code wiki / _hdl_build / nx_deploy_secure.nx

nx_deploy_secure.nx

buildroot/runtime/_hdl_build/nx_deploy_secure.nx

4822 B92 linesdepth 3pulls 3 transitivereach 0 importersview sourcekind tooltopic deploy

docs dependencies structs consts functions

about

nx_deploy_secure.nx -- ZERO-PERSISTENT-PLAINTEXT unattended deploy (vault backlog #5). One sovereign orchestrator: derive the machine-bound key -> open the encrypted vault -> hand the credential to the team's SSH deployer -> SHRED every ephemeral (overwrite + unlink). The operator runs ONE command, never types or stages the password, and no plaintext credential survives on disk past the deploy. Chains the gated modules via fork/execve/wait4 (NishiLang orchestration). Pre-staged by the caller: /tmp/nxput.payload (the page) + /tmp/nxput.dst (remote write cmd). Requires: /tmp/nx_machine_key.elf, _offc/nx_vault.elf, /tmp/nx_ssh_putpage.elf (bootstrap-built). license_tier: ORIGINAL

dependencies 2 imports · 0 importers

imports: nx_syscalls.nxnx_itoa_lib.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

12	const AT_MAGIC_4096: i64 = 4096
14	const AT_FDCWD: i64 = 0 - 100

functions

16	func _p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } called by 1: main calls 1: sys_write
21	func _pn(v: i64) -> i64 { nxi_out(v); return 0 } called by 1: main calls 1: nxi_out
24	func ds_run1(path: u8, arg1: u8, arg2: *u8) -> i64 called by 1: main calls 5: sys_fork sys_mmap sys_execve sys_exit sys_wait4
46	func ds_shred(path: *u8) -> i64 called by 1: ds_cleanup calls 4: sys_openat_wr sys_mmap sys_write sys_close
59	func ds_cleanup() -> i64 called by 1: main calls 1: ds_shred
65	func main() -> i64 calls 10: _p ds_run1 ds_cleanup sys_exit sys_mmap sys_read_file+4