# oxygenvcs.com

The product site for Oxygen, OxygenHub and OxygenFlow. User documentation
lives separately, at docs.oxygenvcs.com.

Static on purpose: hand-written HTML and one stylesheet, no JavaScript, no
cookies, no third-party fonts or requests. Less to maintain, little to
attack.

## Layout

- `src/`: the pages and `assets/`. A page's `<!-- include header -->` and
  `<!-- include footer -->` lines are replaced by `partials/`.
- `scripts/build.sh`: builds `public/` and `site.tar.gz` with sh, awk and
  tar, and refuses a page or stylesheet that loads anything from another
  site.
- `.flow/pipeline.kdl`: OxygenFlow runs the build on every push and keeps
  `site.tar.gz` as an artifact with a signed provenance statement.
- `deploy/`: how a host serves it.

Preview locally: `sh scripts/build.sh && python3 -m http.server -d public 8000`.

## Deploying (pull, not push)

Nothing pushes to the server. A timer on the host runs `deploy/pull.sh`:
it finds the newest passing run of `main`, downloads its `site.tar.gz`,
checks it against the run's provenance (the file's SHA-256, this
repository, `main`), unpacks it into `releases/RUN` and points `current`
at it. The host needs no inbound access and no credentials. The last five
releases stay: roll back with `ln -sfn releases/N current` and restart
the server.

On Earth (user services of `claude`, with lingering), serving
127.0.0.1:7410 behind the Cloudflare tunnel:

```
mkdir -p ~/oxygenvcs ~/.config/systemd/user
cp deploy/pull.sh deploy/httpd.conf ~/oxygenvcs/
cp deploy/oxygenvcs-*.service deploy/oxygenvcs-pull.timer ~/.config/systemd/user/
systemctl --user daemon-reload
systemctl --user start oxygenvcs-pull.service        # first release
systemctl --user enable --now oxygenvcs-web.service oxygenvcs-pull.timer
```

The VisionFive 2 Lite (riscv64) later: the same, with busybox, curl and
python3 installed. The tunnel's route for oxygenvcs.com (and .net, .org,
.co.uk redirecting to it) points at the server's port.