@bongos/core 1.17.2 → 1.18.0

package/public-landing/create.html

@@ -182,6 +182,25 @@ input[type=text].bad{border-color:var(--err);}
 }
 .reassure.on{display:block;}
 
+/* one-click deep link to GitHub's own "New repository" page with the name
+   pre-filled (greenfield only). No permissions — the visitor creates the empty
+   repo in GitHub's own UI; we just fill in the blanks. */
+.ghbtn{
+  display:inline-flex;align-items:center;gap:9px;text-decoration:none;cursor:pointer;
+  background:#24292f;color:#fff;border:none;border-radius:999px;
+  font-family:var(--font-body);font-weight:700;font-size:15px;padding:12px 22px;
+  box-shadow:0 12px 26px -12px rgba(36,41,47,0.55);
+  transition:transform .12s ease, background .12s ease;
+}
+.ghbtn:hover{background:#1b1f24;transform:translateY(-1px);}
+.ghbtn:active{transform:translateY(0) scale(.98);}
+.ghbtn .gh{width:18px;height:18px;fill:currentColor;}
+.ghcreate{display:none;margin-bottom:18px;}
+.ghcreate.on{display:block;}
+.ghcreate-note{font-size:13px;font-weight:500;color:var(--ink-faint);line-height:1.5;margin-top:9px;max-width:52ch;}
+.ghcreate-note strong{color:var(--ink-soft);}
+.steps .ghbtn{font-size:14px;padding:9px 16px;margin-top:10px;}
+
 /* buttons */
 .nav{display:flex;align-items:center;justify-content:space-between;gap:12px;margin-top:26px;}
 .btn{
@@ -394,6 +413,13 @@ input[type=text].bad{border-color:var(--err);}
             <input type="text" id="f-repo" placeholder="mercury" autocomplete="off" maxlength="120">
           </label>
         </div>
+        <div class="ghcreate" id="ghCreate">
+          <a class="ghbtn" id="ghCreateBtn" href="https://github.com/new" target="_blank" rel="noopener">
+            <svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>
+            Create this repo on GitHub
+          </a>
+          <p class="ghcreate-note">Opens GitHub with the name already filled in — just click <strong>Create repository</strong> and leave it empty, then come back and press Next. Already made it? Just press Next.</p>
+        </div>
         <div class="hint" id="h-home">&nbsp;</div>
         <div class="nav">
           <button type="button" class="btn ghost" data-back="1">← Back</button>
@@ -470,7 +496,7 @@ input[type=text].bad{border-color:var(--err);}
   /* ── state ── */
   var DRAFT_KEY = 'cb-create-draft';
   var CREATED_KEY = 'cb-created-instance';
-  var state = { step: 0, name: '', mode: 'greenfield', owner: '', repo: '', slug: '', slugTouched: false, domain: '' };
+  var state = { step: 0, name: '', mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '' };
   try { Object.assign(state, JSON.parse(sessionStorage.getItem(DRAFT_KEY) || '{}')); } catch (e) {}
   var me = null;
 
