code wiki / _hdl_build / nx_vroom_nas_sync.nx
`nx_vroom_nas_sync.nx` source

1// nx_vroom_nas_sync.nx -- deploy the /video/ camera-fix to the LIVE served dir, SAFELY, as elderwesto
2// (operator 2026-06-23 "find it + auto-deploy hook ... don't crash with direct touches"). Investigation
3// proved: nginx serves nishifamily.com/video/ from /volume1/homes/elderwesto/nishihost/sites/nishifamily/
4// video/ (owned by elderwesto uid 1026 = our SSH login), and a Gitea post-receive hook (uid 1000) CANNOT
5// write that dir -- so the deploy runs as elderwesto instead.
6//
7// THE NO-CRASH GUARANTEE: the new files are pulled from the local Gitea bare repo (the EXACT pushed
8// commit, source of truth) into /tmp, then swapped into the served dir with ATOMIC mv (rename) -- nginx
9// never sees a partially-written file, and the daemon is never touched/restarted. Current files are
10// backed up first (reversible), and `set -e` aborts BEFORE any swap if the pull fails (live stays intact).
11//
12// Stages the credential (vault) to /tmp/nxpw + the deploy command to /tmp/nxcmd; nx_ssh_cmd runs it as
13// elderwesto. Run AFTER: nx_machine_key + _offc/nx_vault.elf open nas.nv. Then nx_ssh_cmd, then
14// nx_live_verify must find scaleX(-1) in the SERVED bytes. license_tier: ORIGINAL
15import "nx_syscalls.nx"
16
17const DEPLOY_CMD: *u8 = "set -e; DST=/volume1/homes/elderwesto/nishihost/sites/nishifamily/video; BARE=/volume1/docker/gitea/git/repositories/elderwesto/nishi-core.git; W=/tmp/nxvid; rm -rf $W; mkdir -p $W; git -c safe.directory='*' --git-dir=$BARE archive agents/invention-engine nxc2/sites/nishifamily/video/index.html nxc2/sites/nishifamily/video/app.js | tar -x -C $W; echo PULLED:; ls -l $W/nxc2/sites/nishifamily/video/; T=$(date +%s); cp -p $DST/index.html $DST/index.html.bak-$T; cp -p $DST/app.js $DST/app.js.bak-$T; cp $W/nxc2/sites/nishifamily/video/index.html $DST/.index.html.new; mv -f $DST/.index.html.new $DST/index.html; cp $W/nxc2/sites/nishifamily/video/app.js $DST/.app.js.new; mv -f $DST/.app.js.new $DST/app.js; echo DEPLOYED:; ls -l $DST/index.html $DST/app.js; echo MARKERS:; grep -c 'scaleX(-1)' $DST/index.html || true; grep -c 'tile self' $DST/app.js || true; rm -rf $W; echo SYNC_DONE\n"
18
19func slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
20func pw(s: *u8) -> i64 { sys_write(1,s,slen(s)); return 0 }
21func pn(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1} sys_write(1,bb,k); return 0 }
22
23func main() -> i64 {
24    let box: *i64 = sys_mmap(16) as *i64
25    let sec: *u8 = sys_read_file("/tmp/nxsecret.out" as *u8, box)
26    if (sec as i64)==0 { pw("SYNC-STAGE: no /tmp/nxsecret.out -- run nx_machine_key + _offc/nx_vault.elf open first\n"); sys_exit(1); return 1 }
27    let pf: i64 = sys_openat_wr("/tmp/nxpw" as *u8, 0x180)
28    if pf<0 { pw("SYNC-STAGE: cannot write /tmp/nxpw\n"); sys_exit(1); return 1 }
29    sys_write(pf, sec, box[0]); sys_close(pf)
30    let cf: i64 = sys_openat_wr("/tmp/nxcmd" as *u8, 0x180)
31    if cf<0 { pw("SYNC-STAGE: cannot write /tmp/nxcmd\n"); sys_exit(1); return 1 }
32    sys_write(cf, DEPLOY_CMD, slen(DEPLOY_CMD)); sys_close(cf)
33    pw("SYNC-STAGE: credential recovered to /tmp/nxpw ("); pn(box[0]); pw(" bytes) + atomic-deploy command staged to /tmp/nxcmd. Run nx_ssh_cmd to deploy (as elderwesto, backup+atomic mv).\n")
34    sys_exit(0); return 0
35}
nx_vroom_nas_sync.nx source

`nx_vroom_nas_sync.nx` source
