feat: PCT banking portal deploy on Proxmox .13 (/srv/ali-portal)

Add operator onboarding doc, host topology manifest, and pct-based deploy scripts aligned with dev VM .59 and banking LXCs 5820-5828.

Co-authored-by: Cursor <cursoragent@cursor.com>

config/omnl-banking-portal-host.v1.json

@@ -0,0 +1,39 @@
+{
+  "version": "1.1.0",
+  "description": "OMNL banking portal — Ali operator topology (verified via pnpm ali:hospitallers:verify-external)",
+  "cursorPath": {
+    "sshAlias": "dev-bis-ali",
+    "publicHostname": "ssh-dev.d-bis.org",
+    "devVmLanIp": "192.168.11.59",
+    "user": "dev1",
+    "workspace": "/srv/projects/proxmox",
+    "smomRepo": "/srv/projects/smom-dbis-138"
+  },
+  "proxmox": {
+    "host": "192.168.11.13",
+    "access": "ssh root@192.168.11.13 then pct exec <CTID>",
+    "bankingLxcRange": "5820-5828",
+    "exampleCtid": 5825
+  },
+  "bankingLxc": {
+    "ctidEnv": "OMNL_PCT_CTID",
+    "portalRoot": "/srv/ali-portal",
+    "projectSource": "/home/projects/exchange",
+    "appPort": 3000,
+    "fullStackPorts": {
+      "tokenAggregation": 3000,
+      "settlementMiddleware": 3011,
+      "dbisExchange": 3012,
+      "frontend": 3002
+    }
+  },
+  "edge": {
+    "npmplusHost": "192.168.11.127",
+    "publicDomains": "config/omnl-production-domains.v1.json"
+  },
+  "handoff": {
+    "refreshCommand": "pnpm ali:hospitallers:handoff",
+    "verifyCommand": "pnpm ali:hospitallers:verify-external",
+    "onboardingDoc": "docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md"
+  }
+}

docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md

@@ -0,0 +1,58 @@
+# Ali Zardasht — Remote operator onboarding (Cursor → dev VM `.59`)
+
+Verified path: `pnpm ali:hospitallers:verify-external` → **PASS**
+
+Full canonical copy lives in the **proxmox** repo:
+`docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md`
+
+## Path diagram
+
+```
+Ali laptop (Cursor)
+    → cloudflared + CF service token
+    → ssh-dev.d-bis.org
+    → Cloudflare Tunnel
+    → 192.168.11.59:22 (dev1@5700)
+    → full LAN (Proxmox 192.168.11.13, RPC, banking LXCs 5820–5828)
+```
+
+| Item | Value |
+|------|--------|
+| SSH alias | `dev-bis-ali` |
+| Public hostname | `ssh-dev.d-bis.org` |
+| LAN IP | `192.168.11.59` |
+| User | `dev1` (NOPASSWD sudo) |
+| Cursor workspace | `/srv/projects/proxmox` |
+| OMNL repo (on `.59`) | `/srv/projects/smom-dbis-138` |
+| Proxmox host | `root@192.168.11.13` |
+| Banking LXC CTIDs | `5820`–`5828` |
+| Banking deploy root (each LXC) | `/srv/ali-portal` → app `:3000` |
+
+## Handoff bundle (Signal / 1Password)
+
+| File | Purpose |
+|------|---------|
+| `reports/secrets/ali-hospitallers-ed25519` | SSH private key |
+| `reports/secrets/ali-hospitallers-dotenv-handoff.env` | CF, Proxmox, NPM, Gitea |
+| `reports/secrets/ali-hospitallers-access-handoff.md` | SSH config snippet |
+| `reports/secrets/ali-gitea-credentials.env` | Gitea user `ali` |
+
+Refresh: `pnpm ali:hospitallers:handoff`
+
+## Quick verify (from `.59`)
+
+```bash
+curl -s -o /dev/null -w '%{http_code}\n' http://192.168.11.211:8545   # expect 405
+ssh root@192.168.11.13 'pct exec 5825 -- ls /srv/ali-portal'
+```
+
+## Deploy OMNL to banking LXC
+
+From `dev-bis-ali`:
+
+```bash
+export OMNL_PCT_CTID=5825   # or 5820–5828 per product
+bash /srv/projects/smom-dbis-138/scripts/deployment/deploy-omnl-banking-portal-pct.sh
+```
+
+See `config/omnl-banking-portal-host.v1.json` for topology.