@@ -483,6 +509,7 @@ input[type=text].bad{border-color:var(--err);}
     if (handedName && handedName.trim()) {
       state.name = handedName.trim().slice(0, 80);
       state.slug = deriveSlug(state.name); state.slugTouched = false; // (hoisted declaration)
+      state.repo = deriveRepo(state.name); state.repoTouched = false; // auto-repo from the name
       state.step = state.step >= 1 && state.step <= 4 ? state.step : 1;
       try { sessionStorage.setItem(DRAFT_KEY, JSON.stringify(state)); } catch (e) {}
       history.replaceState(null, '', location.pathname);
@@ -507,14 +534,19 @@ input[type=text].bad{border-color:var(--err);}
     var v = String(s || '');
     return v.length >= 2 && v.length <= 40 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(v) && v.indexOf('--') === -1;
   }
-  function deriveSlug(name) {
+  function slugify(name, maxLen) {
     return String(name || '').toLowerCase()
       .replace(/['’]/g, '')
       .replace(/[^a-z0-9]+/g, '-')
       .replace(/-+/g, '-')
       .replace(/^-|-$/g, '')
-      .slice(0, 40);
+      .slice(0, maxLen);
   }
+  function deriveSlug(name) { return slugify(name, 40); }
+  /* Repo-name default from the project name — the same slug-safe transform (GitHub
+     repo names accept [A-Za-z0-9._-], so a lowercase-dashed name is always valid and
+     matches the placeholder). Wider cap than the handle; the visitor can still edit. */
+  function deriveRepo(name) { return slugify(name, 100); }
   function looksLikeDomain(d) {
     return /^(?!-)[a-z0-9-]{1,63}(?<!-)(\.(?!-)[a-z0-9-]{1,63}(?<!-))+$/i.test(String(d || ''));
   }
@@ -524,6 +556,20 @@ input[type=text].bad{border-color:var(--err);}
     var origin = 'https://' + domain;
     return { homepageUrl: origin, callbackUrl: origin + '/api/gds/auth/web/callback' };
   }
+  /* GitHub's own "New repository" page, pre-filled with the owner + name. No auth or
+     permissions on our side — the visitor creates the empty repo in GitHub's UI, which
+     is exactly what the scaffold then clones. `owner` selects the account/org; omitting
+     a blank param just leaves that field empty on GitHub. */
+  function githubNewRepoUrl(owner, repo) {
+    var u = new URL('https://github.com/new');
+    if (repo) u.searchParams.set('name', repo);
+    if (owner) u.searchParams.set('owner', owner);
+    return u.toString();
+  }
+  function updateGhCreateHref() {
+    var a = $('ghCreateBtn');
+    if (a) a.href = githubNewRepoUrl(state.owner, state.repo);
+  }
   function esc(s) {
     return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
       return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
@@ -559,12 +605,25 @@ input[type=text].bad{border-color:var(--err);}
   $('f-slug').value = state.slug;
   $('f-domain').value = state.domain;
 
+  /* Auto-fill the repo name from the project name until the visitor edits it
+     directly (mirrors the handle's auto-derive). The owner is filled once we know
+     who's signed in — see the /me boot below. */
+  if (!state.repoTouched && state.name && !state.repo) {
+    state.repo = deriveRepo(state.name);
+    $('f-repo').value = state.repo;
+  }
+
   $('f-name').addEventListener('input', function () {
     state.name = this.value;
     if (!state.slugTouched) {
       state.slug = deriveSlug(state.name);
       $('f-slug').value = state.slug;
     }
+    if (!state.repoTouched) {
+      state.repo = deriveRepo(state.name);
+      $('f-repo').value = state.repo;
+      updateGhCreateHref();
+    }
     var h = $('h-name');
     if (state.slug) { h.innerHTML = 'its handle on the platform: <code>' + esc(state.slug) + '</code>'; h.className = 'hint'; }
     else { h.innerHTML = '&nbsp;'; }
@@ -577,14 +636,18 @@ input[type=text].bad{border-color:var(--err);}
     $('c-green').setAttribute('aria-pressed', String(mode === 'greenfield'));
     $('c-adopt').setAttribute('aria-pressed', String(mode === 'adopt'));
     $('adoptNote').classList.toggle('on', mode === 'adopt');
+    // The "create the repo on GitHub" button only makes sense when starting fresh —
+    // an adopted repo already exists.
+    $('ghCreate').classList.toggle('on', mode === 'greenfield');
+    updateGhCreateHref();
     saveDraft();
   }
   $('c-green').addEventListener('click', function () { setMode('greenfield'); });
   $('c-adopt').addEventListener('click', function () { setMode('adopt'); });
   setMode(state.mode);
 
-  $('f-owner').addEventListener('input', function () { state.owner = this.value.trim(); saveDraft(); });
-  $('f-repo').addEventListener('input', function () { state.repo = this.value.trim(); saveDraft(); });
+  $('f-owner').addEventListener('input', function () { state.owner = this.value.trim(); state.ownerTouched = true; updateGhCreateHref(); saveDraft(); });
+  $('f-repo').addEventListener('input', function () { state.repo = this.value.trim(); state.repoTouched = true; updateGhCreateHref(); saveDraft(); });
 
