@astrofoundry/pi-astro 0.33.1 → 0.34.0

package/specialists/arcane/run.ts

@@ -1,17 +1,23 @@
+import { createHash } from "node:crypto";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
+import { buildHostRemote, compareAudit, HOST_COMMANDS, type AuditFile } from "../lib/arcane-host.ts";
+import { failedChecks, MANAGER_COMPOSE, MANAGER_IMAGE, normalizeVersion, olderThan, pinCompose, projectSync, syncReady, utcStamp, type VerifyCheck } from "../lib/arcane-manager.ts";
 import { readConfig } from "../lib/config.ts";
+import { containerFacts, deploymentChecks, listRows, parseDeploymentArgs, syncFacts, type DeploymentExpectation } from "../lib/deployment.ts";
 import { ServiceError, UsageError } from "../lib/errors.ts";
 import { main } from "../lib/main.ts";
 import { buildUpdateReport, parseTag, resolveRef, stackServices, type CheckEntry } from "../lib/image-updates.ts";
 import { printJson, printRaw } from "../lib/output.ts";
-import { run } from "../lib/proc.ts";
+import { specialistsHome } from "../lib/paths.ts";
+import { run, type RunResult } from "../lib/proc.ts";
 import { HttpRegistry, parseImageRef } from "../lib/registry.ts";
 import { releaseNotesFor } from "../lib/releases.ts";
-import { REPO_HELP, repoCommand, type RepoSpec } from "../lib/repo.ts";
+import { ensureCheckout, git, REPO_HELP, repoCommand, repoStatus, type RepoSpec } from "../lib/repo.ts";
 import { ARCANE_DENIED_KEYS, filterJsonText, stripKeys } from "../lib/sanitize.ts";
-import { readSecret } from "../lib/secrets.ts";
+import { readSecret, secretPath } from "../lib/secrets.ts";
+import { sshFixed } from "../lib/ssh.ts";
 import { mintAccessToken, parseServiceAccountKey } from "../lib/zitadel.ts";
 
 const SERVICE = "arcane";
@@ -36,6 +42,14 @@ const SHAPE = {
     gitopsBranch: "string",
 } as const;
 
+/** The Arcane VM through the forced-command key of user `spc-arcane`; read only by commands that use the host. */
+interface HostConfig extends Record<string, string> {
+    hostAddress: string;
+    hostUser: string;
+}
+
+const HOST_SHAPE = { hostAddress: "string", hostUser: "string" } as const;
+
 /** CLI paths that would alter the wrapper's own setup or the binary; everything else passes through. */
 export const REFUSED_PREFIXES: readonly string[] = ["config", "auth", "self-update", "completion"];
 
@@ -69,6 +83,21 @@ const HELP = `arcane specialist
 
   <arcane-cli args...>        run arcane-cli with a fresh federated token; JSON output, sensitive fields removed
                               (arcane-cli gitops ... manages the server-side syncs)
+  project-status [name]       projects with their GitOps sync: commit, state, hook state (no error text)
+  deployment check|wait <project> --commit <sha> [--container NAME=sha256:ID]... [--job NAME=sha256:ID]...
+                              [--allow-no-health NAME]... [--timeout s]
+                              compare the sync commit and state, hook, and each container's project, image ID,
+                              state and health; wait polls every 10 s (default 600 s); the answer's status says ok
+  manager-upgrade <version>   upgrade Arcane itself (arcane/AGENTS.md "Manager upgrades"): digest pin commit, file-only
+                              sync, pull, cold backup, restart of the manager only, checks; a failed check rolls back
+                              the image and Compose file (the data stays; R3 is manual). Owner approval.
+  manager-rollback <stamp>    put back the Compose file and image recorded at <stamp>; revert the pin in git yourself.
+                              Owner approval.
+  host <command> [args]       fixed operations on the Arcane VM (sanitized; raw logs never leave the guest):
+${Object.entries(HOST_COMMANDS)
+    .filter(([, c]) => !c.internal)
+    .map(([, c]) => `      ${c.help}`)
+    .join("\n")}
   update-report [--all]       fresh image update check for every stack, with running and latest release versions
                               from the registries; JSON with a ready table (--all also lists up-to-date services).
                               Checks only: never pulls images or redeploys.
@@ -209,6 +238,248 @@ async function releaseNotes(config: ArcaneConfig, args: string[]): Promise<numbe
     });
 }
 
