diff options
Diffstat (limited to 'docs/CHAT-PRODUCTION.txt')
| -rw-r--r-- | docs/CHAT-PRODUCTION.txt | 61 |
1 files changed, 14 insertions, 47 deletions
diff --git a/docs/CHAT-PRODUCTION.txt b/docs/CHAT-PRODUCTION.txt index 2507e07..6c901dc 100644 --- a/docs/CHAT-PRODUCTION.txt +++ b/docs/CHAT-PRODUCTION.txt @@ -16,7 +16,7 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. PRODUCTION CHAT INTEGRATION - Implemented on main. Builds/tests do not activate the VPS. Experimental; + Builds/tests do not activate the VPS. Experimental; no independent cryptographic or application security audit. Read CHAT-APPLICATION.txt limitations before private use. @@ -57,7 +57,7 @@ BUILD ON THE WORKSTATION isolated musl/GCC built-in and host Linux UAPI headers, excluding glibc. Static OpenSSL has no dynamic providers and seeds through getrandom. The native compatibility probe must pass. WASI uses separately verified SDK/OpenSSL - inputs in CHAT-OPENSSL-MIGRATION.txt. Cryptographic algorithms stay fixed. + inputs in CHAT-CRYPTO.txt. Cryptographic algorithms stay fixed. Inputs cache under .tools/. Version/source/flag changes require an OpenSSL rebuild. Updates require upstream advisory review, every affected URL/hash, @@ -81,7 +81,7 @@ LOCAL MODES AND ORIGIN BINDING var/data/chat-local Production: - ./bin/stack up --production + ./bin/run up --production https://CHAT_HOST/ with the configured HTTPS_PORT var/data/chat @@ -97,10 +97,8 @@ LOCAL MODES AND ORIGIN BINDING DEPLOY AND CREATE THE REAL OWNER FILE - Follow OPERATIONS.txt. Extract the verified release's new management binary - into var/incoming/bootstrap; invoke with --root set to the current installation. - The new binary understands its release schema, verifies the archive, and - installs chat artifacts before startup. + Follow OPERATIONS.txt. Activate through the verified new management binary + with its matching runtime; activation installs chat artifacts before startup. The host needs rootless Podman prerequisites, user linger, low-port permission, DNS A/AAAA records for CHAT_HOST and www.CHAT_HOST, and the normal 80/443 firewall rules. Caddy obtains and renews public certificates automatically. @@ -111,7 +109,7 @@ DEPLOY AND CREATE THE REAL OWNER FILE failed containers. Complete matching-architecture releases need no compilation or registry pull. Check all four services after activation: - ./bin/stack status + ./bin/run status Check HTTPS, HTTP-to-HTTPS and www redirects, the homepage Services entry, /LIMITATIONS.txt, /javascript.html, and /SOURCE.tar.gz on the chat origin. @@ -127,7 +125,7 @@ DEPLOY AND CREATE THE REAL OWNER FILE BACKUP, RESTORE, AND KEY LOSS A complete encrypted application export: - ./bin/stack backup --include-images + ./bin/run backup --include-images Copy .gpg and .sha256 off the VPS; local backups cannot survive VPS loss. Configured recipients apply. Export includes one .env, online SQLite snapshots @@ -137,9 +135,9 @@ BACKUP, RESTORE, AND KEY LOSS Owner private file and GnuPG secret key need separate backups. Restore to a new directory, verify, then explicitly start production mode: - ./bin/stack restore /path/export.tar.gz.gpg /path/stack-restored + ./bin/run restore /path/export.tar.gz.gpg /path/stack-restored cd /path/stack-restored - ./bin/stack up --production + ./bin/run up --production Restore defaults to local mode with fresh project names, avoiding replacement of another installation. up --production reselects production database/origin. @@ -152,10 +150,10 @@ BACKUP, RESTORE, AND KEY LOSS reset deletes every conversation/message; it decrypts and recovers nothing. Reset has no HTTP endpoint and requires filesystem/Podman access: - ./bin/stack chat --owner-fingerprint - ./bin/stack down - ./bin/stack chat --reset-owner PASTE_CURRENT_OWNER_FINGERPRINT_HERE - ./bin/stack up --production + ./bin/run chat --owner-fingerprint + ./bin/run down + ./bin/run chat --reset-owner PASTE_CURRENT_OWNER_FINGERPRINT_HERE + ./bin/run up --production Reset requires a stopped server and matching full fingerprint. Root .env and exports survive. Create a new production owner file; old visitor files reject @@ -175,7 +173,7 @@ VERIFICATION configuring fixture .localhost hostnames, WEB_BIND=127.0.0.1, HTTP_PORT=8181, HTTPS_PORT=8443, and LOCAL_HTTP_PORT=8180: - ./bin/stack up --production + ./bin/run up --production CHAT_TEST_ROOT=/absolute/disposable/stack CHAT_TEST_ORIGIN=https://chat.fixture.localhost:8443 PLAYWRIGHT_BROWSERS_PATH=.tools/browsers npm run test:chat Run from the source checkout for the harness and Playwright installation. @@ -189,34 +187,3 @@ VERIFICATION Production uses ordinary trusted public certificates with no TLS bypass. Passing these checks demonstrates recovery and functional compatibility; it does not establish absence of attacks or constitute an independent audit. - -RECORDED RESULTS, 2026-10-31 - - The complete native workspace check passed: formatting, strict Clippy, - 14 tests, private rustdoc, cargo-deny with no ignored advisories, and - cargo-about generation. Static musl and WASI OpenSSL 3.6.5 probes passed - without changing the required RFC 9980 algorithms. - - Direct development passed in Chromium. Packaged HTTPS passed independently - in Chromium and Firefox with GNU LibreJS 7.21.1 active; its unlicensed-script - control was rejected. Both packaged tests recovered a complete encrypted - application export, including saved images, into a new directory, then - reopened the unchanged owner/visitor files and decrypted the history. - Export and checksum permissions were verified as 0600. - - Runtime inspection verified read-only root filesystem, zero effective - capabilities, no chat host ports, and unless-stopped restart policy. Killing - the disposable chat process with SIGKILL caused an automatic restart, and - its owner fingerprint persisted. The supplied systemd user unit passed - systemd-analyze verification; this did not reboot the real VPS. - - curl independently verified the fixture CA chain and hostname for canonical - chat, www redirect, and homepage. The homepage Services limitations link - resolved correctly. The source download matched the packaged source archive - byte-for-byte and contained only .env.example, without actual .env. - - Upgrade testing started the 2026-10-30 three-service release, then activated - the chat-enabled release through its new prebuilt management binary. All - four services started, existing data and SearXNG secret persisted, and the - new owner setup token was generated in the same root .env. These tests used - disposable local data; they did not register a real production owner. |