   $('f-slug').addEventListener('input', function () {
     state.slugTouched = true;
@@ -719,9 +782,12 @@ input[type=text].bad{border-color:var(--err);}
 
     var steps = [];
     var repoLabel = state.owner && state.repo ? '<strong>' + esc(state.owner + '/' + state.repo) + '</strong>' : 'your new repository';
+    var ghNewUrl = githubNewRepoUrl(state.owner, state.repo);
+    var ghIcon = '<svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>';
     steps.push(adopt
       ? '<li data-onboard-step="github-repo"><b>Layer onto your existing repo</b><p>In your repo run <code style="font-family:var(--font-mono)">bongos init --adopt</code>. It shows a conflict pre-flight and writes <em>nothing</em> until you accept — your files and history stay yours, and your existing backlog is imported. Commit and push.</p></li>'
-      : '<li data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>On github.com: New repository → ' + repoLabel + ' → leave it completely empty.</p></li>');
+      : '<li data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the name already filled in), press <strong>Create repository</strong>, and leave it completely empty. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
+        '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + ghIcon + 'Create ' + repoLabel + ' on GitHub</a></li>');
     if (!state.domain) {
       steps.push('<li><b>Add a domain you own</b><p>Sign-in on your new instance needs a real domain. When you have one, come back here or ask your hall — the address gets wired in minutes.</p></li>');
     }
@@ -829,8 +895,10 @@ input[type=text].bad{border-color:var(--err);}
     again.addEventListener('click', function () {
       stopPolling();
       try { sessionStorage.removeItem(CREATED_KEY); sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
-      state = { step: 1, name: '', mode: 'greenfield', owner: '', repo: '', slug: '', slugTouched: false, domain: '' };
+      state = { step: 1, name: '', mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '' };
       $('f-name').value = ''; $('f-owner').value = ''; $('f-repo').value = ''; $('f-slug').value = ''; $('f-domain').value = '';
+      // Re-seed the owner from the signed-in account for the next project.
+      if (me && me.github_login) { state.owner = me.github_login; $('f-owner').value = state.owner; }
       $('h-name').innerHTML = '&nbsp;';
       setMode('greenfield');
       show(1);
@@ -884,6 +952,14 @@ input[type=text].bad{border-color:var(--err);}
     .then(function (data) {
       me = data.builder || data.me || data;
       renderWho();
+      // Default the GitHub owner to the signed-in account until the visitor edits
+      // it — one less field to fill for the common "my own account" case.
+      if (!state.ownerTouched && !state.owner && me && me.github_login) {
+        state.owner = me.github_login;
+        $('f-owner').value = state.owner;
+        updateGhCreateHref();
+        saveDraft();
+      }
       // returning after a create? resume watching that instance instead of a blank wizard
       var created = null;
       try { created = JSON.parse(sessionStorage.getItem(CREATED_KEY) || 'null'); } catch (e) {}

