vibed-infra 0.3.0

package/README.md

@@ -0,0 +1,99 @@
+# vibed-infra
+
+Product-agnostic VPS deployment packager: wget installer, Docker Compose layouts, digest-gated auto-update, TLS/nginx helpers, and CI workflow templates.
+
+Published on npm as **`vibed-infra`**.
+
+## Install (npm)
+
+```bash
+npm install vibed-infra
+# or in a monorepo sibling checkout:
+# "vibed-infra": "file:../vibed-infra"
+```
+
+Resolve the packager root from Node:
+
+```bash
+node -e "console.log(require('path').dirname(require.resolve('vibed-infra/package.json')))"
+```
+
+Run install locally (product `packageconfig.yaml` + templates required):
+
+```bash
+PACKAGER_RAW=/path/to/node_modules/vibed-infra \
+PACKAGECONFIG_URL=/path/to/product/deploy/packageconfig.yaml \
+PRODUCT_RAW=/path/to/product/deploy/templates \
+bash /path/to/node_modules/vibed-infra/install.sh --profile api
+```
+
+Or use the bin:
+
+```bash
+npx vibed-infra --profile api   # still needs PACKAGECONFIG_URL / PRODUCT_RAW (or packageconfig rawBase)
+```
+
+## Install (wget, operators)
+
+```bash
+wget -qO- https://raw.githubusercontent.com/naiemk/vibed-infra/main/install.sh | \
+  env INFRA_PROFILE=api \
+      PACKAGECONFIG_URL=https://raw.githubusercontent.com/ORG/REPO/main/deploy/packageconfig.yaml \
+      PRODUCT_RAW=https://raw.githubusercontent.com/ORG/REPO/main/deploy/templates \
+      bash
+```
+
+## Layout
+
+| Path | Purpose |
+|------|---------|
+| `install.sh` | Single entrypoint (`INFRA_PROFILE` or `--profile`) |
+| `start.sh` / `update.sh` | Generic lifecycle in install dir |
+| `install-auto-update.sh` | Cron from profile flags |
+| `lib/` | fetch, env, tls, prompt, generate |
+| `templates/` | Generic compose/nginx skeletons |
+| `schema/packageconfig.md` | Schema reference |
+| `examples/vps-hello/` | Full product that installs API + worker + HTTPS gateway on a VPS |
+| `skills/` | Cursor skills |
+| `github/workflows/` | Reusable GHCR build workflow |
+
+## Environment
+
+| Variable | Meaning |
+|----------|---------|
+| `PACKAGER_RAW` | Base URL or local path to this package root |
+| `PACKAGECONFIG_URL` | Product `packageconfig.yaml` (URL or path) |
+| `PRODUCT_RAW` | Product templates base (overrides `rawBase`; opaque to infra) |
+| `INFRA_PROFILE` | `api`, `nodes`, or `gateway` |
+| `INSTALL_DIR` | Target directory (default `.`) |
+
+## Publishing (npm)
+
+Every **merge to `main`** runs [Publish npm](.github/workflows/publish.yml):
+
+1. Bumps **minor** (`0.1.0` → `0.2.0`)
+2. Commits `chore: release vibed-infra v…`, tags `v…`, pushes
+3. Runs `npm publish` (needs repo secret `NPM_TOKEN`)
+
+**Major versions** — set `version` in `package.json` yourself (e.g. `1.0.0`) and include **`[major]`** in the commit message (or PR merge commit). That publishes the pinned version with **no** automatic minor bump.
+
+Manual run: Actions → Publish npm → `workflow_dispatch` (`minor` / `major` / `none`).
+
+Set repository secret **`NPM_TOKEN`** (npm automation token with publish access) before the first merge to `main`.
+
+Ordinary PRs only run CI (`npm test`); they do **not** publish.
+
+## Example (VPS)
+
+[`examples/vps-hello`](examples/vps-hello) is a complete product that uses this packager: `packageconfig.yaml`, install wrappers, start/update scripts, and a tiny API/UI/worker you can build on the box.
+
+```bash
+git clone https://github.com/naiemk/vibed-infra.git
+cd vibed-infra
+./examples/vps-hello/scripts/build-images.sh
+mkdir -p ~/hello-vps/api && cd ~/hello-vps/api
+bash /path/to/vibed-infra/examples/vps-hello/install/install-api.sh
+# edit .env, then ./start-hello-api.sh
+```
+
+Runbook: [`examples/vps-hello/README.md`](examples/vps-hello/README.md).

