From c947158ab7129a68d0b77cb56434b11c49e5e697 Mon Sep 17 00:00:00 2001 From: zaragoza444 Date: Sun, 28 Jun 2026 14:40:55 -0700 Subject: [PATCH] feat: PCT banking portal deploy on Proxmox .13 (/srv/ali-portal) Add operator onboarding doc, host topology manifest, and pct-based deploy scripts aligned with dev VM .59 and banking LXCs 5820-5828. Co-authored-by: Cursor --- config/omnl-banking-portal-host.v1.json | 39 ++++++++++ ...ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md | 58 +++++++++++++++ .../deploy-omnl-banking-portal-pct.sh | 71 +++++++++++++++++++ .../deployment/start-omnl-banking-portal.sh | 40 +++++++++++ 4 files changed, 208 insertions(+) create mode 100644 config/omnl-banking-portal-host.v1.json create mode 100644 docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md create mode 100644 scripts/deployment/deploy-omnl-banking-portal-pct.sh create mode 100644 scripts/deployment/start-omnl-banking-portal.sh diff --git a/config/omnl-banking-portal-host.v1.json b/config/omnl-banking-portal-host.v1.json new file mode 100644 index 0000000..5f96562 --- /dev/null +++ b/config/omnl-banking-portal-host.v1.json @@ -0,0 +1,39 @@ +{ + "version": "1.1.0", + "description": "OMNL banking portal — Ali operator topology (verified via pnpm ali:hospitallers:verify-external)", + "cursorPath": { + "sshAlias": "dev-bis-ali", + "publicHostname": "ssh-dev.d-bis.org", + "devVmLanIp": "192.168.11.59", + "user": "dev1", + "workspace": "/srv/projects/proxmox", + "smomRepo": "/srv/projects/smom-dbis-138" + }, + "proxmox": { + "host": "192.168.11.13", + "access": "ssh root@192.168.11.13 then pct exec ", + "bankingLxcRange": "5820-5828", + "exampleCtid": 5825 + }, + "bankingLxc": { + "ctidEnv": "OMNL_PCT_CTID", + "portalRoot": "/srv/ali-portal", + "projectSource": "/home/projects/exchange", + "appPort": 3000, + "fullStackPorts": { + "tokenAggregation": 3000, + "settlementMiddleware": 3011, + "dbisExchange": 3012, + "frontend": 3002 + } + }, + "edge": { + "npmplusHost": "192.168.11.127", + "publicDomains": "config/omnl-production-domains.v1.json" + }, + "handoff": { + "refreshCommand": "pnpm ali:hospitallers:handoff", + "verifyCommand": "pnpm ali:hospitallers:verify-external", + "onboardingDoc": "docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md" + } +} diff --git a/docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md b/docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md new file mode 100644 index 0000000..5849fdc --- /dev/null +++ b/docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md @@ -0,0 +1,58 @@ +# Ali Zardasht — Remote operator onboarding (Cursor → dev VM `.59`) + +Verified path: `pnpm ali:hospitallers:verify-external` → **PASS** + +Full canonical copy lives in the **proxmox** repo: +`docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md` + +## Path diagram + +``` +Ali laptop (Cursor) + → cloudflared + CF service token + → ssh-dev.d-bis.org + → Cloudflare Tunnel + → 192.168.11.59:22 (dev1@5700) + → full