archipelagoandClaude Opus 5
6ba0599639
Demo images / Build & push demo images (push) Failing after 2m13s
The repo is source code and guidelines only. Nothing about how Archipelago's own fleet is run, or how the team works, stays in it. Untracked (kept on disk, gitignored) — 250 files: - .planning/ (199) and loop/ — internal development process - fleet operations tooling that targets specific nodes: deploy-to-target, deploy-tailscale, deploy-config-defaults, setup-target-dev, setup-aiui-server, setup-https-dev, debug-frontend, node-profile, fleet-fips-pair/unpair, image-recipe/sync-from-live.sh - image-recipe/INTEGRATION-GUIDE.md and docs/multinode-testing-plan.md, both of which are live-server workflow and fleet node inventories - the Phase 10 on-node verification and evidence records, which cite .planning/ as their evidence base KEY-05-ENTROPY-ENFORCEMENT.md was initially moved out with the other Phase 10 docs and then put back: it is cited as normative rationale from ten places in the codebase, including core/clippy.toml, which bans rand::thread_rng and points at it for the reason. That makes it a guideline, not an internal record. Node names removed from source (48 occurrences across comments, manifests and test fixtures): archi-dev-box, archy-x250*, shorty-s, framework-pt, zaza-optiplex, archi-thinkpad. Comments keep the engineering context and the date, which is what carried the meaning; the machine name did not. Three of those were live test values rather than comments and were replaced with valid stand-ins, not prose: two mDNS hostnames and a mesh peer name. An earlier pass substituted "a test node" into a hostname assertion, producing an invalid hostname; caught and fixed as test-node.local. Wipe mechanism: .local-only/manifest.txt inventories every local-only path and .local-only/wipe.sh deletes them on one confirmation, refusing to touch anything git still tracks. Both are themselves untracked, so the public repo does not carry a map of internal filenames. Verified: cargo check -p archipelago --all-features clean; archipelago-container 75/75 tests pass; appOrigin vitest 7/7; audit-secrets 5/5; every relative link in tracked markdown resolves (0 broken). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
29 lines
1.3 KiB
Desktop File
29 lines
1.3 KiB
Desktop File
[Unit]
|
|
Description=Archipelago host-secret audit (are this node's SSH/TLS keys per-node?)
|
|
Documentation=file:///opt/archipelago/scripts/security/host-secrets-audit.sh
|
|
# Ordered after first-boot regeneration so a fresh node is judged on the keys
|
|
# it ends up with, not the ones it booted with. network.target because the
|
|
# fingerprints are only meaningful once the node has an identity to report as.
|
|
After=archipelago-first-boot-secrets.service network.target
|
|
ConditionPathExists=/opt/archipelago/scripts/security/host-secrets-audit.sh
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
# Reads /etc/ssh and /etc/archipelago/ssl and writes
|
|
# /var/lib/archipelago/host-secrets-audit.json, all of which are root-owned.
|
|
User=root
|
|
# DETECT ONLY. D-06 chose detect-report-then-apply
|
|
# rotation is one-way and must never
|
|
# fire unattended across the fleet during an OTA. There is deliberately NO
|
|
# --apply here. Adding one is a decision, not a configuration change.
|
|
ExecStart=-/opt/archipelago/scripts/security/host-secrets-audit.sh --detect
|
|
# The leading `-` above: a failed audit must never fail a boot. The verdict is
|
|
# informational; a node that cannot be judged is still a node that must come up.
|
|
TimeoutStartSec=60
|
|
RemainAfterExit=yes
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|