chore(public): sanitize repository presentation

2026-06-03 08:02:15 +03:00
parent dd3163624b
commit 9fc218dc49
107 changed files with 829 additions and 139257 deletions
@@ -12,7 +12,7 @@ runbook.
 Текущий resume snapshot проекта хранится в
 `.ai/runtime/detmir-current-session.md`. Перед продолжением миграции после
 перерыва или context reset сначала читать его, затем `RUNBOOK.md` и
-`/home/igor/.codex/skills/detmir-rust-migration/references/current-state.md`.
+`<OPERATOR_CODEX_HOME>/skills/detmir-rust-migration/references/current-state.md`.

 ## 1. Целевое состояние

@@ -703,7 +703,7 @@ systemctl is-active tsj-guardian-bot tsj-guardian-watchdog gost-tg
    binary `stat`/`copy`, чтобы `CARGO_TARGET_DIR` работал одинаково для
    Proxmox/Telegram и AW-server deploy. Добавлен
    `scripts/check_detmir_rust_release_artifacts.sh`; проверено
-    `CARGO_TARGET_DIR=/home/igor/.cache/detmir-adk-rust-target cargo build
+    `CARGO_TARGET_DIR=<OPERATOR_HOME>/.cache/detmir-adk-rust-target cargo build
    --release --workspace`, artifact check OK, `deploy_aw_server.yml
    --syntax-check` OK.
 20. `[done]` Прогнать production AW-server deploy contract и закрыть найденные
@@ -938,7 +938,7 @@ systemctl is-active tsj-guardian-bot tsj-guardian-watchdog gost-tg
      перезапускались в рамках этого шага;
    - artifact check расширен `aw-prune-local-state`.
 32. `[done]` Устранить нехватку места на AW server через Proxmox resize:
-    - CT `203` (`aw-server`, `10.10.10.13`) rootfs расширен через Proxmox
+    - CT `203` (`aw-server`, `<AW_SERVER_HOST>`) rootfs расширен через Proxmox
      `pct resize 203 rootfs +20G`;
    - перед resize сохранен config backup:
      `/var/lib/detmir-ai/switch-backups/ct203-aw-server.before-rootfs-resize-20260602T054826Z.conf`;
@@ -1076,7 +1076,7 @@ systemctl is-active tsj-guardian-bot tsj-guardian-watchdog gost-tg
      чтобы full deploy не затирал рабочие Influx credentials пустыми
      значениями;
    - полный `ansible-playbook -i inventory.ini deploy_aw_server.yml
-      -e aw_rust_release_dir=/home/igor/.cache/detmir-adk-rust-target/release`
+      -e aw_rust_release_dir=<OPERATOR_HOME>/.cache/detmir-adk-rust-target/release`
      прошел до конца: `failed=0`, `ok=282`;
    - final gates после deploy зеленые: `aw-db-health` OK,
      `aw-health-check` OK, `dlp-health-check` `22/0/0`,
@@ -1308,7 +1308,7 @@ systemctl is-active tsj-guardian-bot tsj-guardian-watchdog gost-tg
      `dlp_counts={ok:22,warn:0,fail:0}` and `ok_for_operator=true`.
 46. `[done]` Перенести Proxmox DetMir contour smoke на Rust-first helper:
    - добавлен crate `aw-contour-smoke`;
-    - `scripts/aw-contour-smoke-10.10.10.2.sh` теперь Rust-first wrapper:
+    - `scripts/aw-contour-smoke-<GATEWAY_HOST>.sh` теперь Rust-first wrapper:
      ищет `AW_CONTOUR_SMOKE_RUST`,
      `$CARGO_TARGET_DIR/release/aw-contour-smoke`,
      `adk-rust/target/release/aw-contour-smoke`,
@@ -1545,7 +1545,7 @@ systemctl is-active tsj-guardian-bot tsj-guardian-watchdog gost-tg
      `/usr/local/bin/detmir-portal`, `detmir-portal.service`,
      bind `127.0.0.1:8720`;
    - внешний route добавлен в существующий nginx gateway:
-      `https://dm.iri1968.dpdns.org/portal/`;
+      `https://<PUBLIC_GATEWAY_FQDN>/portal/`;
    - UI содержит вкладки `Оператор`, `Руководитель`, `Владелец`,
      `Инциденты ИБ`;
    - API реализованы: `/api/health`, `/api/summary`, `/api/operator`,
@@ -1614,7 +1614,7 @@ systemctl is-active tsj-guardian-bot tsj-guardian-watchdog gost-tg
      AW-server evidence-only service, `/usr/local/bin/detmir-portal-evidence`
      with `detmir-portal-evidence.service`, because the DLP warehouse lives on
      the AW server. Proxmox nginx gateway routes
-      `/portal/api/dlp/evidence*` to `10.10.10.13:8721`. Current production
+      `/portal/api/dlp/evidence*` to `<AW_SERVER_HOST>:8721`. Current production
      verification: AW evidence API `ok=true`, gateway evidence route
      `ok=true`, `db_available=true`, 11 DLP evidence rows returned,
      `screenshot_available=0` because current stored rows do not yet contain
@@ -1,12 +1,10 @@
 use std::ffi::{OsStr, OsString};
-use std::path::{Path, PathBuf};
+use std::path::PathBuf;
 use std::process::Command;

 use anyhow::{Context, Result, bail};
 use clap::Parser;