package/github/workflows/docker-build-reusable.yml

@@ -0,0 +1,61 @@
+# Reusable GHCR docker build — one image per workflow_call.
+#
+# Caller (repeat per image or use a matrix in the caller workflow):
+#
+#   jobs:
+#     build-api:
+#       uses: ./infra/github/workflows/docker-build-reusable.yml
+#       with:
+#         dockerfile: deploy/Dockerfile.api
+#         image: ghcr.io/${{ github.repository_owner }}/my-api
+#         context: .
+#       secrets: inherit
+
+name: Reusable docker build (single image)
+
+on:
+  workflow_call:
+    inputs:
+      dockerfile:
+        required: true
+        type: string
+      image:
+        required: true
+        type: string
+      context:
+        required: false
+        type: string
+        default: .
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/metadata-action@v5
+        id: meta
+        with:
+          images: ${{ inputs.image }}
+          tags: |
+            type=raw,value=main,enable={{is_default_branch}}
+            type=sha,prefix=main-,format=short
+            type=semver,pattern={{version}}
+      - uses: docker/build-push-action@v6
+        with:
+          context: ${{ inputs.context }}
+          file: ${{ inputs.dockerfile }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: |
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}

package/install-auto-update.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# Install cron for profile auto-update flags (.infra-profile + lib-env.sh).
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+# shellcheck source=lib-env.sh
+source "$SCRIPT_DIR/lib-env.sh"
+load_dotenv .env
+
+PROFILE="${INFRA_PROFILE:-}"
+ROLE="${ROLE:-}"
+START_SCRIPT=""
+UPDATE_SCRIPT=""
+if [[ -f .infra-profile ]]; then
+  # shellcheck source=/dev/null
+  source .infra-profile
+fi
+
+if [[ -z "$ROLE" && -n "$PROFILE" ]]; then
+  case "$PROFILE" in
+    api) ROLE=backend ;;
+    nodes) ROLE=workers ;;
+    gateway) ROLE=gateway ;;
+  esac
+fi
+if [[ -z "$ROLE" ]]; then
+  if compgen -G "start-*-gateway.sh" >/dev/null || [[ -f docker-compose.gateway.yml ]]; then
+    ROLE=gateway
+  elif compgen -G "start-*-nodes.sh" >/dev/null || [[ -f docker-compose.workers.yml ]]; then
+    ROLE=workers
+  else
+    ROLE=backend
+  fi
+fi
+
+UPDATE_SCRIPT="${UPDATE_SCRIPT:-update.sh}"
+[[ -x "$SCRIPT_DIR/$UPDATE_SCRIPT" ]] || UPDATE_SCRIPT="update.sh"
+
+cron_enabled=0
+INTERVAL_MIN=30
+CRON_OFFSET=0
+
+case "$ROLE" in
+  backend|api)
+    ROLE=api
+    if role_auto_update_on API_AUTO_UPDATE; then cron_enabled=1; fi
+    INTERVAL_MIN="${API_AUTO_UPDATE_INTERVAL_MIN:-30}"
+    CRON_OFFSET=0
+    ;;
+  workers|nodes)
+    ROLE=nodes
+    if role_auto_update_on NODES_AUTO_UPDATE; then cron_enabled=1; fi
+    INTERVAL_MIN="${NODES_AUTO_UPDATE_INTERVAL_MIN:-30}"
+    CRON_OFFSET=10
+    ;;
+  gateway)
+    if role_auto_update_on UI_TESTNET_AUTO_UPDATE \
+      || role_auto_update_on UI_MAINNET_AUTO_UPDATE \
+      || role_auto_update_on GATEWAY_AUTO_UPDATE \
+      || role_auto_update_on UI_AUTO_UPDATE; then
+      cron_enabled=1
+    fi
+    INTERVAL_MIN="${GATEWAY_AUTO_UPDATE_INTERVAL_MIN:-20}"
+    CRON_OFFSET=20
+    ;;
+  *)
+    ROLE="${ROLE:-api}"
+    ;;
+esac
+
+MARKER="# infra-auto-update:${ROLE}:${SCRIPT_DIR}"
+build_cron_minutes() {
+  local cron_offset="${1:-0}"
+  local cron_interval="${2:-30}"
