luckembursko/Prd
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Prd/deploy/README.md
Lucy Doupalů be9f14ce34 Helpdesk - operator console + patched GrapheneOS Dialer for call handling 
A small helpdesk system: an office Pixel running a patched GrapheneOS Dialer
answers technician calls, records both call legs as separate channels, and a
Ruby backend transcribes them through Whisper and files an AI summary against
the caller.

Squashed to a single commit for sharing. No credentials are included; secrets
live outside the repo in /etc/helpdesk/env on the server or a gitignored
.claude/env.local locally. See .claude/env.local.example for the shape.

Start at README.md, then docs/architecture.md.
2026-07-27 18:50:32 +02:00

1.7 KiB
Raw Permalink Blame History

deploy/

Reference copies of the server-side config for the Helpdesk production host (moje.al.army). The running server is the source of truth; these are versioned so the box can be rebuilt and so changes are reviewable.

File Installed as Purpose
helpdesk.service /etc/systemd/system/helpdesk.service Runs the WEBrick backend (system user, UTF-8 locale, loopback bind).
helpdesk-deploy.sh /usr/local/sbin/helpdesk-deploy Root deploy: sync checkout → /srv/helpdesk, migrate, restart, health-check, roll back. Run by the CI deploy job via scoped sudo.
nginx-helpdesk.location.conf inside /opt/nginx/conf/sites-available/moje.al.army.conf (http context + the 443 server) Reverse-proxy + operator-cert/proxy-secret headers behind the existing mTLS, plus the console's audit log format, rate-limit backstop, and security headers.
nginx-device.conf /opt/nginx/conf/sites-available/helpdesk-device.conf The phone's device door: TLS on :8443, no client cert, HMAC-authed by the backend, path allowlist + rate limits.
nginx-device-proxy-snippet.conf /opt/nginx/conf/snippets/helpdesk-device-proxy.conf Proxy snippet for the device door; blanks the operator-identity headers.
helpdesk-pg-backup.sh /usr/local/sbin/helpdesk-pg-backup.sh Nightly pg_dump of the helpdesk DB, 14-day retention.
helpdesk-pg-backup.{service,timer} /etc/systemd/system/ Runs the backup nightly at 03:30.

Secrets are never in these files: the backend reads /etc/helpdesk/env (root-only), and the nginx X-Proxy-Secret value is injected at install time. Deploy, rollback, backups, and the full env variable list are in docs/operations.md.