LAN (Proxmox 192.168.11.13, RPC, banking LXCs 5820–5828) +``` + +| Item | Value | +|------|--------| +| SSH alias | `dev-bis-ali` | +| Public hostname | `ssh-dev.d-bis.org` | +| LAN IP | `192.168.11.59` | +| User | `dev1` (NOPASSWD sudo) | +| Cursor workspace | `/srv/projects/proxmox` | +| OMNL repo (on `.59`) | `/srv/projects/smom-dbis-138` | +| Proxmox host | `root@192.168.11.13` | +| Banking LXC CTIDs | `5820`–`5828` | +| Banking deploy root (each LXC) | `/srv/ali-portal` → app `:3000` | + +## Handoff bundle (Signal / 1Password) + +| File | Purpose | +|------|---------| +| `reports/secrets/ali-hospitallers-ed25519` | SSH private key | +| `reports/secrets/ali-hospitallers-dotenv-handoff.env` | CF, Proxmox, NPM, Gitea | +| `reports/secrets/ali-hospitallers-access-handoff.md` | SSH config snippet | +| `reports/secrets/ali-gitea-credentials.env` | Gitea user `ali` | + +Refresh: `pnpm ali:hospitallers:handoff` + +## Quick verify (from `.59`) + +```bash +curl -s -o /dev/null -w '%{http_code}\n' http://192.168.11.211:8545 # expect 405 +ssh root@192.168.11.13 'pct exec 5825 -- ls /srv/ali-portal' +``` + +## Deploy OMNL to banking LXC + +From `dev-bis-ali`: + +```bash +export OMNL_PCT_CTID=5825 # or 5820–5828 per product +bash /srv/projects/smom-dbis-138/scripts/deployment/deploy-omnl-banking-portal-pct.sh +``` + +See `config/omnl-banking-portal-host.v1.json` for topology. diff --git a/scripts/deployment/deploy-omnl-banking-portal-pct.sh b/scripts/deployment/deploy-omnl-banking-portal-pct.sh new file mode 100644 index 0000000..a84b796 --- /dev/null +++ b/scripts/deployment/deploy-omnl-banking-portal-pct.sh @@ -0,0 +1,71 @@ +#!/usr/bin/env bash +# Deploy OMNL banking portal into Proxmox LXC via pct. +# +# Topology: +# ~/home/projects/exchange/ (dev tree inside CT) +# /srv/ali-portal/ (production root inside banking LXC 5820–5828) +# +# Usage (from dev-bis-ali or Proxmox host): +# export OMNL_PCT_CTID=XXXX +# bash scripts/deployment/deploy-omnl-banking-portal-pct.sh +# +# Requires: root SSH to PVE host, pct, built repo at OMNL_BANK_ROOT + +set -euo pipefail + +PVE_HOST="${OMNL_PVE_HOST:-192.168.11.13}" +PVE_USER="${OMNL_PVE_USER:-root}" +CTID="${OMNL_PCT_CTID:-5825}" +REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}" +PORTAL_ROOT="${OMNL_PORTAL_ROOT:-/srv/ali-portal}" +PROJECT_SRC="${OMNL_PROJECT_SRC:-/home/projects/exchange}" +STAGE="/tmp/omnl-banking-portal-$(date +%Y%m%d%H%M%S).tar.gz" + +log() { echo "[$(date -Iseconds)] $*"; } + +pct_exec() { + ssh -o BatchMode=yes "${PVE_USER}@${PVE_HOST}" "pct exec ${CTID} -- $*" +} + +pve_exec() { + ssh -o BatchMode=yes "${PVE_USER}@${PVE_HOST}" "$*" +} + +log "Building OMNL stack at $REPO_DIR..." +cd "$REPO_DIR" +bash scripts/deployment/deploy-omnl-bank-production.sh + +log "Staging bundle..." +tar -czf "$STAGE" \ + -C "$REPO_DIR" \ + config \ + frontend-dapp/dist \ + packages/integration-foundation/dist \ + packages/settlement-core/dist \ + services/token-aggregation/dist \ + services/token-aggregation/package.json \ + services/token-aggregation/package-lock.json \ + services/settlement-middleware/dist \ + services/settlement-middleware/package.json \ + services/settlement-middleware/package-lock.json \ + services/dbis-exchange/dist \ + services/dbis-exchange/package.json \ + services/dbis-exchange/package-lock.json \ + scripts/deployment/start-omnl-banking-portal.sh + +log "Push to PVE host $PVE_HOST..." +scp -o BatchMode=yes "$STAGE" "${PVE_USER}@${PVE_HOST}:/tmp/omnl-portal.tar.gz" +rm -f "$STAGE" + +log "Install into CT $CTID at $PORTAL_ROOT..." +pve_exec "pct push ${CTID} /tmp/omnl-portal.tar.gz /tmp/omnl-portal.tar.gz" +pct_exec "mkdir -p ${PORTAL_ROOT} ${PROJECT_SRC}" +pct_exec "tar -xzf /tmp/omnl-portal.tar.gz -C ${PORTAL_ROOT}" +pct_exec "ln -sfn ${PORTAL_ROOT} ${PROJECT_SRC}/omnl-live || true" +pct_exec "chmod +x ${PORTAL_ROOT}/scripts/deployment/start-omnl-banking-portal.sh" + +log "Start services inside CT..." +pct_exec "bash ${PORTAL_ROOT}/scripts/deployment/start-omnl-banking-portal.sh" + +log "Done — portal root: ${PORTAL_ROOT} (CT ${CTID} on ${PVE_HOST})" +log "Point NPMplus / public DNS to ${PVE_HOST} frontend :3002" diff --git a/scripts/deployment/start-omnl-banking-portal.sh b/scripts/deployment/start-omnl-banking-portal.sh new file mode 100644 index 0000000..fb0db45 --- /dev/null +++ b/scripts/deployment/start-omnl-banking-portal.sh @@ -0,0 +1,40 @@ +#!/usr/bin/env bash +# Start OMNL services from /srv/banking-portal/OMNL inside PCT +set -euo pipefail + +ROOT="${OMNL_PORTAL_ROOT:-/srv/ali-portal}" +LOG_DIR="${OMNL_BANK_LOG_DIR:-/var/log/omnl-bank}" +mkdir -p "$LOG_DIR" + +export SETTLEMENT_MIDDLEWARE_CONFIG="${ROOT}/config/settlement-middleware.production.v1.json" +export DBIS_EXCHANGE_CONFIG="${ROOT}/config/dbis-exchange.production.v1.json" +export OMNL_SUPPORTED_CHAINS_CONFIG="${ROOT}/config/omnl-supported-chains.v1.json" +export OMNL_M2_TOKEN_REGISTRY="${ROOT}/config/omnl-m2-token-registry.v1.json" + +start() { + local name="$1" dir="$2" cmd="$3" + cd "${ROOT}/${dir}" + pkill -f "${ROOT}/${dir}" 2>/dev/null || true + nohup env \ + SETTLEMENT_MIDDLEWARE_CONFIG="$SETTLEMENT_MIDDLEWARE_CONFIG" \ + DBIS_EXCHANGE_CONFIG="$DBIS_EXCHANGE_CONFIG" \ + OMNL_SUPPORTED_CHAINS_CONFIG="$OMNL_SUPPORTED_CHAINS_CONFIG" \ + OMNL_M2_TOKEN_REGISTRY="$OMNL_M2_TOKEN_REGISTRY" \ + bash -c "$cmd" >"${LOG_DIR}/${name}.log" 2>&1 & + echo $! >"${LOG_DIR}/${name}.pid" +} + +start token-aggregation services/token-aggregation "npm run start" +sleep 2 +start settlement-middleware services/settlement-middleware "npm run start" +sleep 2 +start dbis-exchange services/dbis-exchange "npm run start" +sleep 2 + +FRONTEND_PORT="${OMNL_BANK_FRONTEND_PORT:-3002}" +pkill -f "serve -s.*${FRONTEND_PORT}" 2>/dev/null || true +cd "${ROOT}/frontend-dapp" +nohup npx --yes serve -s dist -l "$FRONTEND_PORT" >"${LOG_DIR}/frontend.log" 2>&1 & +echo $! >"${LOG_DIR}/frontend.pid" + +echo "OMNL banking portal started under ${ROOT}"