+// ---------------------------------------------------------------- Arcane VM
+
+const NAME = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
+
+async function hostCall(args: string[], allowInternal: boolean): Promise<RunResult> {
+    const { remote, spec } = buildHostRemote(args, allowInternal);
+    const host = readConfig<HostConfig>(SERVICE, HOST_SHAPE);
+    const input = spec.stdinSecret ? readSecret(SERVICE, spec.stdinSecret) : undefined;
+    const target = { host: host.hostAddress, user: host.hostUser, keyFile: secretPath(SERVICE, "SSH_KEY_ARCANE_HOST"), knownHostsFile: join(specialistsHome(), "config", "known_hosts") };
+    return sshFixed(target, remote, spec.timeoutMs, input);
+}
+
+/** One host operation whose answer is JSON; its refusal or failure text becomes the error. */
+async function hostJson(args: string[]): Promise<Record<string, unknown>> {
+    const result = await hostCall(args, true);
+    if (result.code !== 0) throw new ServiceError(`host ${args[0]}: ${result.stderr.trim() || `exited ${result.code}`}`);
+    try {
+        const value: unknown = JSON.parse(result.stdout);
+        if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("not an object");
+        if ((value as { error?: unknown }).error === true) throw new ServiceError(`host ${args[0]}: the check could not complete; its details stay on the guest`);
+        return value as Record<string, unknown>;
+    } catch (err) {
+        if (err instanceof ServiceError) throw err;
+        throw new ServiceError(`host ${args[0]}: output is not a JSON object`);
+    }
+}
+
+async function hostCommand(config: ArcaneConfig, args: string[]): Promise<number> {
+    if (args[0] === "host-audit") {
+        if (args.length !== 1) throw new UsageError("host host-audit takes no arguments");
+        const audit = await hostJson(["host-audit"]);
+        const spec = repoSpec(config);
+        const dir = await ensureCheckout(spec);
+        let pulled = true;
+        try {
+            await git(spec, dir, ["pull", "--ff-only", "origin", config.gitopsBranch]);
+        } catch {
+            pulled = false;
+        }
+        const files = compareAudit(Array.isArray(audit.files) ? (audit.files as AuditFile[]) : [], dir);
+        printJson({ files, units: audit.units, comparedWith: pulled ? `origin/${config.gitopsBranch}` : "the local checkout (pull failed)" });
+        return 0;
+    }
+    const result = await hostCall(args, false);
+    if (result.stdout.length > 0) printRaw(result.stdout);
+    if (result.code !== 0) throw new ServiceError(result.stderr.trim() || `host ${args[0]} exited ${result.code}`);
+    return 0;
+}
+
+async function projectStatus(config: ArcaneConfig, args: string[]): Promise<number> {
+    if (args.length > 1 || (args[0] !== undefined && !NAME.test(args[0]))) throw new UsageError("project-status [name]");
+    return withCli(config, async (cli) => {
+        const projects = listRows(await cliJson(cli, ["projects", "list", "--all"]));
+        const syncs = listRows(await cliJson(cli, ["gitops", "list", "--all"]));
+        const picked = args[0] === undefined ? projects : projects.filter((p) => p.name === args[0]);
+        if (args[0] !== undefined && picked.length !== 1) throw new UsageError(`no single project named ${args[0]}`);
+        printJson({
+            projects: picked.map((p) => ({
+                name: p.name,
+                status: p.status,
+                running: p.runningCount,
+                services: p.serviceCount,
+                syncs: syncs
+                    .filter((s) => s.projectId === p.id)
+                    .map((s) => ({ name: s.name, autoSync: s.autoSync, redeployAfterSync: s.redeployAfterSync, pullImageAfterSync: s.pullImageAfterSync, ...syncFacts(s) })),
+            })),
+        });
+        return 0;
+    });
+}
+
+async function deploymentSnapshot(config: ArcaneConfig, expect: DeploymentExpectation): Promise<Record<string, unknown>> {
+    return withCli(config, async (cli) => {
+        const project = listRows(await cliJson(cli, ["projects", "list", "--all"])).filter((p) => p.name === expect.project);
+        if (project.length !== 1) throw new UsageError(`no single project named ${expect.project}`);
+        const mine = listRows(await cliJson(cli, ["gitops", "list", "--all"])).filter((s) => s.projectId === project[0].id);
+        if (mine.length !== 1) throw new UsageError(`project ${expect.project} needs exactly one GitOps sync, found ${mine.length}`);
+        const containers = [];
+        for (const name of [...Object.keys(expect.services), ...Object.keys(expect.jobs)]) {
+            try {
