From 9349a2de648e241da8e00ba7ae25cb2a877ff3e9 Mon Sep 17 00:00:00 2001 From: Doan Luu Duc Tai Date: Sun, 1 Nov 2026 07:13:45 -0600 Subject: feat(guix): carry prebuilt runtime and recover preserved state --- docs/MAP.txt | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) (limited to 'docs/MAP.txt') diff --git a/docs/MAP.txt b/docs/MAP.txt index 6f5e13d..de546b8 100644 --- a/docs/MAP.txt +++ b/docs/MAP.txt @@ -15,7 +15,7 @@ along with this program. If not, see . FILE MAP - Public tree: every tracked file, including this map. + Public tree: every tracked file plus pending Guix source/docs and this map. Static inventory; update when public paths change. Root: stack/. Private/generated trees below list roles only; contents stay unlisted. @@ -67,6 +67,7 @@ stack/ Personal service source, build recipes and recovery tooling. | |-- CHAT-OPENSSL-MIGRATION.txt OpenSSL crypto migration evidence, dependencies, reviewed exceptions. | |-- CHAT-PRODUCTION.txt Chat release packaging, HTTPS activation, owner setup, production recovery. | |-- CONFIGURATION.txt Supported root settings, validation, public/private state boundaries. +| |-- GUIX.txt Experimental Guix capsule, canonical-store bootstrap, gates and blockers. | |-- LINTING.txt Strict Rust/browser checks, generated-code limits, justified exceptions. | |-- MAP.txt This public-file tree and private/runtime directory roles. | |-- OPERATIONS.txt Stack development, encrypted backup/restore, host setup, deployment. @@ -90,6 +91,17 @@ stack/ Personal service source, build recipes and recovery tooling. | | | `-- supervisord.conf Run nginx and fcgiwrap inside the cgit container. | | `-- chat/ Prebuilt chat image recipe. | | `-- Containerfile Package prebuilt static chat server and web/crypto assets. +| |-- guix/ Experimental Guix runtime and recovery capsule tooling. +| | |-- bootstrap.sh Root-owned canonical closure installation; refuse managed/foreign stores. +| | |-- build.sh Capture Guix channels; build canonical runtime pack; probe Podman info. +| | |-- bundle.sh Validate paired release; wrap encrypted backup, release and bootstrap. +| | |-- containers.conf Guix-only PATH-selected conmon/crun and rootless networking. +| | |-- manifest.scm Guix packages for the portable container/runtime tools. +| | |-- restore.sh Check capsule/host, decrypt safe restore, require images, start production. +| | |-- run.sh Select content-addressed Guix runtime; launch stack with explicit root. +| | |-- test-bootstrap.sh Real bootstrap in isolated filesystem using synthetic closure packs. +| | |-- test-recovery.sh Synthetic release activation, resume, intent/locks and private-state preservation. +| | `-- test.sh Bootstrap, immutable cleanup, integrity, overwrite refusal and launcher fixtures. | |-- searxng/ Search service configuration. | | `-- settings.yml SearXNG defaults: private instance, rate limiting, HTML search. | |-- Caddyfile Production domain routing, HTTPS, WKD and service reverse proxies. @@ -100,11 +112,11 @@ stack/ Personal service source, build recipes and recovery tooling. | `-- stack.service Systemd user boot unit for ~/stack start/stop. |-- src/ Management executable source. | |-- app/ Management command implementation modules. -| | |-- archive.rs Consistent snapshots, encrypted exports and validated directory restores. +| | |-- archive.rs Consistent snapshots, encrypted exports, legacy Caddy layout and validated restores. | | |-- chat.rs Chat build/package artifacts, container settings and owner administration. | | |-- cli.rs Management subcommands, flags and argument validation. -| | |-- files.rs Safe filesystem/archive operations, manifests and hashes. -| | |-- images.rs Export/import exact container images; enforce platform and content locks. +| | |-- files.rs Safe filesystem/archive operations, manifests, hashes and runtime copies. +| | |-- images.rs Export/import saved images with archive-only policy, platform and content locks. | | |-- process.rs Run child processes; capture output and report failures/status. | | |-- project.rs Discover/lock project; settings, Podman commands, service lifecycle. | | |-- release.rs Build checked release archives; validate/install production artifacts. @@ -152,7 +164,7 @@ PRIVATE AND GENERATED PATHS — NOT PUBLIC SOURCE .env Sole private root configuration; never commit. .git/ Local Git objects, refs, hooks and repository settings. .tools/ Downloaded toolchains, build tools, sources and caches. - bin/ Prebuilt management/chat commands and packaged chat assets. + bin/ Prebuilt management/chat commands, launcher and Guix pack. dist/ Locally built release tarballs and checksum files. node_modules/ Locked npm development dependencies; recreated by npm ci. target/ Cargo build output, WASM targets and generated rustdoc. @@ -166,10 +178,15 @@ PRIVATE AND GENERATED PATHS — NOT PUBLIC SOURCE repos/ Served bare Git repositories; separate from root .git/. searxng/ Runtime search configuration and persistent service files. exports/ Encrypted application backups and checksum files. + guix/ Unpacked content-addressed runtime packs; old packs retained. incoming/ Copied release archives and temporary deployment bootstrap. podman/ Recreated container storage/run state; never transfer as backup. graphify/ Public-source graph index, visual map and extraction artifacts. Other var/ paths may hold generated fixtures or temporary work. This map does not enumerate private files. Backups must keep .env and var/data; public Git - alone cannot recover services. See OPERATIONS.txt. + alone cannot recover services. See OPERATIONS.txt and GUIX.txt. + + Experimental host integration: /gnu/store holds canonical Guix packages; + /gnu/.stack-runtimes holds root-owned package install records and lock. + Neither holds application configuration, databases or TLS keys. -- cgit v1.2.3