No description
Find a file
CroneKorkN 6fae2fd324
refactor(left4me): non-editable install + relocate runtime state to /var/lib/left4me
Two related changes landed together:

1. /opt/left4me/ becomes a root-owned deploy-artifact root. Only
   /opt/left4me/src lives there. Source tree is no longer mutated
   by pip at runtime; left4me only needs read access.
2. Runtime mutable state moved to /var/lib/left4me/: the venv (was
   /opt/left4me/.venv) and steamcmd (was /opt/left4me/steam).

The non-editable install copies the (root-owned) source to a
left4me-owned tempdir before `pip install --force-reinstall`.
setuptools.build_meta writes <pkg>.egg-info/ into the source dir
during get_requires_for_build_wheel, so a direct `pip install
/opt/left4me/src/l4d2*` fails on a root-owned source. The
temp-copy is what `python -m build` ought to do but doesn't (its
build isolation only sandboxes deps).

Prereq for the deployment-responsibility reshape: target-side
symlinks from /etc/... into /opt/left4me/src/deploy/files/... are
now safe by construction (left4me cannot rewrite its own hardening
profile).

Design + verification record: left4me/docs/superpowers/specs/
2026-05-15-runtime-state-relocation-design.md

Verified on ovh.left4me: bw apply idempotent on second pass (0
fixed, 0 failed); pip show reports site-packages location, no
Editable project location; web + gameserver units run clean;
alembic current returns head.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-15 17:56:08 +02:00
bin docs: scaffold agent-friendly entry points (Phase 1) 2026-05-10 15:44:45 +02:00
bundles refactor(left4me): non-editable install + relocate runtime state to /var/lib/left4me 2026-05-15 17:56:08 +02:00
data nginx: SSE-friendly proxy_pass + unconditional $connection_upgrade map 2026-05-10 22:12:03 +02:00
doc play around with systemd hardening 2022-03-27 13:29:58 +02:00
docs docs/specs: round-2 agents-md refactor design (gaps 7-12) 2026-05-10 20:39:40 +02:00
groups groups: add applications/left4me 2026-05-10 18:08:36 +02:00
hooks docs: scaffold agent-friendly entry points (Phase 1) 2026-05-10 15:44:45 +02:00
items docs: scaffold agent-friendly entry points (Phase 1) 2026-05-10 15:44:45 +02:00
libs docs: scaffold agent-friendly entry points (Phase 1) 2026-05-10 15:44:45 +02:00
nodes left4me: prefix steam_web_api_key vault value with !decrypt: 2026-05-12 22:57:21 +02:00
.editorconfig editorconfig 2022-08-09 16:49:48 +02:00
.envrc PATH_add bin 2023-08-09 07:16:06 +02:00
.gitignore gitignore: add bundlewrap git_deploy_repos map (operator-specific paths) 2026-05-10 18:43:59 +02:00
AGENTS.md AGENTS.md: drop the 6th ccc rule 2026-05-11 00:26:12 +02:00
CLAUDE.md docs: scaffold agent-friendly entry points (Phase 1) 2026-05-10 15:44:45 +02:00
groups.py print message on parsing group error 2025-06-22 09:36:56 +02:00
hass_get_temp.py bootshorn stuff 2025-08-24 15:23:17 +02:00
nodes.py demagify remove faults 2023-02-23 18:27:27 +01:00
README.md README: drop stale 'install bw fork' instruction 2026-05-10 15:19:44 +02:00
requirements.txt switch bundlewrap install to editable from CroneKorkN/bundlewrap@main 2026-05-10 15:14:31 +02:00

TODO

  • dont spamfilter forwarded mails
  • gollum wiki
  • blog?
  • fix dkim not working sometimes
  • LDAP
  • oauth2/OpenID
  • icinga

Raspberry pi as soundcard

monitor timers

Timer=backup

Triggers=$(systemctl show ${Timer}.timer --property=Triggers --value)
echo $Triggers
if systemctl is-failed "$Triggers"
then
  InvocationID=$(systemctl show "$Triggers" --property=InvocationID --value)
  echo $InvocationID
  ExitCode=$(systemctl show "$Triggers" -p ExecStartEx --value | sed 's/^{//' | sed 's/}$//' | tr ';' '\n' | xargs -n 1 | grep '^status=' | cut -d '=' -f 2)
  echo $ExitCode
  journalctl INVOCATION_ID="$InvocationID" --output cat
fi

telegraf: execd for daemons

TEST

git signing

git config --global gpg.format ssh git config --global commit.gpgsign true

git config user.name CroneKorkN git config user.email i@ckn.li git config user.signingkey "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILMVroYmswD4tLk6iH+2tvQiyaMe42yfONDsPDIdFv6I"