+                containers.push(containerFacts(await cliJson(cli, ["containers", "get", name]), name));
+            } catch {
+                containers.push(null);
+            }
+        }
+        const after = listRows(await cliJson(cli, ["gitops", "list", "--all"])).find((s) => s.id === mine[0].id) ?? {};
+        return { project: expect.project, ...deploymentChecks(expect, syncFacts(mine[0]), containers, syncFacts(after)) };
+    });
+}
+
+/** One federated token per check, because a wait can outlive the token's five minutes. */
+async function deployment(config: ArcaneConfig, args: string[]): Promise<number> {
+    const expect = parseDeploymentArgs(args);
+    const deadline = Date.now() + expect.timeoutS * 1000;
+    for (;;) {
+        const snapshot = await deploymentSnapshot(config, expect);
+        if (snapshot.status === "ok" || !expect.wait) {
+            printJson(snapshot);
+            return 0;
+        }
+        if (Date.now() + 10_000 > deadline) {
+            printJson({ status: "timeout", lastCheck: snapshot });
+            return 0;
+        }
+        await new Promise((r) => setTimeout(r, 10_000));
+    }
+}
+
+const RELEASE_COMMIT_URL = "https://api.github.com/repos/getarcaneapp/arcane/commits/";
+
+/** The commit the official release tag points to, which the image's revision label must name. */
+async function releaseCommit(tag: string): Promise<string> {
+    const res = await fetch(`${RELEASE_COMMIT_URL}${encodeURIComponent(tag)}`, { headers: { accept: "application/vnd.github+json", "user-agent": "pi-astro-arcane" }, signal: AbortSignal.timeout(15_000) });
+    if (!res.ok) throw new ServiceError(`GitHub returned ${res.status} for release ${tag}`);
+    const sha = ((await res.json()) as { sha?: unknown }).sha;
+    if (typeof sha !== "string" || !/^[0-9a-f]{40}$/.test(sha)) throw new ServiceError(`GitHub returned no commit for ${tag}`);
+    return sha;
+}
+
+function sha256(text: string): string {
+    return createHash("sha256").update(text).digest("hex");
+}
+
+const MINUTE = 60_000;
+const SYNC_WAIT_MS = 30 * MINUTE;
+
+/**
+ * arcane/AGENTS.md "Manager upgrades", end to end. Prints one JSON answer with
+ * `status`: upgraded, rolled back (the new image failed its checks), or
+ * stopped (nothing was restarted). The exit code is 0 in all three so the
+ * caller always gets the answer; usage and precondition errors still fail.
+ */
+async function managerUpgrade(config: ArcaneConfig, args: string[]): Promise<number> {
+    if (args.length !== 1) throw new UsageError("manager-upgrade <version>");
+    const version = normalizeVersion(args[0]);
+    const tag = `v${version}`;
+    const registry = new HttpRegistry();
+    const ref = parseImageRef(`${MANAGER_IMAGE}:${tag}`);
+    const digest = await registry.digest(ref, tag);
+    if (digest === null) throw new ServiceError(`${MANAGER_IMAGE}:${tag} does not exist`);
+    const revision = (await registry.labels(ref, tag))["org.opencontainers.image.revision"] ?? null;
+    const commitOfTag = await releaseCommit(tag);
+    if (revision !== commitOfTag) throw new ServiceError(`image revision ${revision ?? "(none)"} is not the commit of release ${tag} (${commitOfTag})`);
+
+    const state = await hostJson(["manager-state"]);
+    const runningVersion = typeof state.version === "string" ? normalizeVersion(state.version) : null;
+    if (runningVersion === null) throw new ServiceError("the running manager reports no version; check it before an upgrade");
+    if (!olderThan(runningVersion, version)) throw new UsageError(`Arcane runs ${runningVersion}; ${version} is not newer`);
+    const container = state.container as { platform?: unknown } | undefined;
+
+    const spec = repoSpec(config);
+    const dir = await ensureCheckout(spec);
+    await git(spec, dir, ["pull", "--ff-only", "origin", config.gitopsBranch]);
+    const status = await repoStatus(spec, dir);
+    if (status.changed.length > 0) throw new ServiceError(`the arcane checkout has uncommitted changes: ${status.changed.join(", ")}`);
+    const file = join(dir, MANAGER_COMPOSE);
+    const pinned = pinCompose(readFileSync(file, "utf-8"), digest);
+
+    const stamp = utcStamp(new Date());
+    const steps: Record<string, unknown> = { from: runningVersion, to: version, digest, revision, stamp };
+    await hostJson(["manager-prepare", stamp]);
+    writeFileSync(file, pinned);
+    await git(spec, dir, ["add", MANAGER_COMPOSE]);
+    await git(spec, dir, ["commit", "--quiet", "-m", `arcane: manager ${tag} (${digest})`]);
+    const commit = (await git(spec, dir, ["rev-parse", "HEAD"])).trim();
