sync full source from private myoffice

proxmox/README.md

@@ -4,52 +4,56 @@ Three-tier setup on **your Gitea**:
 
 | Tier | Repo | Visibility | Contents |
 |------|------|------------|----------|
-| 1. Dev | `myoffice` | Private | Full source |
-| 2. Public code | `myoffice-public` | Public | Allowlisted scripts (`proxmox/`, `Docker/`, README) |
+| 1. Dev | `myoffice` | Private | Full source + Actions |
+| 2. Public code | `myoffice-public` | Public | Full source (manual build) + Proxmox scripts |
 | 3. Published app | Releases on `myoffice-public` | Public | `myoffice-publish.tar.gz` |
 
-CT install downloads the release tarball (not source). No Docker/nginx/SDK/Node inside the CT — proxy with your existing nginx LXC to Kestrel `:9100`.
+CT install downloads the **release** tarball (not source). No Docker/nginx/SDK/Node inside the CT — proxy with your existing nginx LXC to Kestrel `:9100`.
 
 ```text
-[private myoffice] --sync-public--> [myoffice-public raw scripts]
+[private myoffice] --sync-public--> [myoffice-public full source + README]
 [private myoffice] --publish+release--> [Gitea Release .tar.gz]
                                               |
-[User Proxmox] curl myoffice.sh ----------> [LXC: Postgres + ASP.NET + app]
+[User Proxmox] one-line curl myoffice.sh --> [LXC: Postgres + ASP.NET + app]
                                               ^
 [User nginx] proxy_pass http://ct-ip:9100 ----+
 ```
 
-## End user: create CT
+## End user: create CT (one line)
+
+Shown on the **public** repo `README.md` after sync. Example for this instance:
 
 ```bash
-export GITEA_URL="https://gitea.example.com"
-export GITEA_OWNER="org"
-export GITEA_REPO="myoffice-public"          # optional, default
-export RELEASE_TAG="latest"                  # or v1.2.3
-export REPO_RAW_BASE="${GITEA_URL}/${GITEA_OWNER}/${GITEA_REPO}/raw/branch/main"
-
-bash -c "$(curl -fsSL ${REPO_RAW_BASE}/proxmox/myoffice.sh)"
+bash -c "$(curl -fsSL https://mygit.ase.com.ua/alexandr/myoffice_public/raw/branch/master/proxmox/myoffice.sh)"
 ```
 
-Or copy `proxmox/` to the host and run `bash myoffice.sh` with the same env vars.
+Optional env before the command: `GITEA_URL`, `GITEA_OWNER`, `GITEA_REPO`, `GITEA_BRANCH`, `RELEASE_TAG` (`latest` or `v1.2.3`).
 
 Whiptail: Default / Advanced (Public URL, release tag) → creates CT → installs Postgres + ASP.NET runtime → downloads release → configures FrontEnd/CORS + local Postgres → systemd.
 
+## End user: build from public source
+
+```bash
+git clone https://mygit.ase.com.ua/alexandr/myoffice_public.git
+cd myoffice_public
+./proxmox/publish.sh --tar
+```
+
 ## Maintainer: publish a release
 
-On the private repo (build PC):
+On the private repo (build PC or Gitea Actions):
 
 ```powershell
 $env:GITEA_TOKEN = '<token with write:repository on myoffice-public>'
 
 .\proxmox\publish.ps1 -Tar
-.\proxmox\release.ps1 -GiteaUrl https://gitea.example.com -Owner org -Repo myoffice-public -Tag v1.2.3
-.\proxmox\sync-public.ps1 -GiteaUrl https://gitea.example.com -Owner org -Repo myoffice-public -Push
+.\proxmox\release.ps1 -GiteaUrl https://mygit.ase.com.ua -Owner alexandr -Repo myoffice_public -Tag v1.2.3
+.\proxmox\sync-public.ps1 -GiteaUrl https://mygit.ase.com.ua -Owner alexandr -Repo myoffice_public -Branch master -Push
 ```
 
 - `proxmox/publish.ps1` → `_Published/` + `myoffice-publish.tar.gz`
 - `proxmox/release.ps1` → Gitea Release asset
-- `proxmox/sync-public.ps1` → push allowlisted files to public repo (scripts users curl)
+- `proxmox/sync-public.ps1` → full source + public `README.md` (from `README.public.md`)
 
 Or via Gitea Actions on the private repo (`.gitea/workflows/publish.yml`): push `master` → tag `latest`, or push tag `v*` / manual dispatch.
 
