fix: PVE LXC sync via sudo SSH and single build pass

Use sudo ssh with ProxyJump=none from dev-bis-ali to Proxmox, build once before syncing all nine banking LXCs, and track deploy scripts as executable.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/04-configuration/ALI_GITEA_TWO_REPO_WORKFLOW.md

@@ -47,6 +47,12 @@ Branch: **`main`**
 
 ## 5. Production banking LXCs (5820–5828)
 
+First-time / after SSH config changes on dev-bis-ali:
+
+```bash
+bash scripts/deployment/setup-dev1-pve-ssh-access.sh
+```
+
 Operator sync from LAN (dev-bis-ali or Proxmox host with `pct`):
 
 ```bash

docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md

@@ -46,7 +46,9 @@ See [FORGE_CANONICAL_REGISTRY.md](./FORGE_CANONICAL_REGISTRY.md) and [ALI_GITEA_
 
 ```bash
 curl -s -o /dev/null -w '%{http_code}\n' http://192.168.11.211:8545   # expect 405
-ssh root@192.168.11.13 'pct exec 5825 -- ls /srv/ali-portal'
+ssh -o ProxyJump=none root@192.168.11.13 'pct exec 5825 -- ls /srv/ali-portal'
+# Or from dev-bis-ali when dev1 key is not on PVE:
+sudo ssh -o ProxyJump=none root@192.168.11.13 'pct exec 5825 -- ls /srv/ali-portal'
 ```
 
 ## Deploy OMNL to banking LXCs

scripts/deployment/deploy-omnl-banking-portal-pct.sh

@@ -1,22 +1,13 @@
 #!/usr/bin/env bash
 # Deploy OMNL banking portal into Proxmox LXC via pct.
-#
-# Topology:
-#   ~/home/projects/exchange/  (dev tree inside CT)
-#   /srv/ali-portal/  (production root inside banking LXC 5820–5828)
-#
-# Usage (from dev-bis-ali or Proxmox host):
-#   export OMNL_PCT_CTID=XXXX
-#   bash scripts/deployment/deploy-omnl-banking-portal-pct.sh
-#
-# Requires: root SSH to PVE host, pct, built repo at OMNL_BANK_ROOT
-
 set -euo pipefail
 
-PVE_HOST="${OMNL_PVE_HOST:-192.168.11.13}"
-PVE_USER="${OMNL_PVE_USER:-root}"
-CTID="${OMNL_PCT_CTID:-5825}"
 REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/omnl-pve-ssh.sh
+source "${SCRIPT_DIR}/lib/omnl-pve-ssh.sh"
+
+CTID="${OMNL_PCT_CTID:-5825}"
 PORTAL_ROOT="${OMNL_PORTAL_ROOT:-/srv/ali-portal}"
 PROJECT_SRC="${OMNL_PROJECT_SRC:-/home/projects/exchange}"
 STAGE="/tmp/omnl-banking-portal-$(date +%Y%m%d%H%M%S).tar.gz"
@@ -24,18 +15,25 @@ STAGE="/tmp/omnl-banking-portal-$(date +%Y%m%d%H%M%S).tar.gz"
 log() { echo "[$(date -Iseconds)] $*"; }
 
 pct_exec() {
-  ssh -o BatchMode=yes "${PVE_USER}@${PVE_HOST}" "pct exec ${CTID} -- $*"
+  omnl_pve_ssh "pct exec ${CTID} -- $*"
 }
 
 pve_exec() {
-  ssh -o BatchMode=yes "${PVE_USER}@${PVE_HOST}" "$*"
+  omnl_pve_ssh "$*"
 }
 
-log "Building OMNL stack at $REPO_DIR..."
-cd "$REPO_DIR"
-bash scripts/deployment/deploy-omnl-bank-production.sh
+omnl_pve_preflight
 
-log "Staging bundle..."
+if [[ "${OMNL_SKIP_BUILD:-0}" != "1" ]]; then
+  log "Building OMNL stack at $REPO_DIR..."
+  cd "$REPO_DIR"
+  bash scripts/deployment/deploy-omnl-bank-production.sh
+else
+  log "Skipping build (OMNL_SKIP_BUILD=1) — using existing dist/ artifacts"
+  cd "$REPO_DIR"
