sync public allowlist from private myoffice

2026-08-05 10:36:17 +00:00
parent 6f7fd61ee9
commit 874796c860
720 changed files with 2841 additions and 69563 deletions
@@ -0,0 +1,136 @@
+# MyOffice on Proxmox (Gitea releases)
+
+Three-tier setup on **your Gitea**:
+
+| Tier | Repo | Visibility | Contents |
+|------|------|------------|----------|
+| 1. Dev | `myoffice` | Private | Full source |
+| 2. Public code | `myoffice-public` | Public | Allowlisted scripts (`proxmox/`, `Docker/`, README) |
+| 3. Published app | Releases on `myoffice-public` | Public | `myoffice-publish.tar.gz` |
+
+CT install downloads the release tarball (not source). No Docker/nginx/SDK/Node inside the CT — proxy with your existing nginx LXC to Kestrel `:9100`.
+
+```text
+[private myoffice] --sync-public--> [myoffice-public raw scripts]
+[private myoffice] --publish+release--> [Gitea Release .tar.gz]
+                                              |
+[User Proxmox] curl myoffice.sh ----------> [LXC: Postgres + ASP.NET + app]
+                                              ^
+[User nginx] proxy_pass http://ct-ip:9100 ----+
+```
+
+## End user: create CT
+
+```bash
+export GITEA_URL="https://gitea.example.com"
+export GITEA_OWNER="org"
+export GITEA_REPO="myoffice-public"          # optional, default
+export RELEASE_TAG="latest"                  # or v1.2.3
+export REPO_RAW_BASE="${GITEA_URL}/${GITEA_OWNER}/${GITEA_REPO}/raw/branch/main"
+
+bash -c "$(curl -fsSL ${REPO_RAW_BASE}/proxmox/myoffice.sh)"
+```
+
+Or copy `proxmox/` to the host and run `bash myoffice.sh` with the same env vars.
+
+Whiptail: Default / Advanced (Public URL, release tag) → creates CT → installs Postgres + ASP.NET runtime → downloads release → configures FrontEnd/CORS + local Postgres → systemd.
+
+## Maintainer: publish a release
+
+On the private repo (build PC):
+
+```powershell
+$env:GITEA_TOKEN = '<token with write:repository on myoffice-public>'
+
+.\proxmox\publish.ps1 -Tar
+.\proxmox\release.ps1 -GiteaUrl https://gitea.example.com -Owner org -Repo myoffice-public -Tag v1.2.3
+.\proxmox\sync-public.ps1 -GiteaUrl https://gitea.example.com -Owner org -Repo myoffice-public -Push
+```
+
+- `proxmox/publish.ps1` → `_Published/` + `myoffice-publish.tar.gz`
+- `proxmox/release.ps1` → Gitea Release asset
+- `proxmox/sync-public.ps1` → push allowlisted files to public repo (scripts users curl)
+
+Or via Gitea Actions on the private repo (`.gitea/workflows/publish.yml`): push `master` → tag `latest`, or push tag `v*` / manual dispatch.
+
+Lab-only SSH deploy (no Gitea): `.\proxmox\deploy.ps1 -TargetHost <ct-ip>`
+
+## What runs inside the CT
+
+| Service | How | Port |
+|---------|-----|------|
+| PostgreSQL | apt + systemd | `127.0.0.1:5432` |
+| MyOffice API + SPA | `dotnet` via `myoffice-api.service` | **9100** |
+
+```text
+/opt/myoffice/api       # extracted release (API + wwwroot)
+/opt/myoffice/proxmox   # install/update helpers + env
+```
+
+Config chain:
+
+- **Front → API:** same-origin SPA (`environment.proxmox.ts`)
+- **API → Postgres:** CT `appsettings.shared.Production.json`
+- **Browser → app:** nginx → `http://<ct-ip>:9100`
+
+## Proxy (your nginx LXC)
+
+```nginx
+location / {
+    proxy_pass http://<myoffice-ct-ip>:9100;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+}
+```
+
+In Advanced install, set **Public URL** to the browser URL so CORS / `FrontEnd:Host` match.
+
+## Update later
+
+```bash
+pct enter <CTID>
+/opt/myoffice/proxmox/update.sh          # re-download RELEASE_TAG + restart
+/opt/myoffice/proxmox/update.sh logs
+/opt/myoffice/proxmox/update.sh status
+```
+
+Release settings are stored in `/opt/myoffice/proxmox/env`.
+
+## Gitea ops checklist
+
+- Create private `myoffice` and public `myoffice-public`
+- Raise release attachment size limit if needed
+- Token for maintainers: `write:repository` on public repo
+- TLS (or trust custom CA) so Proxmox/`curl` can download
+- Private repo secret `PUBLIC_TOKEN` for Actions (`.gitea/workflows/publish.yml`)
+
+## Gitea runner caching
+
+Three layers (independent):
+
+| Layer | What | How |
+|-------|------|-----|
+| Toolcache | .NET SDK / Node binaries | `setup-dotnet` / `setup-node` write to `/opt/hostedtoolcache`. Persist it on the **act_runner** host so the next job reuses downloads (steps still run, but skip re-download — you already saw `Found in cache @ /opt/hostedtoolcache/...`). |
+| Actions cache | NuGet + npm packages | Workflow uses `actions/cache@v4` for `~/.nuget/packages` and `~/.npm`. Needs the runner cache server (default on act_runner). |
+| Skip setup | No setup steps at all | Bake SDK + Node into the job Docker image (or host runner), then set job env `SKIP_SETUP_DOTNET=true` and `SKIP_SETUP_NODE=true`. |
+
+Example act_runner volume (compose):
+
+```yaml
+volumes:
+  - /var/run/docker.sock:/var/run/docker.sock
+  - act-toolcache:/opt/hostedtoolcache   # persist SDK/Node between jobs
+```
+
+If jobs use ephemeral containers without that volume, SDKs download every run.
+
+- Debian 12 LXC, unprivileged, `--onboot 1`
+- 2 vCPU / 4096 MiB / 20G / `vmbr0` / DHCP
+- Listen `:9100`
+
+## Demo logins
+
+- App: `user_UAH@user_UAH.userUAH` / `user_UAH` (also USD, EUR)
+- Postgres: user/db/password `myoffice`