Jaroslav Beneš
47791a88c7
A real shell on the chat's own connection, opened and closed like the inspector and never beside it. The modes govern the model; what a person types is theirs, since they hold the credential and could open the same shell with an ssh client. The model cannot see the panel -- a button copies the output you choose into the composer. The session outlives the socket: closing the panel leaves a build running, and coming back reattaches with the scrollback. Two tabs share one shell and the smaller window decides the size. It ends on an idle timeout, on deleting the chat, on disabling, moving or deleting the connection, and on a restart -- which says why rather than quietly opening a fresh shell that has lost the working directory. The nginx template's `Connection ""` is right for SSE and fails every WebSocket handshake, so `location /` now uses a `map $http_upgrade`; update.sh grows a drift check for it, because the only symptom on a stale vhost is a panel that cannot connect. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
134 lines
6.0 KiB
Markdown
134 lines
6.0 KiB
Markdown
# Deployment
|
|
|
|
Installs LLeMbas as a **system** service behind nginx with a self-signed
|
|
certificate. Written for a systemd + nginx host; tested on Arch.
|
|
|
|
| | Default |
|
|
|---|---|
|
|
| Service user | `lembas` (system account, `nologin`) |
|
|
| Home | `/home/lembas` |
|
|
| Install prefix | `/srv/lembas` (bind mount of the home) |
|
|
| Checkout | `$PREFIX/app` |
|
|
| Virtualenv | `$PREFIX/venv` |
|
|
| Database | `$PREFIX/data/lembas.db` |
|
|
| Environment | `$PREFIX/lembas.env` (mode 600) |
|
|
| Unit | `/etc/systemd/system/lembas.service` |
|
|
| Vhost | `/etc/nginx/conf.d/<host>.conf` |
|
|
| Listens on | `127.0.0.1:8080` — reachable only through nginx |
|
|
|
|
The prefix defaults to a bind mount of the service user's home because on many
|
|
machines the root filesystem is small while `/home` is not, and the virtualenv
|
|
plus database belong on the larger volume. Set `PREFIX=$HOME_DIR` to skip it.
|
|
|
|
## First install
|
|
|
|
```bash
|
|
SITE_HOST=chat.example ./deploy/install.sh
|
|
```
|
|
|
|
Idempotent — safe to re-run. It creates the user and bind mount, clones the
|
|
repo, builds the venv, generates `lembas.env` with a fresh `LEMBAS_SECRET_KEY`,
|
|
installs the unit and vhost, issues a self-signed certificate, adds a
|
|
`/etc/hosts` entry if the name does not already resolve, and enables the
|
|
service.
|
|
|
|
Then open `https://<SITE_HOST>`, accept the certificate warning, and create the
|
|
first account — it becomes the administrator.
|
|
|
|
Everything is overridable from the environment:
|
|
|
|
| Variable | Default | |
|
|
|---|---|---|
|
|
| `SITE_HOST` | `lembas.local` | nginx `server_name` and certificate CN |
|
|
| `APP_PORT` | `8080` | loopback port the service binds |
|
|
| `SERVICE_USER` | `lembas` | system account to run as |
|
|
| `HOME_DIR` | `/home/lembas` | that account's home |
|
|
| `PREFIX` | `/srv/lembas` | install root (bind mount of `HOME_DIR`) |
|
|
| `REPO_URL` | this checkout's `origin` | so a fork deploys itself |
|
|
| `LEMBAS_BRANCH` | `main` | branch to deploy |
|
|
|
|
## Deploying a change
|
|
|
|
```bash
|
|
git push
|
|
./deploy/update.sh
|
|
```
|
|
|
|
`update.sh` fetches, hard-resets the deployment checkout to `origin/main`,
|
|
reinstalls dependencies and restarts, printing the commits it pulled. The hard
|
|
reset is deliberate: nothing is ever edited in place there, so there is no local
|
|
work to preserve and no conflicts to resolve.
