2 Commits

Include renames

Author	SHA1	Message	Date
57_WolveandClaude Opus 5	134736c082	fix(ergo): findings from reviewing the first live deploy ... Seven confirmed findings from an observed-vs-expected review of a real deploy transcript against the code (four other proposed findings were refuted and no change was made for them). - Caddyfile reformatted so `caddy fmt` is clean, removing the warning Caddy printed on every validate and every start. Two causes, not one: `caddy fmt` indents with TABS, and it deletes a blank line whose following line begins with `{` -- which is why the warning pointed at line 17, the blank before the global options block. The check is a whole-file byte comparison, so the line number was only the first difference and the entire file had to be reformatted. Verified whitespace-only outside the heredoc, whose body is left byte-identical: Caddy strips padding derived from the closing marker's indentation, so re-indenting it would change what the page serves. - deploy.sh no longer upgrades Caddy behind the operator's back. A bare `docker compose pull` refreshed the floating `caddy:2-alpine` on every re-run and `up -d` then recreated it, doing exactly what CADDY_AUTOUPDATE=0 promises not to, with none of update.sh's health check or rollback. Pulls are now per service: the pinned Ergo tag always, Caddy only when absent or opted in. - deploy.sh seeds the ACME_EMAIL and NETWORK_NAME prompts from .env, so pressing Enter through a re-run no longer renames the network to the hostname in the summary while .env keeps the real one. - The Caddy restart guard compares the container's identity across `up -d`. A container compose created or recreated has already read the new Caddyfile; only one left running still holds the old config, and `svc_state` cannot tell those apart. - Container logs are now rotated (json-file, 10m x 3) on every service. Alpine's docker package ships no daemon.json, so the default is unbounded, and the 60-second health probe alone writes a log line per run. - ergoctl notes that LUSERS counts its own probe connection, which is why a server with nobody on it reports one invisible user. Verified: seven local suites pass, the embedded archive round-trips, line endings are LF, and the reformatted Caddyfile is a verified fixed point of the formatter (semantically identical token-for-token to the previous one). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-02 15:38:13 -05:00
57_WolveandClaude Opus 5	4cbd808eb1	feat(ergo): add Ergo IRC server deployment with ergoctl admin CLI ... New deployments/ergo/: the Ergo IRC server behind Caddy for Let's Encrypt TLS and the IRC-over-WebSocket endpoint. Docker rather than a native OpenRC/systemd service, because Alpine's apk ergo trails upstream (3.24 ships 2.18.0 against a 2.19.1 security release) and Debian/Alma package it at all -- so native would mean three install paths plus a per-distro ACME client. Both containers run with network_mode: host. IRC bans, throttling and cloaking key on the client's address, and Docker's userland proxy would hide every IPv6 client behind the bridge gateway; host mode also makes the repo's INPUT firewall genuinely govern 80/443/6697. Caddy reaches Ergo over loopback, which is what lets Ergo honour X-Forwarded-For (proxy-allowed-from defaults to localhost) and mark web sessions secure. - deploy.sh generates ircd.yaml ONCE from the pulled image's own default.yaml (version-matched), rewriting the listeners/websockets blocks wholesale rather than patching lines, then asserts hard post-conditions and validates with `ergo run --smoke` in a throwaway container before anything starts. - update.sh: pinned vX.Y.Z tags, GHSA + "### Security" release-note policies, pre-flight against the new image, user NOTICE + grace, stop-consistent DB snapshot, health check (IRC-level, not a bare TCP connect) and rollback that restores the DB only when the schema actually moved. Compatibility-break releases are held for review. certsync copies Caddy's cert pairwise-atomically and verifies the fingerprint served on 6697 after the rehash. - ergoctl: status/users/logs, validated edit+rehash, oper add/passwd/rm, moderation, backup/restore, cert and update passthrough. Talks IRC to the loopback listener over bash /dev/tcp and strips control characters from replies. - Ergo runs as a non-root system user, read-only rootfs, all caps dropped; Caddy keeps only NET_BIND_SERVICE, with admin API and HTTP/3 off. Reviewed adversarially across six lenses; 20 confirmed findings fixed, notably a dead SIGHUP fallback (`rc=$?` after an `if` is always 0), several `set -e` aborts from non-total pipelines, a release-list cache that only ever populated in a subshell, and re-runs that used shell defaults instead of the deployed .env. Verified locally: bash -n, LF endings, the ircd.yaml render against the real 2.19.1 template in both PLAINTEXT modes, the yaml/oper/version/env helpers, and the IRC client against a fake server (registration, oper, rehash success and 400-failure, control-character stripping, server-down paths). Not yet exercised on a Docker host: the containers themselves, ACME issuance and cert sync. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-02 13:19:31 -05:00