vibed-infra 0.11.0 → 0.12.0

package/README.md

@@ -19,7 +19,7 @@ git add dist && git commit && git push
 
 ## Operator flow (VPS)
 
-Non-root agent prep (SSH, Docker group, uid 1000 data dirs): [`skills/agent-vps-prep/SKILL.md`](skills/agent-vps-prep/SKILL.md).
+Non-root agent prep (SSH, Docker group, one-time uid-1000 operator or ~/services ACL): [`skills/agent-vps-prep/SKILL.md`](skills/agent-vps-prep/SKILL.md).
 
 ```bash
 # 1) DNS — paste dist/DNS-SKILL.md into AU browser agent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibed-infra",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Product-agnostic VPS packager: wget install, Docker Compose, TLS/nginx, auto-update",
   "license": "MIT",
   "repository": {

package/skills/agent-vps-prep/SKILL.md

@@ -2,7 +2,7 @@
 name: agent-vps-prep
 description: >-
   Prepare a fresh VPS for vibed-infra installs run by an automation agent
-  (cloud_agent): SSH key, sudoers, Docker group, data-dir ownership, firewall.
+  (cloud_agent): SSH key, sudoers, Docker group, one-time uid-1000/ACL ownership, firewall.
 ---
 
 # Prepare a VPS for vibed-infra (agent operator)
@@ -14,10 +14,17 @@ Non-root user (e.g. `cloud_agent`) that will run `wget …/dist/install-*.sh | b
 
 ## 1. Create the operator user
 
-(as root)
+**Preferred (configure once):** create the operator as **uid/gid 1000** so bind mounts match typical `USER node` images — no chown, no ACL, no per-app commands forever.
+
+(as root — only if uid/gid 1000 are free: `getent passwd 1000`; `getent group 1000`)
 
 ```bash
-adduser --disabled-password --gecos "" cloud_agent
+adduser --disabled-password --gecos "" --uid 1000 cloud_agent
+# if group 1000 already named "node", either:
+#   adduser --uid 1000 --gid 1000 ...
+# or rename/reuse that group carefully
+groupmod -n cloud_agent node 2>/dev/null || true  # only if appropriate on that host
+
 mkdir -p /home/cloud_agent/.ssh
 chmod 700 /home/cloud_agent/.ssh
 # paste agent public key:
@@ -26,6 +33,11 @@ chmod 600 /home/cloud_agent/.ssh/authorized_keys
 chown -R cloud_agent:cloud_agent /home/cloud_agent/.ssh
 ```
 
+If `adduser --uid 1000` fails because 1000 is taken by a `node` user from a package:
+
+- **Option A:** use that existing uid-1000 user as the agent (add docker group + SSH key to it)
+- **Option B:** create `cloud_agent` with a different uid and use the **ACL fallback** in §5
+
 ## 2. SSH from the agent machine
 
 Generate a key if needed, then connect with `StrictHostKeyChecking=accept-new`:
@@ -55,38 +67,41 @@ sudo chown -R cloud_agent:cloud_agent /home/cloud_agent
 
 vibed-infra defaults: `~/services/gateway`, `~/services/vibed-infra`, product dirs under `~/services/<app>/`.
 
-## 5. Container data directory ownership (uid 1000)
+## 5. Bind-mount ownership (uid 1000) — configure once
 
-Product images often run as `node` (uid/gid **1000**). Bind-mounted `./data` and `./logs` created by `cloud_agent` (e.g. uid 1001) cause `SQLITE_CANTOPEN` / `EACCES`.
+Product images often run as `node` (uid/gid **1000**). If the operator creates `./data` / `./logs` as a *different* uid, containers hit `SQLITE_CANTOPEN` / `EACCES`. Fix this **once on the host**, not after every product install.
 
-**One-shot after first install (or before first start), as root/sudo:**
+### Preferred: operator is already uid 1000
 
-```bash
-# Trustless Commerce / typical vibed apps — adjust paths to your INSTALL_DIRs
-sudo chown -R 1000:1000 \
-  /home/cloud_agent/services/*/api/data \
-  /home/cloud_agent/services/*/api/persist-logs \
-  /home/cloud_agent/services/*/nodes/logs
-```
+If §1 created `cloud_agent` as uid/gid 1000, new trees under `~/services` are already writable by the container user. Nothing else to do.
+
+### Fallback (configure once on `~/services`): default ACL
 
-Or per product:
+When the operator is **not** uid 1000, grant uid 1000 rwx on every new file under services regardless of who creates it. Requires the `acl` package.
 
 ```bash
-sudo chown -R 1000:1000 ~/services/tctest/api/data ~/services/tctest/api/persist-logs
-sudo chown -R 1000:1000 ~/services/tcmain/api/data ~/services/tcmain/api/persist-logs
-sudo chown -R 1000:1000 ~/services/tctest/nodes/logs ~/services/tcmain/nodes/logs
+# as root, once after creating cloud_agent (any uid)
+apt-get install -y acl
+install -d -o cloud_agent -g cloud_agent /home/cloud_agent/services
+setfacl -m u:1000:rwx /home/cloud_agent/services
+setfacl -d -m u:1000:rwx /home/cloud_agent/services
+# also grant the operator full access via ACL defaults
+setfacl -m u:cloud_agent:rwx /home/cloud_agent/services
+setfacl -d -m u:cloud_agent:rwx /home/cloud_agent/services
 ```
 
-Optional: allow passwordless chown for the agent (tight sudoers):
+### Recovery only
+
+If someone already created wrong-owned dirs **before** uid-1000 or ACL setup:
 
 ```bash
-# /etc/sudoers.d/cloud_agent-chown
-cloud_agent ALL=(root) NOPASSWD: /usr/bin/chown -R 1000\:1000 /home/cloud_agent/services/*
+sudo chown -R 1000:1000 \
+  /home/cloud_agent/services/*/api/data \
+  /home/cloud_agent/services/*/api/persist-logs \
+  /home/cloud_agent/services/*/nodes/logs
 ```
 
-Prefer the explicit one-shot; sudoers is optional.
-
-Note: start scripts may try `sudo chown` or a docker alpine chown — host sudo still helps for empty dirs created as the operator user.
+Do not rely on per-product `chown` as ongoing ops. Prefer fixing the host model above.
 
 ## 6. Ports + DNS
 
@@ -114,6 +129,6 @@ wget -qO- https://raw.githubusercontent.com/ORG/REPO/main/deploy/.../dist/instal
 - [ ] `ssh cloud_agent@VPS` works with key only
 - [ ] `docker ps` works without sudo
 - [ ] `$HOME` owned by `cloud_agent`
-- [ ] uid 1000 chown on data/logs after first mkdir/install
+- [ ] operator uid is 1000 **OR** `~/services` has default ACL for `u:1000` (and `u:cloud_agent` if needed)
 - [ ] DNS → VPS IP
 - [ ] install-gateway + setup-tls + start-gateway

package/skills/system-gateway/SKILL.md

@@ -66,7 +66,7 @@ Host `00-default.conf` (HTTP) and each app `sites.conf` (HTTPS) proxy `/_vibed/h
 
 ## Pitfalls
 
-- Operator user / Docker / uid 1000 data dirs: [agent-vps-prep](../agent-vps-prep/SKILL.md).
+- Operator user / Docker / one-time uid-1000 or ACL (not per-app chown): [agent-vps-prep](../agent-vps-prep/SKILL.md).
 - Do not run a second standalone nginx on 80/443.
 - Container names in `sites.conf` must match running API/UI names on `vps-edge`.
 - After cert renewal or `setup-tls.sh`, reload happens automatically when the gateway container is already running.