine: - -```bash -pnpm ali:hospitallers:verify-external -``` - -Expected: **14/14** public endpoints passing (9 portal FQDNs + API health routes). - -## Summary - -| Layer | Repo | Deploy target | -|-------|------|---------------| -| Banking app | `smom-dbis-138` | `~/smom-dbis-138` (dev) → `/srv/ali-portal` (each LXC) | -| Ops / edge | `proxmox` | NPMplus, DNS, LXC map | - -One monorepo, nine public URLs, same stack on every banking LXC. +Legacy `ALI_*` filenames are retired — display name is **Zardasht** only. diff --git a/docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md b/docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md index 72a491e..65eadda 100644 --- a/docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md +++ b/docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md @@ -1,70 +1,7 @@ -# Ali Zardasht — Remote operator onboarding (Cursor → dev VM `.59`) +# Moved -Verified path: `pnpm ali:hospitallers:verify-external` → **PASS** +This document was renamed. -Mirrored in **proxmox** repo: `docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md` +**Canonical (proxmox repo):** [ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md](https://gitea.d-bis.org/d-bis/proxmox/src/branch/master/docs/04-configuration/ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md) -## Path diagram - -``` -Ali laptop (Cursor) - → cloudflared + CF service token - → ssh-dev.d-bis.org - → Cloudflare Tunnel - → 192.168.11.59:22 (dev1@5700) - → full LAN (Proxmox 192.168.11.13, RPC, banking LXCs 5820–5828) -``` - -| Item | Value | -|------|--------| -| SSH alias | `dev-bis-ali` | -| Public hostname | `ssh-dev.d-bis.org` | -| LAN IP | `192.168.11.59` | -| User | `dev1` (NOPASSWD sudo) | -| Cursor workspace | `/srv/projects/proxmox` | -| Banking app repo | `~/smom-dbis-138` → Gitea `d-bis/smom-dbis-138` | -| Proxmox host | `root@192.168.11.13` | -| Banking LXC CTIDs | `5820`–`5828` | -| Banking deploy root (each LXC) | `/srv/ali-portal` → app `:3000` | - -## Handoff bundle (Signal / 1Password) - -| File | Purpose | -|------|---------| -| `reports/secrets/ali-hospitallers-ed25519` | SSH private key | -| `reports/secrets/ali-hospitallers-dotenv-handoff.env` | CF, Proxmox, NPM, Gitea | -| `reports/secrets/ali-hospitallers-access-handoff.md` | SSH config snippet | -| `reports/secrets/ali-gitea-credentials.env` | Gitea user `ali` | - -Refresh: `pnpm ali:hospitallers:handoff` - -## Two-repo layout (Gitea) - -See [FORGE_CANONICAL_REGISTRY.md](./FORGE_CANONICAL_REGISTRY.md) and [ALI_GITEA_TWO_REPO_WORKFLOW.md](./ALI_GITEA_TWO_REPO_WORKFLOW.md). - -## Quick verify (from `.59`) - -```bash -curl -s -o /dev/null -w '%{http_code}\n' http://192.168.11.211:8545 # expect 405 -ssh -o ProxyJump=none root@192.168.11.13 'pct exec 5825 -- ls /srv/ali-portal' -# Or from dev-bis-ali when dev1 key is not on PVE: -sudo ssh -o ProxyJump=none root@192.168.11.13 'pct exec 5825 -- ls /srv/ali-portal' -``` - -## Deploy OMNL to banking LXCs - -All nine LXCs: - -```bash -cd ~/smom-dbis-138 && git pull origin main -bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh --apply -``` - -Single LXC: - -```bash -export OMNL_PCT_CTID=5825 -bash ~/smom-dbis-138/scripts/deployment/deploy-omnl-banking-portal-pct.sh -``` - -See `config/omnl-banking-portal-host.v1.json` for