@@ -112,7 +116,7 @@ Three layers (independent):
 
 | Layer | What | How |
 |-------|------|-----|
-| Toolcache | .NET SDK / Node binaries | `setup-dotnet` / `setup-node` write to `/opt/hostedtoolcache`. Persist it on the **act_runner** host so the next job reuses downloads (steps still run, but skip re-download — you already saw `Found in cache @ /opt/hostedtoolcache/...`). |
+| Toolcache | .NET SDK / Node binaries | `setup-dotnet` / `setup-node` write to `/opt/hostedtoolcache`. Persist it on the **act_runner** host (Docker volume) so the next job reuses downloads (steps still run, but skip re-download — you already saw `Found in cache @ /opt/hostedtoolcache/...`). |
 | Actions cache | NuGet + npm packages | Workflow uses `actions/cache@v4` for `~/.nuget/packages` and `~/.npm`. Needs the runner cache server (default on act_runner). |
 | Skip setup | No setup steps at all | Bake SDK + Node into the job Docker image (or host runner), then set job env `SKIP_SETUP_DOTNET=true` and `SKIP_SETUP_NODE=true`. |
 
@@ -126,6 +130,8 @@ volumes:
 
 If jobs use ephemeral containers without that volume, SDKs download every run.
 
+## Defaults
+
 - Debian 12 LXC, unprivileged, `--onboot 1`
 - 2 vCPU / 4096 MiB / 20G / `vmbr0` / DHCP
 - Listen `:9100`

proxmox/myoffice.sh

@@ -4,7 +4,8 @@
 #   export GITEA_URL="https://gitea.example.com"
 #   export GITEA_OWNER="org"
 #   export GITEA_REPO="myoffice-public"
-#   export REPO_RAW_BASE="${GITEA_URL}/${GITEA_OWNER}/${GITEA_REPO}/raw/branch/main"
+#   export GITEA_BRANCH="master"
+#   export REPO_RAW_BASE="${GITEA_URL}/${GITEA_OWNER}/${GITEA_REPO}/raw/branch/${GITEA_BRANCH}"
 #   bash -c "$(curl -fsSL ${REPO_RAW_BASE}/proxmox/myoffice.sh)"
 #
 # Creates one LXC with PostgreSQL + ASP.NET runtime + app from Gitea Release.
@@ -15,22 +16,28 @@ set -euo pipefail
 GITEA_URL="${GITEA_URL:-}"
 GITEA_OWNER="${GITEA_OWNER:-}"
 GITEA_REPO="${GITEA_REPO:-myoffice-public}"
+GITEA_BRANCH="${GITEA_BRANCH:-master}"
 RELEASE_TAG="${RELEASE_TAG:-latest}"
 RELEASE_ASSET_URL="${RELEASE_ASSET_URL:-}"
 GITEA_TOKEN="${GITEA_TOKEN:-}"
 
 if [[ -z "${REPO_RAW_BASE:-}" ]]; then
   if [[ -n "$GITEA_URL" && -n "$GITEA_OWNER" ]]; then
-    REPO_RAW_BASE="${GITEA_URL%/}/${GITEA_OWNER}/${GITEA_REPO}/raw/branch/main"
+    REPO_RAW_BASE="${GITEA_URL%/}/${GITEA_OWNER}/${GITEA_REPO}/raw/branch/${GITEA_BRANCH}"
   else
-    REPO_RAW_BASE="https://gitea.example.com/OWNER/myoffice-public/raw/branch/main"
+    REPO_RAW_BASE="https://gitea.example.com/OWNER/myoffice-public/raw/branch/${GITEA_BRANCH}"
   fi
 fi
 
