Tizian 「ティツィアーン」
916799c051
Some checks failed
CI / check (push) Has been cancelled
first-start.md takes the instance from a bare host to running, once: the sidecars' users, deploy with a read-only key to the forge and the developer's keys (GPG for redeploy.sh's check, SSH pinned to it), .env, SimpleLogin's app, the sidecars' folders and Jellyfin moved in, a role and database for each app's server, the first start, the first operator by ADR 0021's SQL, and the backups. halkyon-li-env.sh writes .env with every secret made on the host and never over an existing file, as the peppers must not change once people sign in: SimpleLogin alone with approval, everything running behind the forward, Train's map and routes over southern Bavaria and its search over Germany until the Instance console cuts regions, Germany as where data and backups are. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
83 lines
3.1 KiB
Shell
Executable file
83 lines
3.1 KiB
Shell
Executable file
#!/bin/sh
|
|
# Writes halkyon.li's first deploy/.env (ADR 0039; first-start.md, step 4), as deploy,
|
|
# on the instance's host at home:
|
|
#
|
|
# sh deploy/host/halkyon-li-env.sh deploy/.env
|
|
#
|
|
# Every secret is made here and now (32 random bytes, in hex), and never leaves the
|
|
# host but into Proton Pass (vault Infra, a note "halkyon.li .env", the whole file).
|
|
# It refuses to write over an existing file: the session peppers and the database
|
|
# passwords must never change once the instance runs (.env.example says why for each).
|
|
# The settings are the developer's choices of 8 Nov 2026; .env.example explains each
|
|
# one. SimpleLogin's client ID and secret stay empty until its app is registered
|
|
# (first-start.md, step 5).
|
|
set -eu
|
|
|
|
target=${1:?usage: halkyon-li-env.sh <path of the new .env>}
|
|
if [ -e "$target" ]; then
|
|
echo "Error: $target exists; its secrets must stay as they are." >&2
|
|
exit 1
|
|
fi
|
|
|
|
secret() { openssl rand -hex 32; }
|
|
|
|
umask 077
|
|
cat >"$target" <<EOF
|
|
# halkyon.li's .env, written by deploy/host/halkyon-li-env.sh on $(date -u +%Y-%m-%d).
|
|
# Its secrets are in Proton Pass (Infra, "halkyon.li .env"). .env.example explains each
|
|
# setting.
|
|
|
|
# Names (ADR 0039, D7): handles on halkyon.li itself.
|
|
LEARN_DOMAIN=learn.halkyon.li
|
|
LEARN_PUBLIC_HOST=learn.halkyon.li
|
|
ACCOUNT_DOMAIN=halkyon.li
|
|
TRAIN_DOMAIN=train.halkyon.li
|
|
TODO_DOMAIN=todo.halkyon.li
|
|
MEDITATE_DOMAIN=meditate.halkyon.li
|
|
JELLYFIN_DOMAIN=jellyfin.halkyon.li
|
|
|
|
# Everything runs, behind ramiel's forward (compose.forwarded.yaml last, its ports win).
|
|
COMPOSE_FILE=compose.learn.yaml:compose.jellyfin.yaml:compose.languagetool.yaml:compose.train.yaml:compose.maps.yaml:compose.search.yaml:compose.todo.yaml:compose.todo-search.yaml:compose.meditate.yaml:compose.forwarded.yaml
|
|
|
|
# The register (ADR 0016), which the four services share.
|
|
INSTANCE_SECRET=$(secret)
|
|
|
|
# Who comes in: SimpleLogin alone, approved by an operator (ADR 0039, D4). No mail, so
|
|
# neither email codes nor passwords.
|
|
SIGN_IN_WAYS=simplelogin
|
|
SIGN_UP=approval
|
|
SIGN_IN_DECOY_KEY=$(secret)
|
|
# From SimpleLogin's app (first-start.md, step 5).
|
|
SIMPLELOGIN_CLIENT_ID=
|
|
SIMPLELOGIN_CLIENT_SECRET=
|
|
|
|
# Learn: the instance's PostgreSQL superuser and Learn's session pepper.
|
|
LEARN_POSTGRES_PASSWORD=$(secret)
|
|
LEARN_SESSION_KEY_HASH_PEPPER=$(secret)
|
|
|
|
# Train, with BRouter, its own map and Photon. Until the Instance console cuts regions
|
|
# (ADR 0040): the map and routes over southern Bavaria, the search over Germany, the
|
|
# smallest Photon's databases come in, with memory to fit beside the rest.
|
|
TRAIN_POSTGRES_PASSWORD=$(secret)
|
|
TRAIN_SESSION_KEY_HASH_PEPPER=$(secret)
|
|
BROUTER_REGION=10,45,15,50
|
|
MAP_KEY_SECRET=$(secret)
|
|
MAP_REGION=10,47.2,13.9,49
|
|
PHOTON_REGION=europe/germany
|
|
PHOTON_HEAP=2g
|
|
PHOTON_MEMORY=3g
|
|
|
|
# Todo and Meditate (no library yet).
|
|
TODO_POSTGRES_PASSWORD=$(secret)
|
|
TODO_SESSION_KEY_HASH_PEPPER=$(secret)
|
|
MEDITATE_POSTGRES_PASSWORD=$(secret)
|
|
MEDITATE_SESSION_KEY_HASH_PEPPER=$(secret)
|
|
|
|
# Jellyfin's library on the HDD (sidecars/README.md, Jellyfin on halkyon.li).
|
|
JELLYFIN_MEDIA=/data/media
|
|
|
|
# What the app tells people: the iMac at home and the Storage Box, both in Germany.
|
|
DATA_LOCATION=DE
|
|
BACKUP_LOCATION=DE
|
|
EOF
|
|
echo "Written: $target"
|