cayce
34a5f331ac
ci / lint-test-leaks (pull_request) Canceled after 0s
- cayceops core: env-only config (CAYCE_OPS_*), engine/session, ORM models with state machines (proposal/mail/content) and audited writes - provider-agnostic LLM interface (null provider default, stdlib openai-compat) - Typer CLI with lazy component loading (scanner/executor/maild/publisher/monitor) - alembic 0001 initial schema; sqlite-portable JSON columns - tests: 7 passing on throwaway sqlite; fixtures invented, never real data - ci: ruff + alembic smoke + pytest + gitleaks(full history) in .gitea/workflows + .github/workflows; local gate = make check - deploy: docker-compose (postgres 16) + hardened systemd units/timers - docs: DECISIONS D1-D9; README project (grant text retired)
25 lines
995 B
Markdown
25 lines
995 B
Markdown
# systemd deployment (VPS)
|
|
|
|
This is the primary deployment path (docker-compose is for local dev).
|
|
|
|
```bash
|
|
sudo useradd -r -m -d /srv/cayce-ops cayce
|
|
rsync -a --exclude .venv ./ cayce@vm:/srv/cayce-ops/
|
|
sudo -u cayce uv sync --frozen
|
|
sudo -u cayce cayceops db upgrade # alembic to head
|
|
sudo cp deploy/systemd/cayce-ops@.service deploy/systemd/cayce-ops@.timer /etc/systemd/system/
|
|
|
|
# cadence per daemon (edit OnCalendar in each timer copy):
|
|
# scanner hourly executor */10 min maild */5 min
|
|
# publisher */5 min monitor */1 min
|
|
for d in scanner executor maild publisher monitor; do
|
|
sudo cp deploy/systemd/cayce-ops@.timer /etc/systemd/system/cayce-ops@$d.timer
|
|
done
|
|
# adjust OnCalendar per timer, then:
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl enable --now cayce-ops@{scanner,executor,maild,publisher,monitor}.timer
|
|
```
|
|
|
|
The unit hardens the daemon (NoNewPrivileges, ProtectSystem=strict) and reads
|
|
secrets only from `/srv/cayce-ops/.env` (never in the repo).
|