+    await git(spec, dir, ["push", "origin", config.gitopsBranch]);
+    steps.commit = commit;
+
+    const stop = async (reason: string): Promise<number> => {
+        await git(spec, dir, ["revert", "--no-edit", commit]);
+        await git(spec, dir, ["push", "origin", config.gitopsBranch]);
+        printJson({ status: "stopped", reason, ...steps, revertedPin: true, note: "the manager was not restarted; the next file-only sync puts the previous Compose file back" });
+        return 0;
+    };
+
+    const deadline = Date.now() + SYNC_WAIT_MS;
+    for (;;) {
+        try {
+            const sync = await withCli(config, async (cli) => projectSync(await cliJson(cli, ["projects", "list", "--all"]), await cliJson(cli, ["gitops", "list", "--all"]), "arcane"));
+            const deployed = await hostJson(["manager-state"]);
+            if (syncReady(sync, commit, String(deployed.compose_sha256), sha256(pinned))) break;
+            if (Date.now() > deadline) return stop(`the file-only sync did not report success at ${commit.slice(0, 12)} with the committed Compose file within 30 minutes (last: ${sync.status ?? "none"} at ${sync.commit ?? "none"})`);
+        } catch (err) {
+            return stop(`waiting for the sync failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        await new Promise((r) => setTimeout(r, 30_000));
+    }
+    let pulled: Record<string, unknown>;
+    try {
+        pulled = await hostJson(["manager-pull", digest]);
+    } catch (err) {
+        return stop(err instanceof Error ? err.message : String(err));
+    }
+    if (pulled.revision !== revision || pulled.platform !== container?.platform) {
+        return stop(`the pulled image is ${String(pulled.platform)} at ${String(pulled.revision)}, expected ${String(container?.platform)} at ${revision}`);
+    }
+    try {
+        steps.backup = await hostJson(["manager-backup", stamp]);
+    } catch (err) {
+        return stop(err instanceof Error ? err.message : String(err));
+    }
+    let checks: VerifyCheck[];
+    try {
+        await hostJson(["manager-start"]);
+        const verify = await hostJson(["manager-verify", stamp, digest, version]);
+        checks = (Array.isArray(verify.checks) ? verify.checks : []) as VerifyCheck[];
+    } catch (err) {
+        checks = [{ check: "start and verify", ok: false, observed: err instanceof Error ? err.message : String(err) }];
+    }
+    let cliOk = true;
+    try {
+        await withCli(config, (cli) => cliJson(cli, ["version"]));
+    } catch {
+        cliOk = false;
+    }
+    checks.push({ check: "federated arcane-cli login", ok: cliOk });
+    if (checks.length > 1 && checks.every((c) => c.ok)) {
+        printJson({ status: "upgraded", ...steps, checks, arcaneCli: version, note: `install the matching arcane-cli: specialist-install arcane-cli ${version}` });
+        return 0;
+    }
+    const reason = failedChecks(checks) || "the checks returned nothing";
+    await git(spec, dir, ["revert", "--no-edit", commit]);
+    await git(spec, dir, ["push", "origin", config.gitopsBranch]);
+    const rollback = await hostJson(["manager-rollback", stamp]);
+    printJson({
+        status: "rolled back",
+        reason,
+        ...steps,
+        checks,
+        rollback,
+        revertedPin: true,
+        note: "the previous image and Compose file run again; if the new version migrated the database, restore the pre-upgrade data by hand (arcane/AGENTS.md, Upgrade rollback)",
+    });
+    return 0;
+}
+
+async function managerRollback(args: string[]): Promise<number> {
+    if (args.length !== 1) throw new UsageError("manager-rollback <stamp>");
+    printJson(await hostJson(["manager-rollback", args[0]]));
+    return 0;
+}
+
 export async function command(args: string[]): Promise<number> {
     if (args.length === 0 || args[0] === "--help" || args[0] === "help") {
         printRaw(HELP);
@@ -218,6 +489,11 @@ export async function command(args: string[]): Promise<number> {
     if (args[0] === "git") return repoCommand(repoSpec(config), args.slice(1));
     if (args[0] === "update-report") return updateReport(config, args.slice(1));
     if (args[0] === "release-notes") return releaseNotes(config, args.slice(1));
+    if (args[0] === "host") return hostCommand(config, args.slice(1));
+    if (args[0] === "project-status") return projectStatus(config, args.slice(1));
+    if (args[0] === "deployment") return deployment(config, args.slice(1));
+    if (args[0] === "manager-upgrade") return managerUpgrade(config, args.slice(1));
+    if (args[0] === "manager-rollback") return managerRollback(args.slice(1));
     return passthrough(config, args);
 }
 

