# Ali Zardasht — Remote operator onboarding (Cursor → dev VM `.59`)

Verified path: `pnpm ali:hospitallers:verify-external` → **PASS**

Mirrored in **proxmox** repo: `docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md`

## Path diagram

```
Ali laptop (Cursor)
    → cloudflared + CF service token
    → ssh-dev.d-bis.org
    → Cloudflare Tunnel
    → 192.168.11.59:22 (dev1@5700)
    → full LAN (Proxmox 192.168.11.13, RPC, banking LXCs 5820–5828)
```

| Item | Value |
|------|--------|
| SSH alias | `dev-bis-ali` |
| Public hostname | `ssh-dev.d-bis.org` |
| LAN IP | `192.168.11.59` |
| User | `dev1` (NOPASSWD sudo) |
| Cursor workspace | `/srv/projects/proxmox` |
| Banking app repo | `~/smom-dbis-138` → Gitea `d-bis/smom-dbis-138` |
| Proxmox host | `root@192.168.11.13` |
| Banking LXC CTIDs | `5820`–`5828` |
| Banking deploy root (each LXC) | `/srv/ali-portal` → app `:3000` |

## Handoff bundle (Signal / 1Password)

| File | Purpose |
|------|---------|
| `reports/secrets/ali-hospitallers-ed25519` | SSH private key |
| `reports/secrets/ali-hospitallers-dotenv-handoff.env` | CF, Proxmox, NPM, Gitea |
| `reports/secrets/ali-hospitallers-access-handoff.md` | SSH config snippet |
| `reports/secrets/ali-gitea-credentials.env` | Gitea user `ali` |

Refresh: `pnpm ali:hospitallers:handoff`

## Two-repo layout (Gitea)

See [FORGE_CANONICAL_REGISTRY.md](./FORGE_CANONICAL_REGISTRY.md) and [ALI_GITEA_TWO_REPO_WORKFLOW.md](./ALI_GITEA_TWO_REPO_WORKFLOW.md).

## Quick verify (from `.59`)

```bash
curl -s -o /dev/null -w '%{http_code}\n' http://192.168.11.211:8545   # expect 405
ssh -o ProxyJump=none root@192.168.11.13 'pct exec 5825 -- ls /srv/ali-portal'
# Or from dev-bis-ali when dev1 key is not on PVE:
sudo ssh -o ProxyJump=none root@192.168.11.13 'pct exec 5825 -- ls /srv/ali-portal'
```

## Deploy OMNL to banking LXCs

All nine LXCs:

```bash
cd ~/smom-dbis-138 && git pull origin main
bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh --apply
```

Single LXC:

```bash
export OMNL_PCT_CTID=5825
bash ~/smom-dbis-138/scripts/deployment/deploy-omnl-banking-portal-pct.sh
```

See `config/omnl-banking-portal-host.v1.json` for topology.