+fi
+
+log "Staging bundle for CT ${CTID}..."
 tar -czf "$STAGE" \
   -C "$REPO_DIR" \
   config \
@@ -53,8 +51,8 @@ tar -czf "$STAGE" \
   services/dbis-exchange/package-lock.json \
   scripts/deployment/start-omnl-banking-portal.sh
 
-log "Push to PVE host $PVE_HOST..."
-scp -o BatchMode=yes "$STAGE" "${PVE_USER}@${PVE_HOST}:/tmp/omnl-portal.tar.gz"
+log "Push to PVE host ${OMNL_PVE_SSH_TARGET}..."
+omnl_pve_scp "$STAGE" "${OMNL_PVE_SSH_TARGET}:/tmp/omnl-portal.tar.gz"
 rm -f "$STAGE"
 
 log "Install into CT $CTID at $PORTAL_ROOT..."
@@ -67,5 +65,4 @@ pct_exec "chmod +x ${PORTAL_ROOT}/scripts/deployment/start-omnl-banking-portal.s
 log "Start services inside CT..."
 pct_exec "bash ${PORTAL_ROOT}/scripts/deployment/start-omnl-banking-portal.sh"
 
-log "Done — portal root: ${PORTAL_ROOT} (CT ${CTID} on ${PVE_HOST})"
-log "Point NPMplus / public DNS to ${PVE_HOST} frontend :3002"
+log "Done — portal root: ${PORTAL_ROOT} (CT ${CTID} on ${OMNL_PVE_SSH_TARGET})"

scripts/deployment/lib/omnl-pve-ssh.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Shared SSH/SCP helpers for Proxmox pct deploy from dev-bis-ali (LAN).
+set -euo pipefail
+
+OMNL_PVE_HOST="${OMNL_PVE_HOST:-192.168.11.13}"
+OMNL_PVE_USER="${OMNL_PVE_USER:-root}"
+OMNL_PVE_SSH_HOST="${OMNL_PVE_SSH_HOST:-${OMNL_PVE_HOST}}"
+OMNL_PVE_SSH_TARGET="${OMNL_PVE_USER}@${OMNL_PVE_SSH_HOST}"
+
+# Avoid cloudflared ProxyJump when using raw 192.168.11.x from dev-bis-ali.
+OMNL_PVE_SSH_BASE_OPTS=(
+  -o BatchMode=yes
+  -o ConnectTimeout=20
+  -o StrictHostKeyChecking=accept-new
+  -o ProxyJump=none
+)
+
+OMNL_PVE_SSH_PREFIX=()
+
+omnl_pve_detect_sudo() {
+  if [[ -n "${OMNL_PVE_SSH_PREFIX[*]:-}" ]]; then
+    return 0
+  fi
+  if [[ "${OMNL_PVE_USE_SUDO:-auto}" == "0" ]]; then
+    OMNL_PVE_SSH_PREFIX=()
+    return 0
+  fi
+  if [[ "${OMNL_PVE_USE_SUDO:-auto}" == "1" ]]; then
+    OMNL_PVE_SSH_PREFIX=(sudo)
+    return 0
+  fi
+  if ssh "${OMNL_PVE_SSH_BASE_OPTS[@]}" "$OMNL_PVE_SSH_TARGET" true 2>/dev/null; then
+    OMNL_PVE_SSH_PREFIX=()
+  elif sudo -n ssh "${OMNL_PVE_SSH_BASE_OPTS[@]}" "$OMNL_PVE_SSH_TARGET" true 2>/dev/null; then
+    OMNL_PVE_SSH_PREFIX=(sudo)
+  else
+    echo "Cannot SSH to ${OMNL_PVE_SSH_TARGET} (tried direct and sudo)." >&2
+    echo "Fix: bash scripts/deployment/setup-dev1-pve-ssh-access.sh" >&2
+    return 1
+  fi
+}
+
+omnl_pve_ssh() {
+  omnl_pve_detect_sudo
+  "${OMNL_PVE_SSH_PREFIX[@]}" ssh "${OMNL_PVE_SSH_BASE_OPTS[@]}" "$OMNL_PVE_SSH_TARGET" "$@"
+}
+
+omnl_pve_scp() {
+  omnl_pve_detect_sudo
+  "${OMNL_PVE_SSH_PREFIX[@]}" scp "${OMNL_PVE_SSH_BASE_OPTS[@]}" "$@"
+}
+
+omnl_pve_preflight() {
+  omnl_pve_detect_sudo
+  omnl_pve_ssh "command -v pct >/dev/null && pct list >/dev/null" || {
+    echo "Proxmox pct unavailable on ${OMNL_PVE_SSH_TARGET}" >&2
+    return 1
+  }
+}

scripts/deployment/setup-dev1-pve-ssh-access.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Ensure dev1@dev-bis-ali can reach Proxmox via sudo ssh (LAN, no cloudflared).