+  local m="$cron_offset" parts=()
+  while [[ "$m" -lt 60 ]]; do parts+=("$m"); m=$((m + cron_interval)); done
+  [[ "${#parts[@]}" -eq 0 ]] && parts=(0)
+  local IFS=,
+  echo "${parts[*]}"
+}
+CRON_MINUTES="$(build_cron_minutes "${CRON_OFFSET:-0}" "${INTERVAL_MIN:-30}")"
+CRON_SCHED="${CRON_MINUTES} * * * *"
+CRON_CMD="cd ${SCRIPT_DIR} && /bin/bash ${SCRIPT_DIR}/${UPDATE_SCRIPT} >/dev/null 2>&1"
+dir_slug="$(basename "$SCRIPT_DIR" | tr -c 'A-Za-z0-9._-' '_')"
+CRON_D_FILE="/etc/cron.d/infra-${ROLE}-${dir_slug}"
+
+remove_user_crontab_marker() {
+  command -v crontab >/dev/null 2>&1 || return 0
+  local existing filtered
+  existing="$(crontab -l 2>/dev/null || true)"
+  filtered="$(printf '%s\n' "$existing" | grep -vF "$MARKER" || true)"
+  printf '%s\n' "$filtered" | sed '/^$/d' | crontab - 2>/dev/null || true
+}
+
+if [[ "$cron_enabled" -eq 1 ]]; then
+  if [[ -d /etc/cron.d && -w /etc/cron.d ]]; then
+    cat >"$CRON_D_FILE" <<EOF
+# Managed by infra install-auto-update.sh
+# ${MARKER}
+SHELL=/bin/bash
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+${CRON_SCHED} root ${CRON_CMD}
+EOF
+    chmod 644 "$CRON_D_FILE"
+    echo "Installed $CRON_D_FILE (minutes ${CRON_MINUTES})"
+    remove_user_crontab_marker
+  elif command -v crontab >/dev/null 2>&1; then
+    existing="$(crontab -l 2>/dev/null || true)"
+    filtered="$(printf '%s\n' "$existing" | grep -vF "$MARKER" || true)"
+    { printf '%s\n' "$filtered"; echo "${CRON_SCHED} ${CRON_CMD} ${MARKER}"; } | sed '/^$/d' | crontab -
+    echo "Installed user cron for $ROLE"
+  fi
+else
+  rm -f "$CRON_D_FILE" 2>/dev/null || true
+  remove_user_crontab_marker
+  echo "Auto-update disabled for $ROLE"
+fi
+
+# Drop leftover cron markers from older product-specific installers
+MARKER_LEGACY="# onchain-invoice-auto-update:${ROLE}:${SCRIPT_DIR}"
+if command -v crontab >/dev/null 2>&1; then
+  existing="$(crontab -l 2>/dev/null || true)"
+  filtered="$(printf '%s\n' "$existing" | grep -vF "$MARKER_LEGACY" || true)"
+  [[ "$cron_enabled" -eq 1 ]] || printf '%s\n' "$filtered" | sed '/^$/d' | crontab - 2>/dev/null || true
+fi

package/install.sh

@@ -0,0 +1,259 @@
+#!/usr/bin/env bash
+# Infra packager — single wget entrypoint.
+#
+#   wget -qO- $PACKAGER_RAW/install.sh | env INFRA_PROFILE=api PACKAGECONFIG_URL=... bash
+#
+# Product wrappers set PACKAGECONFIG_URL and INFRA_PROFILE.
+set -euo pipefail
+
+PACKAGER_RAW="${PACKAGER_RAW:-${INFRA_RAW:-https://raw.githubusercontent.com/naiemk/vibed-infra/main}}"
+DEST="${INSTALL_DIR:-.}"
+PROFILE="${INFRA_PROFILE:-}"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --profile) PROFILE="$2"; shift 2 ;;
+    --components)
+      IFS=',' read -ra _comps <<<"$2"
+      for c in "${_comps[@]}"; do
+        case "$c" in
+          app|backend|api) PROFILE=api; break ;;
+          workers|nodes) PROFILE=nodes; break ;;
+          gateway) PROFILE=gateway; break ;;
+        esac
+      done
+      shift 2
+      ;;
+    --dest) DEST="$2"; shift 2 ;;
+    -h|--help)
+      echo "usage: install.sh [--profile api|nodes|gateway] [--dest DIR]"
+      echo "env: PACKAGECONFIG_URL PRODUCT_RAW PACKAGER_RAW INFRA_PROFILE INSTALL_DIR"
+      exit 0
+      ;;
+    *) shift ;;
+  esac
+done
+
+mkdir -p "$DEST"
+DEST="$(cd "$DEST" && pwd)"
+
+# Bootstrap libs from packager (works when piped via wget|bash or local PACKAGER_RAW path).