package/public-landing/index.html

@@ -45,20 +45,17 @@ body{
 .stage{
   position:relative;z-index:1;min-height:100vh;
   display:flex;flex-direction:column;align-items:center;justify-content:center;
-  text-align:center;padding:48px 24px 110px;gap:8px;
+  text-align:center;padding:48px 24px 64px;gap:8px;
 }
 /* a soft white glow behind the mascot so a white- or transparent-bg PNG blends */
 .hero-mascot{
   position:relative;width:min(540px,86vw);margin-bottom:6px;
-  /* cap by height on short viewports so the hall CTA + sign-in hint always clear
-     the fixed footer (task 2094); on tall desktops the width cap wins, unchanged */
-  max-height:50vh;display:flex;justify-content:center;
 }
 .hero-mascot::before{
   content:"";position:absolute;inset:-6% -10%;z-index:-1;border-radius:50%;
   background:radial-gradient(ellipse at center, rgba(255,255,255,0.95) 0%, rgba(255,255,255,0.7) 45%, rgba(255,255,255,0) 72%);
 }
-.hero-mascot img{display:block;width:100%;height:auto;max-height:50vh;object-fit:contain;}
+.hero-mascot img{display:block;width:100%;height:auto;}
 /* fallback shown if buddha.png is not present yet */
 .mascot-fallback{
   width:min(540px,86vw);aspect-ratio:1.6/1;border-radius:28px;
@@ -80,27 +77,9 @@ body{
   border:none;border-radius:999px;padding:15px 32px;text-decoration:none;
   display:inline-flex;align-items:center;gap:9px;
   background:var(--accent);color:#fff;box-shadow:0 12px 28px -10px var(--accent);
-  transition:transform .12s ease, box-shadow .12s ease, background .12s ease;
+  transition:transform .12s ease, box-shadow .12s ease;
 }
 .btn:hover{transform:translateY(-1px);box-shadow:0 16px 34px -10px var(--accent);}
-.btn.ghost{background:rgba(255,255,255,0.75);color:var(--ink);box-shadow:0 6px 18px -8px rgba(42,31,23,0.25);}
-.btn.ghost:hover{box-shadow:0 10px 24px -8px rgba(42,31,23,0.3);}
-/* signed-out: the create door is visible but resting — it hints, and clicking it
-   starts the GitHub sign-in (returning straight into /create). */
-.btn.resting{background:#eeddc8;color:#a08a74;box-shadow:none;}
-.btn.resting:hover{background:#ecd6ba;transform:none;box-shadow:none;}
-.cta-row{display:flex;gap:14px;flex-wrap:wrap;justify-content:center;}
-.signin-hint{font-size:13.5px;font-weight:600;color:var(--ink-soft);margin-top:14px;min-height:19px;}
-.signin-hint a{color:var(--accent-deep);text-decoration:none;font-weight:700;}
-.signin-hint a:hover{text-decoration:underline;}
-.who{
-  position:fixed;top:16px;right:20px;z-index:2;display:flex;align-items:center;gap:9px;
-  font-size:14px;font-weight:600;color:var(--ink-soft);min-height:30px;
-}
-.who img{width:28px;height:28px;border-radius:50%;border:2px solid #fff;box-shadow:0 2px 8px rgba(42,31,23,0.14);}
-.who a{color:var(--accent-deep);text-decoration:none;font-weight:700;}
-.who a:hover{text-decoration:underline;}
-.who .who-act{padding-left:10px;margin-left:2px;border-left:1px solid rgba(42,31,23,0.18);}
 .foot{
   position:fixed;bottom:18px;left:0;right:0;z-index:1;text-align:center;
   color:var(--ink-soft);font-size:13px;opacity:0.8;
@@ -119,68 +98,24 @@ body{
   </div>
   <div class="wordmark" data-brand-product>cloud bongos</div>
   <p class="tagline" data-brand-tagline>Building software is laying down a beat.</p>
-  <div class="cta-row">
-    <a class="btn" id="hallBtn" data-link-hall href="https://builders.cloudbongos.com">Enter the Hall →</a>
-  </div>
-  <p class="signin-hint" id="signinHint" aria-live="polite"></p>
+  <a class="btn" data-link-hall href="https://builders.cloudbongos.com">Enter the Hall →</a>
 </main>
-<div class="who" id="who" aria-live="polite"></div>
 
 <div class="foot">A non-profit, capture-resistant commons. Built by agents, on Cloud Bongos.</div>
 
