| 1 |
# oxygenvcs.com |
| 2 |
|
| 3 |
The product site for Oxygen, OxygenHub and OxygenFlow. User documentation |
| 4 |
lives separately, at docs.oxygenvcs.com. |
| 5 |
|
| 6 |
Static on purpose: hand-written HTML and one stylesheet, no JavaScript, no |
| 7 |
cookies, no third-party fonts or requests. Less to maintain, little to |
| 8 |
attack. |
| 9 |
|
| 10 |
## Layout |
| 11 |
|
| 12 |
- `src/`: the pages and `assets/`. A page's `<!-- include header -->` and |
| 13 |
`<!-- include footer -->` lines are replaced by `partials/`. |
| 14 |
- `scripts/build.sh`: builds `public/` and `site.tar.gz` with sh, awk and |
| 15 |
tar, and refuses a page or stylesheet that loads anything from another |
| 16 |
site. |
| 17 |
- `.flow/pipeline.kdl`: OxygenFlow runs the build on every push and keeps |
| 18 |
`site.tar.gz` as an artifact with a signed provenance statement. |
| 19 |
- `deploy/`: how a host serves it. |
| 20 |
|
| 21 |
Preview locally: `sh scripts/build.sh && python3 -m http.server -d public 8000`. |
| 22 |
|
| 23 |
## Deploying (pull, not push) |
| 24 |
|
| 25 |
Nothing pushes to the server. A timer on the host runs `deploy/pull.sh`: |
| 26 |
it finds the newest passing run of `main`, downloads its `site.tar.gz`, |
| 27 |
checks it against the run's provenance (the file's SHA-256, this |
| 28 |
repository, `main`), unpacks it into `releases/RUN` and points `current` |
| 29 |
at it. The host needs no inbound access and no credentials. The last five |
| 30 |
releases stay: roll back with `ln -sfn releases/N current` and restart |
| 31 |
the server. |
| 32 |
|
| 33 |
On Earth (user services of `claude`, with lingering), serving |
| 34 |
127.0.0.1:7410 behind the Cloudflare tunnel: |
| 35 |
|
| 36 |
``` |
| 37 |
mkdir -p ~/oxygenvcs ~/.config/systemd/user |
| 38 |
cp deploy/pull.sh deploy/httpd.conf ~/oxygenvcs/ |
| 39 |
cp deploy/oxygenvcs-*.service deploy/oxygenvcs-pull.timer ~/.config/systemd/user/ |
| 40 |
systemctl --user daemon-reload |
| 41 |
systemctl --user start oxygenvcs-pull.service # first release |
| 42 |
systemctl --user enable --now oxygenvcs-web.service oxygenvcs-pull.timer |
| 43 |
``` |
| 44 |
|
| 45 |
The VisionFive 2 Lite (riscv64) later: the same, with busybox, curl and |
| 46 |
python3 installed. The tunnel's route for oxygenvcs.com (and .net, .org, |
| 47 |
.co.uk redirecting to it) points at the server's port. |