 # Derive GITEA_* from REPO_RAW_BASE when only raw base is set:
-#   https://host/owner/repo/raw/branch/main
+#   https://host/owner/repo/raw/branch/master
 if [[ -z "$GITEA_URL" || -z "$GITEA_OWNER" ]]; then
-  if [[ "$REPO_RAW_BASE" =~ ^(https?://[^/]+)/([^/]+)/([^/]+)/raw/ ]]; then
+  if [[ "$REPO_RAW_BASE" =~ ^(https?://[^/]+)/([^/]+)/([^/]+)/raw/branch/([^/]+) ]]; then
+    [[ -z "$GITEA_URL" ]] && GITEA_URL="${BASH_REMATCH[1]}"
+    [[ -z "$GITEA_OWNER" ]] && GITEA_OWNER="${BASH_REMATCH[2]}"
+    [[ "$GITEA_REPO" == "myoffice-public" ]] && GITEA_REPO="${BASH_REMATCH[3]}"
+    GITEA_BRANCH="${BASH_REMATCH[4]}"
+  elif [[ "$REPO_RAW_BASE" =~ ^(https?://[^/]+)/([^/]+)/([^/]+)/raw/ ]]; then
     [[ -z "$GITEA_URL" ]] && GITEA_URL="${BASH_REMATCH[1]}"
     [[ -z "$GITEA_OWNER" ]] && GITEA_OWNER="${BASH_REMATCH[2]}"
     [[ "$GITEA_REPO" == "myoffice-public" ]] && GITEA_REPO="${BASH_REMATCH[3]}"

proxmox/sync-public.ps1

@@ -1,10 +1,9 @@
-# Sync allowlisted paths from the private repo to the public Gitea repo (no full source).
+# Sync full source from the private repo to the public Gitea repo (manual build + Proxmox scripts).
 # Usage:
-#   $env:GITEA_TOKEN = '<token>'   # optional if using SSH remote
+#   $env:GITEA_TOKEN = '<token>'
 #   .\proxmox\sync-public.ps1 -GiteaUrl https://gitea.example.com -Owner org -Repo myoffice-public -Push
 #
-# Allowlist: proxmox/, Docker/, README.md, LICENSE (if present).
-# Never syncs MyOffice.* source, _Published, secrets, node_modules, etc.
+# Copies tracked git files (plus generates public README.md). Skips private CI, secrets, build junk.
 
 [CmdletBinding()]
 param(
@@ -16,7 +15,7 @@ param(
 
 	[string]$Repo = 'myoffice-public',
 
-	[string]$Branch = 'main',
+	[string]$Branch = 'master',
 
 	[string]$Token = $env:GITEA_TOKEN,
 
@@ -37,55 +36,16 @@ if (-not $WorkDir) {
 	$WorkDir = Join-Path $env:TEMP 'myoffice-public-sync'
 }
 