+INFRA_LIB="$DEST/.infra-lib"
+mkdir -p "$INFRA_LIB"
+_bootstrap_lib() {
+  local src="$1" dest="$2"
+  if [[ -f "$src" ]]; then
+    cp -f "$src" "$dest"
+  else
+    _fetch "${PACKAGER_RAW}/lib/$(basename "$dest")" "$dest"
+  fi
+}
+_fetch() {
+  local url="$1" out="$2"
+  if command -v curl >/dev/null 2>&1; then curl -fsSL "$url" -o "$out"; else wget -qO "$out" "$url"; fi
+}
+LOCAL_PACKAGER=0
+if [[ "$PACKAGER_RAW" =~ ^/ ]] && [[ -d "$PACKAGER_RAW/lib" ]]; then
+  LOCAL_PACKAGER=1
+fi
+for lib in fetch.sh env.sh prompt.sh tls.sh load_config.py generate.py; do
+  if [[ "$LOCAL_PACKAGER" == "1" ]]; then
+    cp -f "${PACKAGER_RAW}/lib/${lib}" "${INFRA_LIB}/${lib}"
+  else
+    _fetch "${PACKAGER_RAW}/lib/${lib}" "${INFRA_LIB}/${lib}"
+  fi
+done
+for lib in start.sh update.sh install-auto-update.sh; do
+  if [[ "$LOCAL_PACKAGER" == "1" ]]; then
+    cp -f "${PACKAGER_RAW}/${lib}" "${DEST}/${lib}"
+  else
+    _fetch "${PACKAGER_RAW}/${lib}" "${DEST}/${lib}"
+  fi
+  chmod +x "${DEST}/${lib}"
+done
+
+# shellcheck source=/dev/null
+source "${INFRA_LIB}/fetch.sh"
+# shellcheck source=/dev/null
+source "${INFRA_LIB}/prompt.sh"
+# shellcheck source=/dev/null
+source "${INFRA_LIB}/tls.sh"
+
+cd "$DEST"
+
+if [[ -z "$PROFILE" ]]; then
+  PROFILE="$(infra_pick_profile)"
+fi
+
+PACKAGECONFIG_URL="${PACKAGECONFIG_URL:-${PACKAGE_CONFIG_URL:-}}"
+if [[ -z "$PACKAGECONFIG_URL" ]]; then
+  echo "Set PACKAGECONFIG_URL to the product packageconfig.yaml (URL or path)" >&2
+  exit 1
+fi
+PC_LOCAL="$DEST/.packageconfig.yaml"
+if [[ "$PACKAGECONFIG_URL" =~ ^/ ]]; then
+  cp -f "$PACKAGECONFIG_URL" "$PC_LOCAL"
+else
+  infra_fetch "$PACKAGECONFIG_URL" "$PC_LOCAL"
+fi
+
+if [[ -z "${PRODUCT_RAW:-}" && -n "${ONCHAIN_INVOICE_RAW:-}" ]]; then
+  echo "warning: ONCHAIN_INVOICE_RAW is deprecated; use PRODUCT_RAW" >&2
+  PRODUCT_RAW="$ONCHAIN_INVOICE_RAW"
+fi
+if [[ -z "${PRODUCT_RAW:-}" ]]; then
+  PRODUCT_RAW="$(
+    python3 -c "
+import sys
+sys.path.insert(0, '${INFRA_LIB}')
+from load_config import load_packageconfig
+from pathlib import Path
+print(load_packageconfig(Path('${PC_LOCAL}')).get('rawBase',''))
+"
+  )"
+fi
+if [[ -z "$PRODUCT_RAW" ]]; then
+  echo "Set PRODUCT_RAW or packageconfig rawBase (product templates URL or path)" >&2
+  exit 1
+fi
+
+echo "== infra install profile=$PROFILE dest=$DEST =="
+
+_py_profile() {
+  python3 -c "
+import sys, json
+sys.path.insert(0, '${INFRA_LIB}')
+from load_config import load_packageconfig, get_profile
+from pathlib import Path
+p = get_profile(load_packageconfig(Path('${PC_LOCAL}')), '${PROFILE}')
+print(json.dumps(p))
+"
+}
+
+PROF_JSON="$(_py_profile)"
