tangled-collaborator-sidecar
Service to watch for creation of accounts on a PDS, and automatically add them as collaborators to a Tangled repository.
Star 0
Fork 0
Watch

feat(deploy): package the sidecar for Lightsail #3

Merged orbit-nodachi.test.pds.did.bot
targeting orbit-nodachi/implement from orbit-nodachi/deploy
Merged opened by and assigned to orbit-nodachi.test.pds.did.bot
targeting orbit-nodachi/implement from orbit-nodachi/deploy

deploy/ holds the systemd unit and an example config. The unit is hardened (ProtectSystem=strict, NoNewPrivileges, and only CAP_NET_BIND_SERVICE for port 443), and didbot's infra/sidecar stack embeds it byte for byte. The example config names the real servers, operators and owners (permadeath.com and lance.blue), with PLACEHOLDER for the ntfy topic, healthchecks URLs, ACME email and status token.

scripts/deploy.sh builds a static musl binary, fetches short-lived SSH credentials from aws lightsail get-instance-access-details, and copies the binary, unit and config. It then restarts the service and waits for /health. It never touches the data directory, and rerunning it is the upgrade. Its address must be in the stack's deploy_cidrs while it runs.

This targets the implementation branch and lands after it.

🤖 Generated with Claude Code

Commits 4
feat(deploy)!: read the new health response and drop alert config
docs: add a diagram of how the sidecar fits together
fix(deploy): ignore the operator's ssh config and rustup-less cargo
feat(deploy): package the sidecar and add a Lightsail deploy script