-$allowDirs = @('proxmox', 'Docker')
-$allowFiles = @('README.md', 'LICENSE', 'LICENSE.md')
-$excludeNames = @('.git', '_Published', 'myoffice-publish.tar.gz', 'node_modules', 'data', '.env', 'env.local')
-
-function Test-Excluded([string]$Name) {
-	return $excludeNames -contains $Name
-}
-
-function Copy-Allowlisted {
-	param([string]$DestRoot)
-
-	foreach ($dir in $allowDirs) {
-		$src = Join-Path $repoRoot $dir
-		if (-not (Test-Path $src)) {
-			Write-Host "Skip missing dir: $dir"
-			continue
-		}
-		$dest = Join-Path $DestRoot $dir
-		if (Test-Path $dest) {
-			Remove-Item -Recurse -Force $dest
-		}
-		New-Item -ItemType Directory -Path $dest -Force | Out-Null
-
-		Get-ChildItem -Path $src -Force | Where-Object { -not (Test-Excluded $_.Name) } | ForEach-Object {
-			if ($dir -eq 'Docker' -and $_.Name -eq 'data') { return }
-			Copy-Item $_.FullName -Destination (Join-Path $dest $_.Name) -Recurse -Force
-		}
-		Write-Host "Synced $dir/"
-	}
-
-	foreach ($file in $allowFiles) {
-		$src = Join-Path $repoRoot $file
-		if (Test-Path $src) {
-			Copy-Item $src -Destination (Join-Path $DestRoot $file) -Force
-			Write-Host "Synced $file"
-		}
-	}
-
-	$publicNote = Join-Path $DestRoot 'PUBLIC.md'
-	@(
-		'# MyOffice public tree',
-		'',
-		'This repository is a **filtered** mirror for Proxmox CT install scripts and Docker demo files.',
-		'Application **source** stays in the private developer repository.',
-		'Runnable app binaries are published as **Gitea Releases** (`myoffice-publish.tar.gz`).',
-		'',
-		'See [proxmox/README.md](proxmox/README.md).',
-		''
-	) | Set-Content -Path $publicNote -Encoding utf8
+function Test-SkipPath([string]$RelPath) {
+	$n = $RelPath -replace '\\', '/'
+	if ($n -eq '.gitea' -or $n.StartsWith('.gitea/')) { return $true }
+	if ($n -eq '_Published' -or $n.StartsWith('_Published/')) { return $true }
+	if ($n -eq 'myoffice-publish.tar.gz') { return $true }
+	if ($n -eq 'Docker/data' -or $n.StartsWith('Docker/data/')) { return $true }
+	if ($n -eq '.env' -or $n.StartsWith('.env.') -or $n -eq 'env.local') { return $true }
+	if ($n -eq 'proxmox/README.public.md') { return $true }
+	if ($n.EndsWith('.user') -or $n.EndsWith('.suo')) { return $true }
+	return $false
 }
 
 if ($Token) {
@@ -99,7 +59,7 @@ else {
 }
 
 Write-Host "-----------------------------------------------"
-Write-Host "Sync allowlist -> $Owner/$Repo ($Branch)"
+Write-Host "Sync full source -> $Owner/$Repo ($Branch)"
 Write-Host "WorkDir: $WorkDir"
 Write-Host "-----------------------------------------------"
 
@@ -129,7 +89,42 @@ Get-ChildItem -Path $WorkDir -Force | Where-Object { $_.Name -ne '.git' } | ForE
 	Remove-Item $_.FullName -Recurse -Force
 }
 
-Copy-Allowlisted -DestRoot $WorkDir
+$tracked = git -C $repoRoot ls-files
+$copied = 0
+$skipped = 0
+foreach ($f in $tracked) {
+	if (Test-SkipPath $f) {
+		$skipped++
+		continue
+	}
+	$src = Join-Path $repoRoot $f
+	if (-not (Test-Path -LiteralPath $src)) {
+		continue
+	}
+	$dest = Join-Path $WorkDir $f
+	$destDir = Split-Path -Parent $dest
+	if (-not (Test-Path $destDir)) {
+		New-Item -ItemType Directory -Path $destDir -Force | Out-Null
+	}
+	Copy-Item -LiteralPath $src -Destination $dest -Force
+	$copied++
+}
+Write-Host "Copied $copied tracked files (skipped $skipped)."
+
+$repoRawBase = "$GiteaUrl/$Owner/$Repo/raw/branch/$Branch"
+$template = Join-Path $scriptDir 'README.public.md'
+if (-not (Test-Path $template)) {
+	throw "Missing $template"
+}
+$readme = Get-Content -LiteralPath $template -Raw -Encoding utf8
+$readme = $readme.
+	Replace('__GITEA_URL__', $GiteaUrl).
+	Replace('__GITEA_OWNER__', $Owner).
+	Replace('__GITEA_REPO__', $Repo).
+	Replace('__GITEA_BRANCH__', $Branch).
+	Replace('__REPO_RAW_BASE__', $repoRawBase)
+Set-Content -LiteralPath (Join-Path $WorkDir 'README.md') -Value $readme -Encoding utf8 -NoNewline
+Write-Host "Wrote public README.md"
 
