be9f14ce34
A small helpdesk system: an office Pixel running a patched GrapheneOS Dialer answers technician calls, records both call legs as separate channels, and a Ruby backend transcribes them through Whisper and files an AI summary against the caller. Squashed to a single commit for sharing. No credentials are included; secrets live outside the repo in /etc/helpdesk/env on the server or a gitignored .claude/env.local locally. See .claude/env.local.example for the shape. Start at README.md, then docs/architecture.md.
18 lines
1.7 KiB
Markdown
18 lines
1.7 KiB
Markdown
# deploy/
|
|
|
|
Reference copies of the server-side config for the Helpdesk production host (moje.al.army). The running
|
|
server is the source of truth; these are versioned so the box can be rebuilt and so changes are reviewable.
|
|
|
|
| File | Installed as | Purpose |
|
|
|---|---|---|
|
|
| `helpdesk.service` | `/etc/systemd/system/helpdesk.service` | Runs the WEBrick backend (system user, UTF-8 locale, loopback bind). |
|
|
| `helpdesk-deploy.sh` | `/usr/local/sbin/helpdesk-deploy` | Root deploy: sync checkout → `/srv/helpdesk`, migrate, restart, health-check, roll back. Run by the CI deploy job via scoped `sudo`. |
|
|
| `nginx-helpdesk.location.conf` | inside `/opt/nginx/conf/sites-available/moje.al.army.conf` (http context + the 443 server) | Reverse-proxy + operator-cert/proxy-secret headers behind the existing mTLS, plus the console's audit log format, rate-limit backstop, and security headers. |
|
|
| `nginx-device.conf` | `/opt/nginx/conf/sites-available/helpdesk-device.conf` | The phone's device door: TLS on :8443, no client cert, HMAC-authed by the backend, path allowlist + rate limits. |
|
|
| `nginx-device-proxy-snippet.conf` | `/opt/nginx/conf/snippets/helpdesk-device-proxy.conf` | Proxy snippet for the device door; blanks the operator-identity headers. |
|
|
| `helpdesk-pg-backup.sh` | `/usr/local/sbin/helpdesk-pg-backup.sh` | Nightly `pg_dump` of the helpdesk DB, 14-day retention. |
|
|
| `helpdesk-pg-backup.{service,timer}` | `/etc/systemd/system/` | Runs the backup nightly at 03:30. |
|
|
|
|
Secrets are never in these files: the backend reads `/etc/helpdesk/env` (root-only), and the nginx
|
|
`X-Proxy-Secret` value is injected at install time. Deploy, rollback, backups, and the full env
|
|
variable list are in `docs/operations.md`.
|