@vibelord/lanes 1.2.0 → 1.3.0

package/payload/lanes/install/host-install.sh

@@ -8,13 +8,15 @@
 #                (sha256), terminfo, the catalog: a failure here leaves the installed release running exactly as it was;
 #   commit       install/services.py --install: every unit, then current.previous, then the flip of `current` (W9 U1);
 #   post-commit  libexec/update.py post-commit, from the tree just installed: daemon-reload, `lanes sync`, restart
-#                lanes-statusd, try-restart each optional service, `lanes install-container` per container,
-#                `lanes reload-views`, `lanes ensure --if-layout-changed` — each step runs whatever the one before it
-#                returned (`lanes sync` exiting 1 — a board with an error — is a warning in the record, which leaves
-#                the result `ok`; never the end of the update).
+#                lanes-statusd, try-restart each optional service (right after lanes-docsd's, install/enable-docs.sh:
+#                the docs page's pinned Mermaid, a warning when it is skipped or refused, W10 W8), `lanes
+#                install-container` per container, `lanes reload-views`, `lanes ensure --if-layout-changed` — each step
+#                runs whatever the one before it returned (`lanes sync` exiting 1 — a board with an error — is a warning
+#                in the record, which leaves the result `ok`; never the end of the update).
 # Every run is recorded in $LANES_STATE/update/last.json (DM-LANES-UPDATE-RECORD: result ok | partial | refused |
 # failed, each phase and step with its exit status) and logged in full to update/last.log; the terminal or the journal
-# gets one line per phase and step. A full install (no --update-only) prints as before and records nothing.
+# gets one line per phase and step. A full install (no --update-only) records nothing; it runs enable-docs.sh right
+# after lanes-docsd's restart, never fatally, and its summary names the Mermaid outcome.
 # One install or update at a time: every run but --check first takes the run lock $LANES_STATE/update/.lock and holds
 # it to its end (fd 9); a run that finds it held writes nothing — no log, no record — and exits 3.
 # A full install enables lanes-update.timer with the other timers (plan W9 U3, LNS-91): `lanes update --timer`, 15 min
@@ -154,6 +156,15 @@ for command in python3 curl tar sha256sum infocmp tic install systemctl docker t
     command -v "$command" >/dev/null 2>&1 || { echo "Missing prerequisite: $command (see docs/INSTALL.md)" >&2; exit 1; }
 done
 python3 -c 'import sys; sys.exit(0 if sys.version_info >= (3, 9) else "Python 3.9+ is required")'
+# --- docs store encryption at rest (W10 W5, LNS-106) ------------------------------------------------------------
+# LANES_DOCS_AGE_RECIPIENT in lanes-docsd.service's drop-in encrypts each document's docs-store copy with `age -r`
+# (default off; RUNBOOK "Docs service", encryption at rest). Set where no `age` binary is on PATH, every upload and
+# publish would fail: refused here, before anything is installed, with libexec/docs_store.py's reason.
+check_docs_age() {
+    python3 "$repo/libexec/docs_store.py" check-age || exit 1
+}
+check_docs_age
+# --- end docs store encryption at rest -------------------------------------------------------------------------
 export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
 if [ "$start" = 1 ]; then
     systemctl --user show-environment >/dev/null
@@ -224,6 +235,7 @@ if [ "$update_only" = 1 ]; then
         *) printf 'partial: the post-commit ended with exit %s (log %s)\n' "$status" "$log" >&3; exit 4 ;;
     esac
 fi
+mermaid="not installed (--no-start) — sh $repo/install/enable-docs.sh installs it"
 if [ "$start" = 1 ]; then
     systemctl --user daemon-reload
     # A failing sync (a board's container down, a registry it cannot read) is reported; the services still start.
@@ -236,11 +248,33 @@ if [ "$start" = 1 ]; then
     # The enrolment service (libexec/enrold.py) runs the code of THIS install: enable, then (re)start it.
     systemctl --user enable lanes-enrold.service
     systemctl --user restart lanes-enrold.service
+    # The docs service (libexec/docsd.py, W10 W3) likewise; it refuses every request until `lanes enrol mode request`
+    # pins the Serve header check.
+    systemctl --user enable lanes-docsd.service
+    systemctl --user restart lanes-docsd.service
+    # --- the docs page's pinned Mermaid (W10 W8, LNS-109) ---------------------------------------------------------
+    # install/enable-docs.sh (RUNBOOK "Mermaid pin"), never fatal: the install goes on whatever it exits, and the
+    # summary below names the outcome — 0 ok (installed, or already present with the pinned digest: no download),
+    # 1 skipped (a prerequisite or the download), 3 refused (no valid pin, a digest mismatch: nothing installed), any
+    # other status failed. An update (--update-only) runs it as a post-commit step (libexec/update.py DOCS_STEP).
+    mermaid_rc=0
+    mermaid_said=$(sh "$repo/install/enable-docs.sh" 2>&1 9>&-) || mermaid_rc=$?
+    [ -z "$mermaid_said" ] || printf '%s\n' "$mermaid_said"
+    mermaid_reason=$(printf '%s\n' "$mermaid_said" | awk 'NF { line = $0 } END { print line }')
+    [ -n "$mermaid_reason" ] || mermaid_reason="exit $mermaid_rc, no output"
+    case $mermaid_rc in
+        0) mermaid='ok' ;;
+        1) mermaid="skipped ($mermaid_reason) — diagrams show as source until sh $repo/install/enable-docs.sh succeeds" ;;
+        3) mermaid="refused ($mermaid_reason) — nothing was installed; see RUNBOOK \"Mermaid pin\"" ;;
+        *) mermaid="failed (exit $mermaid_rc: $mermaid_reason) — sh $repo/install/enable-docs.sh" ;;
+    esac
+    # --- end the docs page's pinned Mermaid -----------------------------------------------------------------------
     # A running web frontend reads the Caddyfile of the tree it was started from; an npm update stages a new tree,
     # so a reload would keep the old routes (/enrol/ included): restart it, only when it runs. Clients reconnect.
     systemctl --user try-restart lanes-mobile.service
 fi
 printf '\nServer installed from %s\n' "$repo"
+echo "Mermaid for the docs page: $mermaid"
 echo 'Configure boards in ~/.config/lanes/workspaces/; see workspaces.example/README.md.'
 echo 'Next: lanes install-container CONTAINER; lanes sync; lanes doctor'
 echo 'Web access and host cleanup/guard timers remain opt-in; see docs/INSTALL.md.'