+ROLE="$(python3 -c "import json,sys; print(json.loads(sys.argv[1]).get('role','backend'))" "$PROF_JSON")"
+START_SCRIPT="$(python3 -c "import json,sys; print(json.loads(sys.argv[1]).get('startScript','start.sh'))" "$PROF_JSON")"
+UPDATE_SCRIPT="$(python3 -c "import json,sys; print(json.loads(sys.argv[1]).get('updateScript','update.sh'))" "$PROF_JSON")"
+ENV_EXAMPLE="$(python3 -c "import json,sys; t=json.loads(sys.argv[1]).get('templates') or {}; print(t.get('envExample','.env.example'))" "$PROF_JSON")"
+CONFIG_FILE="$(python3 -c "import json,sys; t=json.loads(sys.argv[1]).get('templates') or {}; print(t.get('config',''))" "$PROF_JSON")"
+COMPOSE_TPL="$(python3 -c "import json,sys; t=json.loads(sys.argv[1]).get('templates') or {}; print(t.get('compose',''))" "$PROF_JSON")"
+COMPOSE_MAINNET="$(python3 -c "import json,sys; t=json.loads(sys.argv[1]).get('templates') or {}; print(t.get('composeMainnet',''))" "$PROF_JSON")"
+
+cp -f "${INFRA_LIB}/env.sh" "$DEST/lib-env.sh"
+mkdir -p "$DEST/lib"
+cp -f "${INFRA_LIB}/load_config.py" "$DEST/lib/"
+cp -f "${INFRA_LIB}/generate.py" "$DEST/lib/"
+
+if [[ -n "$ENV_EXAMPLE" ]]; then
+  infra_write_template "${PRODUCT_RAW}/${ENV_EXAMPLE}" "$DEST/${ENV_EXAMPLE}" 0
+  cp -f "$DEST/${ENV_EXAMPLE}" "$DEST/.env.example"
+fi
+if [[ -n "$CONFIG_FILE" ]]; then
+  infra_write_if_missing "${PRODUCT_RAW}/${CONFIG_FILE}" "$DEST/${CONFIG_FILE}" 0
+  infra_write_template "${PRODUCT_RAW}/${CONFIG_FILE}" "$DEST/${CONFIG_FILE}" 0
+fi
+if [[ -n "$COMPOSE_TPL" ]]; then
+  infra_write_if_missing "${PRODUCT_RAW}/${COMPOSE_TPL}" "$DEST/${COMPOSE_TPL}" 0
+  infra_write_template "${PRODUCT_RAW}/${COMPOSE_TPL}" "$DEST/${COMPOSE_TPL}" 0
+fi
+if [[ -n "$COMPOSE_MAINNET" ]]; then
+  infra_write_template "${PRODUCT_RAW}/${COMPOSE_MAINNET}" "$DEST/${COMPOSE_MAINNET}" 0
+fi
+
+# Generic infra compose templates (optional USE_COMPOSE=1)
+case "$ROLE" in
+  backend)
+    infra_write_template "${PACKAGER_RAW}/templates/docker-compose.backend.yml" "$DEST/docker-compose.backend.yml" 0
+    ;;
+  workers)
+    infra_write_template "${PACKAGER_RAW}/templates/docker-compose.workers.yml" "$DEST/docker-compose.workers.yml" 0
+    ;;
+  gateway)
+    infra_write_template "${PACKAGER_RAW}/templates/docker-compose.gateway.yml" "$DEST/docker-compose.gateway.yml" 0
+    ;;
+esac
+
+if [[ -n "$START_SCRIPT" && "$START_SCRIPT" != "start.sh" ]]; then
+  infra_write_if_missing "${PRODUCT_RAW}/${START_SCRIPT}" "$DEST/${START_SCRIPT}" 1
+  infra_write_template "${PRODUCT_RAW}/${START_SCRIPT}" "$DEST/${START_SCRIPT}" 1
+fi
+if [[ -n "$UPDATE_SCRIPT" && "$UPDATE_SCRIPT" != "update.sh" ]]; then
+  infra_write_if_missing "${PRODUCT_RAW}/${UPDATE_SCRIPT}" "$DEST/${UPDATE_SCRIPT}" 1