 <script>
 /* Brand-pack fill (R57). The server injects window.__BRANDING__ synchronously
-   ahead of this script (src/bongos/serve-internal.js); the baked markup above is
+   ahead of this script (src/gds/serve-internal.js); the baked markup above is
    the no-JS / standalone fallback. A differently-branded game-less instance
    overrides the product name, tagline, and Hall link from its own config. */
 (function () {
   var b = (typeof window !== 'undefined' && window.__BRANDING__) || null;
-  if (b) {
-    var id = b.identity || {}, copy = b.copy || {}, dom = b.domains || {};
-    var set = function (sel, val){ if(!val) return; document.querySelectorAll(sel).forEach(function(n){ n.textContent = val; }); };
-    if (id.productName) set('[data-brand-product]', id.productName.toLowerCase());
-    if (copy.tagline) set('[data-brand-tagline]', copy.tagline);
-    if (dom.buildersOrigin) document.querySelectorAll('[data-link-hall]').forEach(function(n){ n.setAttribute('href', dom.buildersOrigin); });
-  }
-
-  /* Membership-aware hall access (goal 35, task 2094). This is a PROJECT's own
-     landing page. Signed in as an admitted builder here → "Enter the Hall".
-     Otherwise → "Request access" (this project's own hall shows the request-
-     access card), with a quiet "already a builder? sign in" for returning
-     builders. Sign-in is itself gated to approved builders (auth.js), so a
-     newcomer who tries it is routed to request access anyway. The identity +
-     action live top-right. Degrades to the request-access visual when the API
-     is unreachable (static preview / standalone viewing). */
-  var hallHref = (b && b.domains && b.domains.buildersOrigin) || 'https://builders.cloudbongos.com';
-  var signInHref = '/api/bongos/auth/web/start?return=' + encodeURIComponent('/');
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
-  var hallBtn = document.getElementById('hallBtn');
-  var signinHint = document.getElementById('signinHint');
-  var who = document.getElementById('who');
-
-  function showSignedOut() {
-    if (hallBtn) { hallBtn.textContent = 'Request access'; hallBtn.setAttribute('href', hallHref); }
-    if (signinHint) signinHint.innerHTML = 'Already a builder here? <a href="' + signInHref + '">Sign in with GitHub</a>.';
-    if (who) who.innerHTML = '<a href="' + signInHref + '">Sign in with GitHub</a>';
-  }
-  function showMember(me) {
-    if (hallBtn) { hallBtn.textContent = 'Enter the Hall →'; hallBtn.setAttribute('href', hallHref); }
-    if (signinHint) signinHint.textContent = '';
-    if (who) who.innerHTML =
-      (me.avatar_url ? '<img src="' + esc(me.avatar_url) + '" alt="">' : '') +
-      '<span>' + esc(me.github_login || 'signed in') + '</span>' +
-      '<a class="who-act" href="' + hallHref + '">Enter hall →</a>';
-  }
-
-  showSignedOut();   // default until /me resolves (and the no-JS request-access intent)
-  fetch('/api/bongos/me', { credentials: 'same-origin' })
-    .then(function (res) { if (!res.ok) throw new Error(String(res.status)); return res.json(); })
-    .then(function (data) { showMember(data.builder || data.me || data); })
-    .catch(function () { /* signed out / not a member / unreachable: request-access visual stands */ });
+  if (!b) return;
+  var id = b.identity || {}, copy = b.copy || {}, dom = b.domains || {};
+  function set(sel, val){ if(!val) return; document.querySelectorAll(sel).forEach(function(n){ n.textContent = val; }); }
+  if (id.productName) set('[data-brand-product]', id.productName.toLowerCase());
+  if (copy.tagline) set('[data-brand-tagline]', copy.tagline);
+  if (dom.buildersOrigin) document.querySelectorAll('[data-link-hall]').forEach(function(n){ n.setAttribute('href', dom.buildersOrigin); });
 })();
 </script>
 </body>

package/scripts/gds/provision.js

@@ -98,6 +98,11 @@ const CONFIG = {
   // <slug>.caddy file (idempotent overwrite, no fragile append to a shared file);
   // the main Caddyfile carries a one-time `import <dir>/*.caddy` (operator setup).
   caddySnippetDir: process.env.PROVISION_CADDY_SNIPPET_DIR || '/etc/caddy/sites',
+  // Where nightly pg_dump backups land (db-backup-nightly.sh's GDS_BACKUP_DIR
+  // default). Shared across co-tenant instances on one box — dumps are named
+  // `<db>-<ts>.sql.gz`, so each instance's files + retention prune stay scoped to
+  // its own DB. Owned by the app user, mode 0750. (task 2213, productizes 2210.)
+  backupDir: process.env.PROVISION_BACKUP_DIR || '/var/backups/gds',
   // Dedicated-droplet defaults (only used for hosting_shape='dedicated').
   region: process.env.PROVISION_REGION || 'nyc3',
   baseImage: process.env.PROVISION_BASE_IMAGE || 'ubuntu-24-04-x64',
@@ -252,6 +257,10 @@ function seedFirstVersionCmd(inst, { privileged = false } = {}) {
 // It is the ADR 0108 DESTINATION model; these generators make provision.js drive the
 // scripts/deploy/deploy-instance.sh runbook API-driven instead of by hand.
 const CORE_PKG_DIR = 'node_modules/@bongos/core';
+// The unix account the instance's Node process + its backup timer run as. Mirrors
+// serviceUnit's hardcoded `User=lars`/`Group=lars` (the droplet's app user); kept as
+// one constant so the backup dir owner + the backup unit's User= can't drift from it.
+const APP_USER = 'lars';
 function standaloneRoot(inst, { base = CONFIG.standaloneBase } = {}) { return path.posix.join(base, inst.slug); }
 // Sync the instance's own repo (host content + the core pin). Mirrors deploy-instance.sh
 // step 1 — assumes the repo is already cloned at standaloneRoot (initial clone is a
@@ -447,6 +456,80 @@ WantedBy=multi-user.target
 }
 function serviceUnitPath(inst) { return `/etc/systemd/system/${inst.slug}.service`; }
 
