be9f14ce34
A small helpdesk system: an office Pixel running a patched GrapheneOS Dialer answers technician calls, records both call legs as separate channels, and a Ruby backend transcribes them through Whisper and files an AI summary against the caller. Squashed to a single commit for sharing. No credentials are included; secrets live outside the repo in /etc/helpdesk/env on the server or a gitignored .claude/env.local locally. See .claude/env.local.example for the shape. Start at README.md, then docs/architecture.md. |
||
|---|---|---|
| .. | ||
| helpdesk-deploy.sh | ||
| helpdesk-pg-backup.service | ||
| helpdesk-pg-backup.sh | ||
| helpdesk-pg-backup.timer | ||
| helpdesk.service | ||
| nginx-device-proxy-snippet.conf | ||
| nginx-device.conf | ||
| nginx-helpdesk.location.conf | ||
| README.md | ||
deploy/
Reference copies of the server-side config for the Helpdesk production host (moje.al.army). The running server is the source of truth; these are versioned so the box can be rebuilt and so changes are reviewable.
| File | Installed as | Purpose |
|---|---|---|
helpdesk.service |
/etc/systemd/system/helpdesk.service |
Runs the WEBrick backend (system user, UTF-8 locale, loopback bind). |
helpdesk-deploy.sh |
/usr/local/sbin/helpdesk-deploy |
Root deploy: sync checkout → /srv/helpdesk, migrate, restart, health-check, roll back. Run by the CI deploy job via scoped sudo. |
nginx-helpdesk.location.conf |
inside /opt/nginx/conf/sites-available/moje.al.army.conf (http context + the 443 server) |
Reverse-proxy + operator-cert/proxy-secret headers behind the existing mTLS, plus the console's audit log format, rate-limit backstop, and security headers. |
nginx-device.conf |
/opt/nginx/conf/sites-available/helpdesk-device.conf |
The phone's device door: TLS on :8443, no client cert, HMAC-authed by the backend, path allowlist + rate limits. |
nginx-device-proxy-snippet.conf |
/opt/nginx/conf/snippets/helpdesk-device-proxy.conf |
Proxy snippet for the device door; blanks the operator-identity headers. |
helpdesk-pg-backup.sh |
/usr/local/sbin/helpdesk-pg-backup.sh |
Nightly pg_dump of the helpdesk DB, 14-day retention. |
helpdesk-pg-backup.{service,timer} |
/etc/systemd/system/ |
Runs the backup nightly at 03:30. |
Secrets are never in these files: the backend reads /etc/helpdesk/env (root-only), and the nginx
X-Proxy-Secret value is injected at install time. Deploy, rollback, backups, and the full env
variable list are in docs/operations.md.