 git -C $WorkDir add -A
 $status = git -C $WorkDir status --porcelain
@@ -138,8 +133,8 @@ if (-not $status) {
 }
 else {
 	git -C $WorkDir -c user.email='myoffice-sync@local' -c user.name='myoffice-sync' `
-		commit -m "sync public allowlist from private myoffice"
-	Write-Host "Committed allowlist snapshot."
+		commit -m "sync full source from private myoffice"
+	Write-Host "Committed public snapshot."
 }
 
 if ($Push) {
@@ -156,6 +151,6 @@ else {
 }
 
 Write-Host ""
-Write-Host "Raw base for CT install:"
-Write-Host "  $GiteaUrl/$Owner/$Repo/raw/branch/$Branch"
+Write-Host "Proxmox one-liner:"
+Write-Host ('  bash -c "$(curl -fsSL {0}/proxmox/myoffice.sh)"' -f $repoRawBase)
 Write-Host ""

proxmox/sync-public.sh

@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
-# Sync allowlisted paths from the private repo to the public Gitea repo (no full source).
+# Sync full source from the private repo to the public Gitea repo (manual build + Proxmox scripts).
 # Usage:
 #   export GITEA_TOKEN='<token>'
 #   ./proxmox/sync-public.sh --gitea-url https://gitea.example.com --owner org --repo myoffice-public --push
 #
-# Allowlist: proxmox/, Docker/, README.md, LICENSE (if present).
+# Copies tracked git files (plus generates public README.md). Skips private CI, secrets, build junk.
 
 set -euo pipefail
 
@@ -15,7 +15,7 @@ cd "$repo_root"
 gitea_url="${GITEA_URL:-}"
 owner="${GITEA_OWNER:-}"
 repo="${GITEA_REPO:-myoffice-public}"
-branch="${BRANCH:-main}"
+branch="${BRANCH:-master}"
 token="${GITEA_TOKEN:-}"
 work_dir="${WORK_DIR:-}"
 do_push=false
@@ -71,16 +71,19 @@ if [[ -z "$work_dir" ]]; then
 	work_dir="${TMPDIR:-/tmp}/myoffice-public-sync"
 fi
 
-allow_dirs=(proxmox Docker)
-allow_files=(README.md LICENSE LICENSE.md)
-exclude_names=('.git' '_Published' 'myoffice-publish.tar.gz' 'node_modules' 'data' '.env' 'env.local')
-
-is_excluded() {
-	local name="$1"
-	for x in "${exclude_names[@]}"; do
-		[[ "$name" == "$x" ]] && return 0
-	done
-	return 1
+# Paths never published (private CI, secrets, local junk).
+should_skip() {
+	local f="$1"
+	case "$f" in
+		.gitea | .gitea/*) return 0 ;;
+		_Published | _Published/*) return 0 ;;
+		myoffice-publish.tar.gz) return 0 ;;
+		Docker/data | Docker/data/*) return 0 ;;
+		.env | .env.* | env.local) return 0 ;;
+		*.user | *.suo) return 0 ;;
+		proxmox/README.public.md) return 0 ;; # baked into public README.md
+		*) return 1 ;;
+	esac
 }
 
 if [[ -n "$token" ]]; then
@@ -98,7 +101,7 @@ else
 fi
 
 echo "-----------------------------------------------"
-echo "Sync allowlist -> $owner/$repo ($branch)"
+echo "Sync full source -> $owner/$repo ($branch)"
 echo "WorkDir: $work_dir"
 echo "-----------------------------------------------"
 