+// ── nightly DB backup: per-instance timer + service (task 2213) ─────────────
+// PRODUCTIZES the manual task-2210 fix: a newly-provisioned instance was born with
+// NO backups (dir absent, GDS_BACKUP_DB unset → the script fell back to the
+// nonexistent `amazonprimea` default, and the repo's global gds-db-backup units
+// hardcode /home/lars/amazonprimea — wrong for the consumer node_modules/@bongos/
+// core layout). These generators emit a PER-INSTANCE unit pair that fixes all three:
+//   • name  → `<slug>-db-backup.{service,timer}` so co-tenant instances on one box
+//             never collide (each dumps its OWN db; the script's retention prune is
+//             already `<db>-*.sql.gz`-scoped, so a shared backupDir is safe).
+//   • DB    → Environment=GDS_BACKUP_DB=<instance db>, set on the unit (not read from
+//             the web.env) so the dump targets the right database with no fallback.
+//   • path  → ExecStart resolves the canonical script INSIDE the instance's pinned
+//             @bongos/core (standalone) or this control-plane checkout (co-tenant),
+//             the SAME workDir/CORE_PKG_DIR split serviceUnit uses — never the old
+//             monorepo path.
+function backupUnitName(inst) { return `${inst.slug}-db-backup`; }
+function backupServicePath(inst) { return `/etc/systemd/system/${backupUnitName(inst)}.service`; }
+function backupTimerPath(inst) { return `/etc/systemd/system/${backupUnitName(inst)}.timer`; }
+// The consumer-layout-correct absolute path to db-backup-nightly.sh. Standalone runs
+// it from the instance's own pinned core; co-tenant/dedicated from this checkout's
+// scripts/gds/ — mirrors serviceUnit's execStart resolution so they can't diverge.
+function backupScriptPath(inst) {
+  const rel = 'scripts/gds/db-backup-nightly.sh';
+  return inst.hosting_shape === 'standalone'
+    ? path.posix.join(standaloneRoot(inst), CORE_PKG_DIR, rel)
+    : path.posix.join(REPO_ROOT, rel);
+}
+function backupService(inst, { backupDir = CONFIG.backupDir } = {}) {
+  return `[Unit]
+Description=Nightly pg_dump of the ${inst.slug} GDS DB (provisioned by provision.js, task 2213)
+After=postgresql.service
+Requires=postgresql.service
+
+[Service]
+Type=oneshot
+User=${APP_USER}
+Group=${APP_USER}
+# The DB to dump + where dumps land — set on the unit (not via the instance web.env)
+# so the dump targets the right database with no fallback to a stale default (root
+# cause of the task-2210 breakage). db-backup-nightly.sh reads both as env.
+Environment=GDS_BACKUP_DB=${dbName(inst)}
+Environment=GDS_BACKUP_DIR=${backupDir}
+# Consumer-layout path: the canonical script inside this instance's pinned core.
+ExecStart=/bin/bash ${backupScriptPath(inst)}
+# Modest hardening — the script only needs read on the pg socket + write on the
+# backup dir. Mirrors the repo's gds-db-backup.service.
+NoNewPrivileges=true
+ProtectSystem=strict
+ReadWritePaths=${backupDir}
+ProtectHome=read-only
+PrivateTmp=true
+
+[Install]
+# Not socket-activated; the timer drives this. The timer's WantedBy is what enables.
+`;
+}
+function backupTimer(inst) {
+  return `[Unit]
+Description=Daily timer for the ${inst.slug} GDS DB pg_dump (provisioned by provision.js, task 2213)
+
+[Timer]
+# 04:00 UTC daily, mirroring the repo's gds-db-backup.timer (low-traffic window).
+OnCalendar=*-*-* 04:00:00 UTC
+# Catch up on next boot if the box was off when the timer was due.
+Persistent=true
+# Jitter so simultaneous timers don't dogpile the disk at exactly 04:00.
+RandomizedDelaySec=300
+Unit=${backupUnitName(inst)}.service
+
+[Install]
+WantedBy=timers.target
+`;
+}
+
 // The branding pack a provisioned CO-TENANT instance loads: the shared, committed
 // neutral starter (the co-tenant model shares ONE checkout, differentiated only by
 // env — src/branding.js's GDS_BRANDING_FILE knob). Per-instance identity/domains
@@ -950,6 +1033,21 @@ async function provisionInstance(inst, deps) {
     boxExec(`${sudoP}systemctl enable --now ${inst.slug}`);
   } else { log('    (unit baked into cloud-init)'); }
 