package/specialists/edge/run.ts

@@ -73,9 +73,29 @@ const SINCE = /^[A-Za-z0-9 :\-+]{1,40}$/;
 /** Debian package names: lower-case letters, digits, plus, minus, period. */
 const PACKAGE = /^[a-z0-9][a-z0-9+.-]{0,63}$/;
 
+/**
+ * Public routes of services on the Arcane VM, checked from Cortex through
+ * public DNS the way users reach them: status code only, no redirect
+ * followed, no credentials. `expect` holds the codes a healthy route returns
+ * (the Supabase settings endpoint wants an API key, so 401; Studio redirects
+ * to the Pomerium sign-in; the rest answer 200, as arcane-ops judged them).
+ */
+export const PUBLIC_ROUTES: Readonly<Record<string, { url: string; expect: readonly number[] }>> = {
+    "supabase-auth-settings": { url: "https://supabase.37pla.net/auth/v1/settings", expect: [401] },
+    "supabase-jwks": { url: "https://supabase.37pla.net/auth/v1/.well-known/jwks.json", expect: [200] },
+    "supabase-openid": { url: "https://supabase.37pla.net/auth/v1/.well-known/openid-configuration", expect: [200] },
+    "supabase-oauth-discovery": { url: "https://supabase.37pla.net/auth/v1/.well-known/oauth-authorization-server", expect: [200] },
+    "supabase-studio": { url: "https://supabase-studio.37pla.net/", expect: [301, 302, 303, 307, 308] },
+    "grimoire-public": { url: "https://cli.grimoire.monadeo.com/v1/auth/config", expect: [200] },
+    "grimoire-public-health": { url: "https://cli.grimoire.monadeo.com/healthz", expect: [200] },
+    "mealie-public": { url: "https://mealie.37pla.net/api/recipes?page=1&perPage=1", expect: [200] },
+};
+
 const HELP = `edge specialist (Frontdoor VPS through an IAP tunnel)
 
   probe                       GET the public OpenID discovery document through the VPS address
+  route-probe [name...]       HTTP status of public routes from Cortex, no redirects, no credentials:
+                              ${Object.keys(PUBLIC_ROUTES).join(", ")}
   vps <command> [args]        fixed operations through the forced-command SSH key
 ${Object.entries(VPS_COMMANDS)
     .map(([name, c]) => `      ${name.padEnd(14)} ${c.help}`)
@@ -206,11 +226,31 @@ async function probe(config: EdgeConfig): Promise<number> {
     return ok ? 0 : 1;
 }
 
+/** One status check per route; redirects are reported, never followed. */
+export async function routeProbe(names: string[], curl: (args: string[]) => Promise<{ stdout: string; code: number }>): Promise<Record<string, unknown>[]> {
+    const unknown = names.filter((n) => !(n in PUBLIC_ROUTES));
+    if (unknown.length > 0) throw new UsageError(`unknown route: ${unknown.join(", ")}; known: ${Object.keys(PUBLIC_ROUTES).join(", ")}`);
+    const picked = names.length > 0 ? names : Object.keys(PUBLIC_ROUTES);
+    return Promise.all(
+        picked.map(async (name) => {
+            const route = PUBLIC_ROUTES[name];
+            const result = await curl(["--silent", "--output", "/dev/null", "--max-time", "10", "--proto", "=https", "--write-out", "%{http_code} %{time_total}", route.url]);
+            const [code, seconds] = result.stdout.trim().split(" ");
+            const status = Number(code);
+            return { route: name, url: route.url, httpCode: Number.isInteger(status) && status > 0 ? status : null, expected: route.expect, ok: result.code === 0 && route.expect.includes(status), seconds: seconds ? Number(seconds) : null, curlExit: result.code };
+        }),
+    );
+}
+
 export async function command(args: string[]): Promise<number> {
     if (args.length === 0 || args[0] === "--help" || args[0] === "help") {
         printRaw(HELP);
         return 0;
     }
+    if (args[0] === "route-probe") {
+        printJson(await routeProbe(args.slice(1), (curlArgs) => run("/usr/bin/curl", curlArgs, { timeoutMs: 20_000 })));
+        return 0;
+    }
     const config = readConfig<EdgeConfig>(SERVICE, SHAPE);
     switch (args[0]) {
         case "probe":