scripts/deployment/deploy-omnl-banking-portal-pct.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# Deploy OMNL banking portal into Proxmox LXC via pct.
+#
+# Topology:
+#   ~/home/projects/exchange/  (dev tree inside CT)
+#   /srv/ali-portal/  (production root inside banking LXC 5820–5828)
+#
+# Usage (from dev-bis-ali or Proxmox host):
+#   export OMNL_PCT_CTID=XXXX
+#   bash scripts/deployment/deploy-omnl-banking-portal-pct.sh
+#
+# Requires: root SSH to PVE host, pct, built repo at OMNL_BANK_ROOT
+
+set -euo pipefail
+
+PVE_HOST="${OMNL_PVE_HOST:-192.168.11.13}"
+PVE_USER="${OMNL_PVE_USER:-root}"
+CTID="${OMNL_PCT_CTID:-5825}"
+REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}"
+PORTAL_ROOT="${OMNL_PORTAL_ROOT:-/srv/ali-portal}"
+PROJECT_SRC="${OMNL_PROJECT_SRC:-/home/projects/exchange}"
+STAGE="/tmp/omnl-banking-portal-$(date +%Y%m%d%H%M%S).tar.gz"
+
+log() { echo "[$(date -Iseconds)] $*"; }
+
+pct_exec() {
+  ssh -o BatchMode=yes "${PVE_USER}@${PVE_HOST}" "pct exec ${CTID} -- $*"
+}
+
+pve_exec() {
+  ssh -o BatchMode=yes "${PVE_USER}@${PVE_HOST}" "$*"
+}
+
+log "Building OMNL stack at $REPO_DIR..."
+cd "$REPO_DIR"
+bash scripts/deployment/deploy-omnl-bank-production.sh
+
+log "Staging bundle..."
+tar -czf "$STAGE" \
+  -C "$REPO_DIR" \
+  config \
+  frontend-dapp/dist \
+  packages/integration-foundation/dist \
+  packages/settlement-core/dist \
+  services/token-aggregation/dist \
+  services/token-aggregation/package.json \
+  services/token-aggregation/package-lock.json \
+  services/settlement-middleware/dist \
+  services/settlement-middleware/package.json \
+  services/settlement-middleware/package-lock.json \
+  services/dbis-exchange/dist \
+  services/dbis-exchange/package.json \
+  services/dbis-exchange/package-lock.json \
+  scripts/deployment/start-omnl-banking-portal.sh
+
+log "Push to PVE host $PVE_HOST..."
+scp -o BatchMode=yes "$STAGE" "${PVE_USER}@${PVE_HOST}:/tmp/omnl-portal.tar.gz"
+rm -f "$STAGE"
+
+log "Install into CT $CTID at $PORTAL_ROOT..."
+pve_exec "pct push ${CTID} /tmp/omnl-portal.tar.gz /tmp/omnl-portal.tar.gz"
+pct_exec "mkdir -p ${PORTAL_ROOT} ${PROJECT_SRC}"
+pct_exec "tar -xzf /tmp/omnl-portal.tar.gz -C ${PORTAL_ROOT}"
+pct_exec "ln -sfn ${PORTAL_ROOT} ${PROJECT_SRC}/omnl-live || true"
+pct_exec "chmod +x ${PORTAL_ROOT}/scripts/deployment/start-omnl-banking-portal.sh"
+
+log "Start services inside CT..."
+pct_exec "bash ${PORTAL_ROOT}/scripts/deployment/start-omnl-banking-portal.sh"
+
+log "Done — portal root: ${PORTAL_ROOT} (CT ${CTID} on ${PVE_HOST})"
+log "Point NPMplus / public DNS to ${PVE_HOST} frontend :3002"

scripts/deployment/start-omnl-banking-portal.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Start OMNL services from /srv/banking-portal/OMNL inside PCT
+set -euo pipefail
+
+ROOT="${OMNL_PORTAL_ROOT:-/srv/ali-portal}"
+LOG_DIR="${OMNL_BANK_LOG_DIR:-/var/log/omnl-bank}"
+mkdir -p "$LOG_DIR"
+
+export SETTLEMENT_MIDDLEWARE_CONFIG="${ROOT}/config/settlement-middleware.production.v1.json"
+export DBIS_EXCHANGE_CONFIG="${ROOT}/config/dbis-exchange.production.v1.json"
+export OMNL_SUPPORTED_CHAINS_CONFIG="${ROOT}/config/omnl-supported-chains.v1.json"
+export OMNL_M2_TOKEN_REGISTRY="${ROOT}/config/omnl-m2-token-registry.v1.json"
+
+start() {
+  local name="$1" dir="$2" cmd="$3"
+  cd "${ROOT}/${dir}"
+  pkill -f "${ROOT}/${dir}" 2>/dev/null || true
+  nohup env \
+    SETTLEMENT_MIDDLEWARE_CONFIG="$SETTLEMENT_MIDDLEWARE_CONFIG" \
+    DBIS_EXCHANGE_CONFIG="$DBIS_EXCHANGE_CONFIG" \
+    OMNL_SUPPORTED_CHAINS_CONFIG="$OMNL_SUPPORTED_CHAINS_CONFIG" \
+    OMNL_M2_TOKEN_REGISTRY="$OMNL_M2_TOKEN_REGISTRY" \
+    bash -c "$cmd" >"${LOG_DIR}/${name}.log" 2>&1 &
+  echo $! >"${LOG_DIR}/${name}.pid"
+}
+
+start token-aggregation services/token-aggregation "npm run start"
+sleep 2
+start settlement-middleware services/settlement-middleware "npm run start"
+sleep 2
+start dbis-exchange services/dbis-exchange "npm run start"
+sleep 2
+
+FRONTEND_PORT="${OMNL_BANK_FRONTEND_PORT:-3002}"
+pkill -f "serve -s.*${FRONTEND_PORT}" 2>/dev/null || true
+cd "${ROOT}/frontend-dapp"
+nohup npx --yes serve -s dist -l "$FRONTEND_PORT" >"${LOG_DIR}/frontend.log" 2>&1 &
+echo $! >"${LOG_DIR}/frontend.pid"
+
+echo "OMNL banking portal started under ${ROOT}"