+  // ── step 4b: nightly DB backup — dir + consumer-layout timer/service (task 2213) ──
+  // Every instance must be born WITH backups (the task-2210 gap: cloudbongos was
+  // provisioned without any). Create the app-user-owned backup dir, install the
+  // per-instance timer/service (correct db + consumer-layout script path), enable
+  // the timer. Idempotent: `install -d` no-ops on an existing dir, unit writes are
+  // overwrites, `enable --now` is idempotent. Dedicated bakes the same into cloud-init.
+  log('  [backup] create backup dir + install + enable nightly DB backup timer');
+  if (local) {
+    boxExec(`${sudoP}install -d -o ${APP_USER} -g ${APP_USER} -m 0750 ${CONFIG.backupDir}`);
+    boxWriteFile(backupServicePath(inst), backupService(inst), { mode: 0o644, sudo: true });
+    boxWriteFile(backupTimerPath(inst), backupTimer(inst), { mode: 0o644, sudo: true });
+    boxExec(`${sudoP}systemctl daemon-reload`);
+    boxExec(`${sudoP}systemctl enable --now ${backupUnitName(inst)}.timer`);
+  } else { log('    (backup dir + units baked into cloud-init)'); }
+
   // ── step 5: DNS — Cloudflare A-record UPSERT for the instance's domain (P4) ──
   // Formalized in P4 (#1945): the shared box-dns-cloudflare.sh hook UPSERTs an A
   // record pointing the domain at its target IP (recordIp), in the domain's own
@@ -1009,12 +1107,28 @@ async function provisionInstance(inst, deps) {
 // SAME pure command generators so local + dedicated never diverge.
 function dedicatedUserData(inst) {
   const i = { ...inst, db_name: inst.db_name || inst.slug };
+  // task 2213: a dedicated droplet gets the same nightly backup as local shapes —
+  // write the per-instance unit pair (base64-encoded to sidestep YAML block-scalar
+  // escaping of the multi-line bodies), create the app-user-owned backup dir, and
+  // enable the timer alongside the web unit. Mirrors provisionInstance's step 4b.
+  const svcB64 = Buffer.from(backupService(i), 'utf8').toString('base64');
+  const timerB64 = Buffer.from(backupTimer(i), 'utf8').toString('base64');
   return `#cloud-config
+write_files:
+  - path: ${backupServicePath(i)}
+    encoding: b64
+    permissions: '0644'
+    content: ${svcB64}
+  - path: ${backupTimerPath(i)}
+    encoding: b64
+    permissions: '0644'
+    content: ${timerB64}
 runcmd:
   - [ bash, -lc, "${dbCreateCmd(i)} || true" ]
   - [ bash, -lc, "cd ${REPO_ROOT} && ${migrateCmd(i)}" ]
   - [ bash, -lc, "${seedFirstVersionCmd(i)}" ]
-  - [ bash, -lc, "systemctl daemon-reload && systemctl enable --now ${i.slug}" ]
+  - [ bash, -lc, "install -d -o ${APP_USER} -g ${APP_USER} -m 0750 ${CONFIG.backupDir}" ]
+  - [ bash, -lc, "systemctl daemon-reload && systemctl enable --now ${i.slug} ${backupUnitName(i)}.timer" ]
 `;
 }
 