topology. +Legacy filename `ALI_ZARDASHT_*` is retired — display name is **Zardasht** only. diff --git a/docs/04-configuration/FORGE_CANONICAL_REGISTRY.md b/docs/04-configuration/FORGE_CANONICAL_REGISTRY.md index fdf7c7d..b274743 100644 --- a/docs/04-configuration/FORGE_CANONICAL_REGISTRY.md +++ b/docs/04-configuration/FORGE_CANONICAL_REGISTRY.md @@ -1,11 +1,11 @@ # Forge canonical registry — Gitea `d-bis` -Single source of truth for which repositories Ali and operators use. **Do not** treat GitHub mirrors or ad-hoc “banking portal” repos as canonical. +Single source of truth for which repositories Zardasht and operators use. **Do not** treat GitHub mirrors or ad-hoc “banking portal” repos as canonical. ## Canonical repositories -| Repo | Gitea remote | Path on `dev-bis-ali` | Role | -|------|--------------|------------------------|------| +| Repo | Gitea remote | Path on `dev-bis-zardasht` | Role | +|------|--------------|----------------------------|------| | **`proxmox`** | `https://gitea.d-bis.org/d-bis/proxmox.git` | `/srv/projects/proxmox` | Operator / orchestration — manifests, LXC map, NPM, deploy orchestration | | **`smom-dbis-138`** | `https://gitea.d-bis.org/d-bis/smom-dbis-138.git` | `~/smom-dbis-138` | **Banking app source of truth** — all OMNL portal code | @@ -15,8 +15,8 @@ Optional: `proxmox` may vendor `smom-dbis-138` as a git submodule at `proxmox/sm | Repo | Branch | Notes | |------|--------|-------| -| `smom-dbis-138` | `main` | Production banking stack (commit `33e9316`+ verified on dev) | -| `proxmox` | `main` | Operator scripts, LXC sync, infra docs | +| `smom-dbis-138` | `main` | Production banking stack | +| `proxmox` | `master` | Operator scripts, LXC sync, infra docs | ## What lives where @@ -38,7 +38,7 @@ smom-dbis-138/ ├── deploy-omnl-bank-production.sh ├── deploy-omnl-domains.sh ├── deploy-omnl-banking-portal-pct.sh - ├── sync-ali-omnl-banking-portal-lxcs.sh + ├── sync-ali-omnl-banking-portal-lxcs.sh # deprecated → proxmox zardasht:banking-portal:sync └── start-omnl-banking-portal.sh ``` @@ -47,20 +47,20 @@ smom-dbis-138/ - LXC CTID map (5820–5828) - NPMplus proxy hosts (9 public FQDNs → LAN) - Cloudflare / DNS runbooks -- `pnpm ali:hospitallers:handoff`, `pnpm ali:hospitallers:verify-external` +- `pnpm zardasht:hospitallers:handoff`, `pnpm zardasht:banking-portal:sync`, `pnpm zardasht:dev-banking:tunnel` ## Public surface -Nine FQDNs (see `config/omnl-production-domains.v1.json`) — **one stack**, deployed to each banking LXC at `/srv/ali-portal`. No per-FQDN git repos. +Nine FQDNs (see `config/omnl-production-domains.v1.json`) — **one stack**, deployed to each banking LXC at `/srv/zardasht-portal` (legacy `/srv/ali-portal` symlink). No per-FQDN git repos. ## Credentials -- Gitea user: **`ali`** — `ali-gitea-credentials.env` (handoff bundle) +- Gitea user: **`ali`** (legacy technical id; display name **Zardasht**) - Env split: - `proxmox/.env` — Proxmox, NPM, Cloudflare, Gitea tokens - `smom-dbis-138/.env` — `PRIVATE_KEY`, `RPC_URL_138`, OMNL API keys ## Related docs -- [ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md](./ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md) -- [ALI_GITEA_TWO_REPO_WORKFLOW.md](./ALI_GITEA_TWO_REPO_WORKFLOW.md) +- [ZARDASHT_GITEA_TWO_REPO_WORKFLOW.md](./ZARDASHT_GITEA_TWO_REPO_WORKFLOW.md) +- Proxmox: `docs/04-configuration/ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md` diff --git a/docs/04-configuration/ZARDASHT_GITEA_TWO_REPO_WORKFLOW.md b/docs/04-configuration/ZARDASHT_GITEA_TWO_REPO_WORKFLOW.md new file mode 100644 index 0000000..3df9f86 --- /dev/null +++ b/docs/04-configuration/ZARDASHT_GITEA_TWO_REPO_WORKFLOW.md @@ -0,0 +1,110 @@ +# Zardasht — two-repo Gitea workflow + +Canonical layout per [FORGE_CANONICAL_REGISTRY.md](./FORGE_CANONICAL_REGISTRY.md). + +## 1. Cursor Remote-SSH + +Connect to **`dev-bis-zardasht`** → open **`/srv/projects/proxmox`** for ops docs and orchestration scripts. + +## 2. Edit banking app code + +Primary workspace: **`~/smom-dbis-138`** + +```bash +cd ~/smom-dbis-138 +git pull origin main +# edit frontend-dapp/, services/, config/, etc. +``` + +## 3. Build and run on dev VM (`.59`) + +```bash +cd ~/smom-dbis-138 +git pull origin main +bash scripts/deployment/deploy-omnl-bank-production.sh +bash scripts/deployment/deploy-omnl-domains.sh # dev nginx only +``` + +Health checks: + +```bash +curl -sf http://127.0.0.1:3011/api/v1/settlement/health | head -c 120 +curl -sf http://127.0.0.1:3012/api/v1/exchange/health | head -c 120 +curl -s -o /dev/null -w 'frontend=%{http_code}\n' http://127.0.0.1:3002/hub +``` + +Named dev tunnel (optional, from proxmox repo): + +```bash +cd /srv/projects/proxmox +pnpm zardasht:dev-banking:tunnel +pnpm zardasht:dev-banking:verify # https://banking-dev.d-bis.org/hub +``` + +## 4. Push to Gitea + +```bash +cd ~/smom-dbis-138 +git add -A +git commit -m "feat: your change" +git push origin main +``` + +Remote: `https://gitea.d-bis.org/d-bis/smom-dbis-138.git` +Branch: **`main`** + +## 5. Production banking LXCs (5820–5828) + +First-time / after SSH config changes on dev-bis-zardasht: + +```bash +bash scripts/deployment/setup-dev1-pve-ssh-access.sh +``` + +Operator sync from LAN (dev VM or Proxmox host with `pct`): + +```bash +cd /srv/projects/proxmox +git pull origin master +pnpm zardasht:banking-portal:sync +``` + +Dry-run: + +```bash +pnpm zardasht:banking-portal:sync:dry-run +``` + +Single LXC (legacy pct path): + +```bash +export OMNL_PCT_CTID=5825 +bash scripts/deployment/deploy-omnl-banking-portal-pct.sh +``` + +## Env / secrets + +| File | Contents | +|------|----------| +| `/srv/projects/proxmox/.env` | Proxmox, NPM, Cloudflare, Gitea tokens | +| `~/smom-dbis-138/.env` | `PRIVATE_KEY`, `RPC_URL_138`, `OMNL_API_KEY`, deploy keys | + +Both: `chmod 600` + +## Verify public endpoints + +From operator machine: + +```bash +pnpm zardasht:hospitallers:verify-external +pnpm zardasht:banking-portal:e2e +``` + +## Summary + +| Layer | Repo | Deploy target | +|-------|------|---------------| +| Banking app | `smom-dbis-138` | `~/smom-dbis-138` (dev) → `/srv/zardasht-portal` (each LXC; legacy `/srv/ali-portal` symlink) | +| Ops / edge | `proxmox` | NPMplus, DNS, LXC map, named dev tunnel | + +One monorepo, nine public URLs, same stack on every banking LXC. diff --git a/scripts/deployment/activate-omnl-production.sh b/scripts/deployment/activate-omnl-production.sh index 463cf33..d1eadab 100644 --- a/scripts/deployment/activate-omnl-production.sh +++ b/scripts/deployment/activate-omnl-production.sh @@ -22,6 +22,7 @@ bash scripts/deployment/deploy-omnl-domains.sh log "=== 3/5 Sync banking portal LXCs (5825-5828) ===" bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh --apply +# Prefer from proxmox: pnpm zardasht:banking-portal:sync log "=== 4/5 Push Fineract/API env to each LXC ===" if [[ -f "$ENV_FILE" ]]; then diff --git a/scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh b/scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh index 22f3d00..799ccad 100755 --- a/scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh +++ b/scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh @@ -1,79 +1,9 @@ #!/usr/bin/env bash -# Sync OMNL banking portal to banking LXCs via Proxmox pct. +# DEPRECATED — delegates to proxmox zardasht sync (canonical LXC deploy path). set -euo pipefail - -REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}" -DEPLOY_SCRIPT="${REPO_DIR}/scripts/deployment/deploy-omnl-banking-portal-pct.sh" -LXC_CONFIG="${OMNL_BANKING_LXC_CONFIG:-$REPO_DIR/config/omnl-banking-portal-lxcs.v1.json}" -APPLY=false - -if [[ "${1:-}" == "--apply" ]]; then - APPLY=true -fi - -log() { echo "[$(date -Iseconds)] $*"; } - -if [[ ! -f "$DEPLOY_SCRIPT" ]]; then - echo "Missing deploy script: $DEPLOY_SCRIPT" >&2 - exit 1 -fi - -read_ctids() { - if [[ -n "${OMNL_BANKING_LXC_CTIDS:-}" ]]; then - # shellcheck disable=SC2206 - CTIDS=(${OMNL_BANKING_LXC_CTIDS}) - return - fi - if command -v node >/dev/null 2>&1 && [[ -f "$LXC_CONFIG" ]]; then - mapfile -t CTIDS < <(node -e " - const c=require(process.argv[1]); - for (const x of c.containers||[]) console.log(x.ctid); - " "$LXC_CONFIG") - return - fi - CTIDS=(5825 5826 5827 5828) -} - -read_ctids - -# shellcheck source=lib/omnl-pve-ssh.sh -source "${REPO_DIR}/scripts/deployment/lib/omnl-pve-ssh.sh" -omnl_pve_preflight - -log "OMNL banking LXC sync — CTIDs: ${CTIDS[*]}" -log "Mode: $(if $APPLY; then echo APPLY; else echo DRY-RUN; fi)" -log "Repo: $REPO_DIR" -log "Config: $LXC_CONFIG" -log "PVE: ${OMNL_PVE_SSH_TARGET} (sudo prefix: ${OMNL_PVE_SSH_PREFIX[*]:-none})" - -if $APPLY; then - log "Using stack built in step 1 — skip duplicate full deploy" - export OMNL_SKIP_BUILD=1 -fi - -synced=0 -skipped=0 -for CTID in "${CTIDS[@]}"; do - if $APPLY; then - log "Deploying CT $CTID..." - set +e - OMNL_SKIP_BUILD=1 OMNL_PCT_CTID="$CTID" OMNL_BANK_ROOT="$REPO_DIR" bash "$DEPLOY_SCRIPT" - rc=$? - set -e - if [[ $rc -eq 0 ]]; then - synced=$((synced + 1)) - elif [[ $rc -eq 2 ]]; then - skipped=$((skipped + 1)) - else - log "WARN: deploy failed for CT $CTID (exit $rc, continuing)" - fi - else - log "Would deploy CT $CTID → /srv/ali-portal (pct exec on ${OMNL_PVE_SSH_TARGET})" - fi -done - -if $APPLY; then - log "Synced ${synced}/${#CTIDS[@]} banking LXCs (${skipped} skipped)." -else - log "Dry-run complete. Re-run with --apply to deploy." +echo "DEPRECATED: sync-ali-omnl-banking-portal-lxcs.sh — use pnpm zardasht:banking-portal:sync from proxmox repo" >&2 +PROXMOX_ROOT="${PROXMOX_ROOT:-/srv/projects/proxmox}" +if [[ ! -f "${PROXMOX_ROOT}/scripts/deployment/sync-zardasht-omnl-banking-portal-lxcs.sh" ]]; then + PROXMOX_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)" fi +exec bash "${PROXMOX_ROOT}/scripts/deployment/sync-zardasht-omnl-banking-portal-lxcs.sh" "$@"