+  infra_write_template "${PRODUCT_RAW}/${UPDATE_SCRIPT}" "$DEST/${UPDATE_SCRIPT}" 1
+fi
+
+python3 -c "
+import json, sys
+extras = json.loads(sys.argv[1]).get('extras') or []
+for e in extras:
+    print(e)
+" "$PROF_JSON" | while read -r extra; do
+  [[ -n "$extra" ]] || continue
+  infra_write_if_missing "${PRODUCT_RAW}/${extra}" "$DEST/${extra}" 1
+  infra_write_template "${PRODUCT_RAW}/${extra}" "$DEST/${extra}" 1
+done
+
+if [[ "$ROLE" == "gateway" ]]; then
+  mkdir -p "$DEST/gateway/conf.d"
+  infra_write_if_missing "${PRODUCT_RAW}/gateway/nginx.conf" "$DEST/gateway/nginx.conf" 0
+  infra_write_template "${PRODUCT_RAW}/gateway/nginx.conf" "$DEST/gateway/nginx.conf" 0
+  if python3 "${INFRA_LIB}/generate.py" "$PC_LOCAL" --profile "$PROFILE" -o "$DEST/gateway/conf.d/domains.conf" 2>/dev/null; then
+    echo "generated: gateway/conf.d/domains.conf"
+  else
+    infra_write_if_missing "${PRODUCT_RAW}/gateway/conf.d/domains.conf" "$DEST/gateway/conf.d/domains.conf" 0
+    infra_write_template "${PRODUCT_RAW}/gateway/conf.d/domains.conf" "$DEST/gateway/conf.d/domains.conf" 0
+  fi
+fi
+
+if [[ ! -f "$DEST/.env" ]]; then
+  cp "$DEST/.env.example" "$DEST/.env"
+  echo "created: $DEST/.env"
+else
+  echo "exists: $DEST/.env"
+fi
+
+cat >"$DEST/.infra-profile" <<EOF
+PROFILE=${PROFILE}
+ROLE=${ROLE}
+START_SCRIPT=${START_SCRIPT}
+UPDATE_SCRIPT=${UPDATE_SCRIPT}
+EOF
+
+chmod +x "$DEST/${START_SCRIPT}" 2>/dev/null || true
+INFRA_PROFILE="$PROFILE" ./install-auto-update.sh || true
+
+if [[ "$ROLE" == "gateway" ]]; then
+  # shellcheck source=/dev/null
+  source "$DEST/lib-env.sh"
+  load_dotenv "$DEST/.env"
+  CERT_DIR="$(python3 -c "
+import sys
+sys.path.insert(0, '${INFRA_LIB}')
+from load_config import load_packageconfig, get_profile
+from pathlib import Path
+p = get_profile(load_packageconfig(Path('${PC_LOCAL}')), '${PROFILE}')
+sites = p.get('sites') or []
+if not sites:
+    print('/etc/letsencrypt/live/example.com')
+else:
+    s = sites[0]
+    print(s.get('tlsCertDir') or ('/etc/letsencrypt/live/' + s['host']))
+")"
+  TLS_FULLCHAIN="${TLS_FULLCHAIN:-${CERT_DIR}/fullchain.pem}"
+  TLS_PRIVKEY="${TLS_PRIVKEY:-${CERT_DIR}/privkey.pem}"
+  mapfile -t DOMAIN_ARR < <(python3 -c "
+import sys
+sys.path.insert(0, '${INFRA_LIB}')
+from load_config import load_packageconfig, get_profile
+from pathlib import Path
+p = get_profile(load_packageconfig(Path('${PC_LOCAL}')), '${PROFILE}')
+for s in p.get('sites') or []:
+    print(s['host'])
+    for a in s.get('aliases') or []:
+        print(a)
+")
+  infra_tls_offer_interactive "$TLS_FULLCHAIN" "$TLS_PRIVKEY" "${DOMAIN_ARR[@]}"
+fi
+
+echo ""
+echo "Install complete. Start: cd $DEST && ./${START_SCRIPT}"