+set -euo pipefail
+
+CONFIG="${HOME}/.ssh/config.d-ecosystem"
+PUB="${HOME}/.ssh/id_ed25519.pub"
+
+log() { echo "[$(date -Iseconds)] $*"; }
+
+if [[ ! -f "$PUB" ]]; then
+  echo "Missing $PUB — generate or copy operator SSH key first." >&2
+  exit 1
+fi
+
+if [[ -f "$CONFIG" ]] && grep -q 'Host 192.168.11\.\*' "$CONFIG"; then
+  log "Patching $CONFIG — disable ProxyJump for LAN 192.168.11.* (use pve-r630-* aliases from laptop via -J dev-bis)"
+  tmp="$(mktemp)"
+  awk '
+    /^Host 192\.168\.11\.\*/ { inblock=1 }
+    inblock && /^[[:space:]]+ProxyJump dev-bis/ { sub(/ProxyJump dev-bis/, "ProxyJump none"); }
+    { print }
+    inblock && /^$/ { inblock=0 }
+  ' "$CONFIG" > "$tmp"
+  mv "$tmp" "$CONFIG"
+  chmod 600 "$CONFIG"
+fi
+
+log "Testing Proxmox SSH (direct, then sudo)..."
+# shellcheck source=lib/omnl-pve-ssh.sh
+source "$(dirname "$0")/lib/omnl-pve-ssh.sh"
+omnl_pve_preflight
+log "Proxmox SSH OK via ${OMNL_PVE_SSH_PREFIX[*]:-direct} → ${OMNL_PVE_SSH_TARGET}"

scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh

@@ -1,12 +1,5 @@
 #!/usr/bin/env bash
 # Sync OMNL banking portal to all Ali banking LXCs (5820–5828) via Proxmox pct.
-#
-# Usage:
-#   bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh           # dry-run
-#   bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh --apply   # deploy all
-#
-# Requires: root SSH to OMNL_PVE_HOST (default 192.168.11.13), built repo at ~/smom-dbis-138
-
 set -euo pipefail
 
 REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}"
@@ -17,26 +10,36 @@ if [[ "${1:-}" == "--apply" ]]; then
   APPLY=true
 fi
 
-# Banking portal LXCs — one per public FQDN product surface
 CTIDS=(5820 5821 5822 5823 5824 5825 5826 5827 5828)
 
 log() { echo "[$(date -Iseconds)] $*"; }
 
-if [[ ! -x "$DEPLOY_SCRIPT" ]]; then
+if [[ ! -f "$DEPLOY_SCRIPT" ]]; then
   echo "Missing deploy script: $DEPLOY_SCRIPT" >&2
   exit 1
 fi
 
+# shellcheck source=lib/omnl-pve-ssh.sh
+source "${REPO_DIR}/scripts/deployment/lib/omnl-pve-ssh.sh"
+omnl_pve_preflight
+
 log "OMNL banking LXC sync — CTIDs: ${CTIDS[*]}"
 log "Mode: $(if $APPLY; then echo APPLY; else echo DRY-RUN; fi)"
 log "Repo: $REPO_DIR"
+log "PVE: ${OMNL_PVE_SSH_TARGET} (sudo prefix: ${OMNL_PVE_SSH_PREFIX[*]:-none})"
+
+if $APPLY; then
+  log "Building stack once on dev..."
+  cd "$REPO_DIR"
+  bash scripts/deployment/deploy-omnl-bank-production.sh
+fi
 
 for CTID in "${CTIDS[@]}"; do
   if $APPLY; then
     log "Deploying CT $CTID..."
-    OMNL_PCT_CTID="$CTID" OMNL_BANK_ROOT="$REPO_DIR" bash "$DEPLOY_SCRIPT"
+    OMNL_SKIP_BUILD=1 OMNL_PCT_CTID="$CTID" OMNL_BANK_ROOT="$REPO_DIR" bash "$DEPLOY_SCRIPT"
   else
-    log "Would deploy CT $CTID → /srv/ali-portal (pct exec on ${OMNL_PVE_HOST:-192.168.11.13})"
+    log "Would deploy CT $CTID → /srv/ali-portal (pct exec on ${OMNL_PVE_SSH_TARGET})"
   fi
 done