package/specialists/entry/remote/spc-arcane-host-entry.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+# Forced command for the arcane specialist's key on VM 100 (user spc-arcane, no docker group).
+# authorized_keys line:
+#   command="/usr/local/sbin/spc-arcane-host-entry",no-port-forwarding,no-agent-forwarding,no-pty,no-X11-forwarding ssh-ed25519 AAAA... spc-arcane-host@cortex
+# The command is split into words without globbing and handed to the root-owned
+# spc-arcane-op, the only command its sudoers entry allows; that file checks the
+# operation name and every argument. Standard input passes through (mealie-api).
+set -eu
+cmd="${SSH_ORIGINAL_COMMAND:-}"
+case "$cmd" in
+  "" | *[!A-Za-z0-9\ ._:/+-]*) echo "refused: characters outside A-Z a-z 0-9 space . _ : / + -" >&2; exit 2 ;;
+esac
+set -f
+# shellcheck disable=SC2086
+exec /usr/bin/sudo -n /usr/local/sbin/spc-arcane-op $cmd

package/specialists/entry/remote/spc-arcane-install.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+# One-time setup of the spc-arcane user on VM 100 for the arcane specialist.
+# Run as root with these files in /tmp/spc-arcane: spc-arcane-host-entry,
+# spc-arcane-op, spc-arcane-sudoers, spc-arcane-host.pub, and the arcane-ops
+# probes host_probe.py, resource_probe.py, incident_probe.py, kernel_probe.py,
+# storage_probe.py, queue_probe.py, mealie_probe.py, radarr_probe.py.
+# Idempotent; reinstalling updates the files and keeps the user.
+set -eu
+src=/tmp/spc-arcane
+probes="host_probe resource_probe incident_probe kernel_probe storage_probe queue_probe mealie_probe radarr_probe"
+for f in spc-arcane-host-entry spc-arcane-op spc-arcane-sudoers spc-arcane-host.pub; do
+  [ -f "$src/$f" ] || { echo "missing $src/$f" >&2; exit 2; }
+done
+for p in $probes; do
+  [ -f "$src/$p.py" ] || { echo "missing $src/$p.py" >&2; exit 2; }
+done
+visudo -cf "$src/spc-arcane-sudoers"
+id spc-arcane >/dev/null 2>&1 || useradd --system --create-home --home-dir /var/lib/spc-arcane --shell /bin/sh spc-arcane
+install -d -o root -g root -m 0755 /usr/local/lib/spc-arcane
+for p in $probes; do
+  install -o root -g root -m 0644 "$src/$p.py" "/usr/local/lib/spc-arcane/$p.py"
+done
+install -o root -g root -m 0755 "$src/spc-arcane-op" /usr/local/sbin/spc-arcane-op
+install -o root -g root -m 0755 "$src/spc-arcane-host-entry" /usr/local/sbin/spc-arcane-host-entry
+install -o root -g root -m 0440 "$src/spc-arcane-sudoers" /etc/sudoers.d/spc-arcane
+install -d -o root -g root -m 0700 /var/backups/spc-arcane
+install -d -o spc-arcane -g spc-arcane -m 0700 /var/lib/spc-arcane/.ssh
+printf 'command="/usr/local/sbin/spc-arcane-host-entry",no-port-forwarding,no-agent-forwarding,no-pty,no-X11-forwarding %s\n' "$(cat "$src/spc-arcane-host.pub")" > /var/lib/spc-arcane/.ssh/authorized_keys
+chown spc-arcane:spc-arcane /var/lib/spc-arcane/.ssh/authorized_keys
+chmod 0600 /var/lib/spc-arcane/.ssh/authorized_keys
+rm -rf "$src"
+echo "spc-arcane ready: $(id spc-arcane)"
+echo "groups (must not include docker): $(id -nG spc-arcane)"
+echo "sshd key sources and user filters:"
+sshd -T 2>/dev/null | grep -Ei '^(authorizedkeysfile|authorizedkeyscommand|pubkeyauthentication|allowusers|allowgroups|denyusers|denygroups) ' || true