|
|
|
|
## Operating it
|
|
|
|
```bash
|
|
systemctl status lembas
|
|
journalctl -u lembas -f
|
|
sudo -u lembas /srv/lembas/venv/bin/lembas info # paths and counts
|
|
```
|
|
|
|
Configuration lives in `$PREFIX/lembas.env`. Edit it and restart.
|
|
|
|
## Notes
|
|
|
|
**The secret key is generated once.** `install.sh` will not overwrite an
|
|
existing `lembas.env`. Rotating `LEMBAS_SECRET_KEY` signs every user out *and*
|
|
makes stored upstream API keys unreadable — they would have to be re-entered.
|
|
|
|
**nginx buffering is off for a reason.** Replies stream as server-sent events.
|
|
With `proxy_buffering on` (the default) nginx holds the entire reply and
|
|
delivers it in one lump at the end, which is indistinguishable from streaming
|
|
being broken. `proxy_read_timeout` is raised to an hour because a model can
|
|
think for minutes before the first token.
|
|
|
|
**The vhost passes WebSocket upgrades through, and must.** The terminal panel
|
|
is the one WebSocket in LLeMbas. A `location` that sets `Connection ""` — which
|
|
is what SSE alone needs, and what this template used to say — fails every
|
|
handshake, and a failed handshake tells the browser nothing: no status, no
|
|
reason. The `map $http_upgrade` at the top of the vhost yields the empty string
|
|
when the client did not ask to upgrade, so streaming is unaffected. `update.sh`
|
|
warns when the installed vhost has drifted from the template, because this is
|
|
the failure most likely to be diagnosed as a bug in the application.
|
|
|
|
**Every restart kills every open shell.** A reply being written is persisted
|
|
with whatever it has; a terminal has nothing to persist, so a command still
|
|
running on the far side is cut off. `update.sh` restarts unconditionally, so a
|
|
deploy in the middle of somebody's `apt-get dist-upgrade` ends it. The panel is
|
|
told why rather than silently reconnecting to a new shell, which would have
|
|
lost the working directory and the half-typed command.
|
|
|
|
**A terminal is not in the transcript, and is not logged.** The open and the
|
|
close are logged with the user, the chat and the connection; what was typed is
|
|
not recorded anywhere. That follows from the design — the chat's mode governs
|
|
the model, not the person at the keyboard — but everything else an agent chat
|
|
does *is* in the transcript, so it is a difference in kind and worth knowing
|
|
before somebody goes looking for the history.
|
|
|
|
**Nothing an agent does runs on this machine.** Agent chats execute their
|
|
commands over SSH, on a host somebody added and prepared — a container, a VM,
|
|
another machine. That is the whole isolation story, and it is why the unit can
|
|
stay locked down instead of being opened up to make room for a sandbox.
|
|
|
|
`ProtectSystem=full` rather than `strict` only because the data directory must
|
|
be writable and `strict` would mean listing every path.
|
|
|
|
The practical consequence for whoever runs this: **the security of an agent
|
|
chat is the security of the host behind its SSH profile.** A throwaway
|
|
container with the one project mounted into it is a very different thing from a
|
|
key to a production server, and LLeMbas cannot tell them apart.
|
|
|
|
**Use a real certificate if this is exposed beyond a trusted LAN.** The
|
|
self-signed cert exists so the install works with no external dependencies;
|
|
point `ssl_certificate` at a real one and nothing else needs to change.
|
|
|
|
The session cookie is deliberately not marked `secure`, so that a LAN install
|
|
over plain http can sign anybody in at all. That has always meant a network
|
|
attacker on http could steal a session; with the terminal it also means they
|
|
could open an interactive shell on the machine behind that chat. If the
|
|
terminal is switched on, run this over TLS.
|
|
|
|
**One worker only.** True of generations already — the registry is in-process —
|
|
and sharper here: with two workers a browser reconnecting to its terminal could
|
|
land in the process that has no shell for it, and silently open a second one on
|
|
the same machine.
|