@@ -119,53 +122,50 @@ fi
 
 find "$work_dir" -mindepth 1 -maxdepth 1 ! -name '.git' -exec rm -rf {} +
 
-for dir in "${allow_dirs[@]}"; do
-	src="$repo_root/$dir"
-	if [[ ! -d "$src" ]]; then
-		echo "Skip missing dir: $dir"
+copied=0
+skipped=0
+while IFS= read -r -d '' f; do
+	if should_skip "$f"; then
+		skipped=$((skipped + 1))
 		continue
 	fi
-	dest="$work_dir/$dir"
-	mkdir -p "$dest"
-	while IFS= read -r -d '' item; do
-		name="$(basename "$item")"
-		if is_excluded "$name"; then
-			continue
-		fi
-		if [[ "$dir" == Docker && "$name" == data ]]; then
-			continue
-		fi
-		cp -a "$item" "$dest/"
-	done < <(find "$src" -mindepth 1 -maxdepth 1 -print0)
-	echo "Synced $dir/"
-done
-
-for file in "${allow_files[@]}"; do
-	src="$repo_root/$file"
-	if [[ -f "$src" ]]; then
-		cp -a "$src" "$work_dir/$file"
-		echo "Synced $file"
+	src="$repo_root/$f"
+	if [[ ! -e "$src" ]]; then
+		continue
 	fi
-done
+	dest="$work_dir/$f"
+	mkdir -p "$(dirname "$dest")"
+	cp -a "$src" "$dest"
+	copied=$((copied + 1))
+done < <(git -C "$repo_root" ls-files -z)
 
-cat >"$work_dir/PUBLIC.md" <<'EOF'
-# MyOffice public tree
+echo "Copied $copied tracked files (skipped $skipped)."
 
-This repository is a **filtered** mirror for Proxmox CT install scripts and Docker demo files.
-Application **source** stays in the private developer repository.
-Runnable app binaries are published as **Gitea Releases** (`myoffice-publish.tar.gz`).
+repo_raw_base="${gitea_url}/${owner}/${repo}/raw/branch/${branch}"
+readme_template="$script_dir/README.public.md"
+if [[ ! -f "$readme_template" ]]; then
+	echo "Missing $readme_template" >&2
+	exit 1
+fi
+sed \
+	-e "s|__GITEA_URL__|${gitea_url}|g" \
+	-e "s|__GITEA_OWNER__|${owner}|g" \
+	-e "s|__GITEA_REPO__|${repo}|g" \
+	-e "s|__GITEA_BRANCH__|${branch}|g" \
+	-e "s|__REPO_RAW_BASE__|${repo_raw_base}|g" \
+	"$readme_template" >"$work_dir/README.md"
+echo "Wrote public README.md"
 
-See [proxmox/README.md](proxmox/README.md).
-
-EOF
+# Drop private-only docs that confuse public consumers (optional keep docs/)
+# Keep docs/ — useful for auth notes.
 
 git -C "$work_dir" add -A
 if [[ -z "$(git -C "$work_dir" status --porcelain)" ]]; then
 	echo "No changes to commit."
 else
 	git -C "$work_dir" -c user.email='myoffice-sync@local' -c user.name='myoffice-sync' \
-		commit -m "sync public allowlist from private myoffice"
-	echo "Committed allowlist snapshot."
+		commit -m "sync full source from private myoffice"
+	echo "Committed public snapshot."
 fi
 
 if [[ "$do_push" == true ]]; then
@@ -178,6 +178,6 @@ else
 fi
 
 echo ""
-echo "Raw base for CT install:"
-echo "  $gitea_url/$owner/$repo/raw/branch/$branch"
+echo "Proxmox one-liner:"
+echo "  bash -c \"\$(curl -fsSL ${repo_raw_base}/proxmox/myoffice.sh)\""
 echo ""