@@ -1034,10 +1148,16 @@ async function teardownInstance(inst, deps) {
   if (inst.hosting_shape !== 'dedicated') {
     boxExec(`${sudoP}systemctl disable --now ${inst.slug}`, { allowFail: true });
     boxExec(`${sudoP}rm -f ${serviceUnitPath(inst)}`, { allowFail: true });
+    // Stop + remove the nightly backup units too (task 2213). The backup DIR + its
+    // dumps are left in place — like the DB below, they are precious data a teardown
+    // must not silently destroy.
+    boxExec(`${sudoP}systemctl disable --now ${backupUnitName(inst)}.timer`, { allowFail: true });
+    boxExec(`${sudoP}rm -f ${backupServicePath(inst)} ${backupTimerPath(inst)}`, { allowFail: true });
     boxExec(`${sudoP}systemctl daemon-reload`, { allowFail: true });
-    // DB + Caddy block are left for an explicit operator (data is precious; a
-    // teardown should not silently dropdb). We log the manual follow-ups.
-    log(`  (left for the operator: dropdb ${dbName(inst)}, remove the Caddy block for ${inst.slug})`);
+    // DB + Caddy block + backup dumps are left for an explicit operator (data is
+    // precious; a teardown should not silently dropdb or delete backups). Log the
+    // manual follow-ups.
+    log(`  (left for the operator: dropdb ${dbName(inst)}, remove the Caddy block for ${inst.slug}, prune ${CONFIG.backupDir}/${dbName(inst)}-*.sql.gz)`);
   } else if (apply && deps.doApi && inst.droplet_id) {
     await deps.doApi.deleteDroplet(inst.droplet_id);
   }
@@ -1396,6 +1516,7 @@ module.exports = {
   CONFIG, MAX_INTENT_ATTEMPTS,
   // pure step generators (tested directly)
   dbName, dbCreateCmd, migrateCmd, seedFirstVersionCmd, serviceUnit, serviceUnitPath, webEnvBody, webEnvPath,
+  backupUnitName, backupServicePath, backupTimerPath, backupScriptPath, backupService, backupTimer,
   standaloneRoot, standalonePullCmd, standaloneInstallCmd, standaloneMigrateCmd,
   // standalone scaffold (ADR 0108 / 0125, task 2055)
   parseTargetRef, instanceRepoRemote, instanceInitSpec, scaffoldStandaloneRepo, coreVersionSafe,

package/scripts/gds/ship.js

@@ -84,7 +84,17 @@ const GRADER_TIMEOUT_MS = 240_000; // 4 min — Opus on a big diff with Read too
 // feature worktree this script lives in. Falls back to two-levels-up if we
 // can't ask git (e.g. fresh clone with no `main` worktree set up yet).
 const REPO_ROOT = findMainWorktree(__dirname) || path.resolve(__dirname, '..', '..');
-const { playSound } = require(path.resolve(__dirname, '../../.claude/sounds/play.js'));
+// Sound playback is COSMETIC — the ship pipeline must NEVER depend on it. Guard
+// the require so a missing/broken player (e.g. .claude/sounds/ absent on a fresh
+// clone or after a re-seed) degrades to a silent no-op instead of crashing ship.js
+// at load. A cosmetic feature can't be allowed to break shipping (task 1002199).
+const { playSound } = (() => {
+  try {
+    return require(path.resolve(__dirname, '../../.claude/sounds/play.js'));
+  } catch {
+    return { playSound: () => {} };
+  }
+})();
 const DROPLET = 'lars@104.236.254.243';
 const BEHIND_MAIN_LIMIT = 5;