-const PLAYWRIGHT_NODE_MODULES: &str = "/home/igor/.agents/skills/playwright/node_modules";
-
 #[derive(Debug, Parser)]
 #[command(
    about = "Rust launcher for the ActivityWatch-Russian browser smoke test",
@@ -73,7 +71,14 @@ fn default_node_path(current: Option<&OsStr>) -> Option<OsString> {
    if current.is_some_and(|value| !value.is_empty()) {
        return None;
    }
-    let path = Path::new(PLAYWRIGHT_NODE_MODULES);
+    let Some(home) = std::env::var_os("HOME") else {
+        return None;
+    };
+    let path = PathBuf::from(home)
+        .join(".agents")
+        .join("skills")
+        .join("playwright")
+        .join("node_modules");
    if path.is_dir() {
        Some(path.as_os_str().to_os_string())
    } else {
@@ -16,7 +16,7 @@ const DEFAULT_AW_API: &str = "http://10.10.10.13:5600/api/0";
 const DEFAULT_WORKTIME_URL: &str = "http://10.10.10.13:5610";
 const DEFAULT_ONE_C_URL: &str = "http://10.10.10.2:8710";
 const DEFAULT_HOSTNAME: &str = "SHARKON2025";
-const DEFAULT_GATEWAY_HOST: &str = "dm.iri1968.dpdns.org";
+const DEFAULT_GATEWAY_HOST: &str = "detmir.example.local";

 #[derive(Debug, Parser)]
 #[command(about = "Autonomous read-only DetMir contour check from Proxmox.")]
@@ -108,7 +108,7 @@ fn run() -> Result<i32> {
        .root
        .canonicalize()
        .with_context(|| format!("canonicalize root {}", cli.root.display()))?;
-    let env_file = root.join("secrets/runtime.env");
+    let env_file = root.join("private-config/runtime.env");
    let env_values = read_env_file(&env_file).unwrap_or_default();
    let timestamp = cli
        .timestamp
@@ -452,7 +452,7 @@ mod tests {
        env.insert("AW_WINRM_PASSWORD".to_string(), "hidden".to_string());
        let plan = build_plan(
            dir.path(),
-            &dir.path().join("secrets/runtime.env"),
+            &dir.path().join("private-config/runtime.env"),
            &env,
            "10.10.10.13",
            "igor",
@@ -101,7 +101,7 @@ fn run() -> Result<i32> {
        .timestamp
        .clone()
        .unwrap_or_else(|| Local::now().format("%Y%m%d-%H%M%S").to_string());
-    let env_file = root.join("secrets/runtime.env");
+    let env_file = root.join("private-config/runtime.env");
    let env_values = read_env_file(&env_file).unwrap_or_default();
    let inventory = absolute_path(&root, &cli.inventory);
    let log_dir = root.join(".rollout-logs").join(&timestamp);
@@ -609,7 +609,7 @@ mod tests {
        env.insert("AW_WINRM_PASSWORD".to_string(), "hidden".to_string());
        let plan = build_plan(
            dir.path(),
-            &dir.path().join("secrets/runtime.env"),
+            &dir.path().join("private-config/runtime.env"),
            &env,
            &dir.path().join("ansible/inventory.ini"),
            &dir.path().join(".rollout-logs/test"),
@@ -645,7 +645,7 @@ mod tests {
        create_file(dir.path().join("ansible/post_validate_aw_windows.yml"));
        let plan = build_plan(
            dir.path(),
-            &dir.path().join("secrets/runtime.env"),
+            &dir.path().join("private-config/runtime.env"),
            &HashMap::new(),
            &dir.path().join("ansible/inventory.ini"),
            &dir.path().join(".rollout-logs/test"),
@@ -10,8 +10,6 @@ use sha2::{Digest, Sha256};
 use zip::write::SimpleFileOptions;

 const KIT_DIR: &str = "install-kit-awindows-20260427-211240";
-const SERVER_CONFIG_DIR: &str = "server-configs-192.168.100.18";
-const OLD_SERVER_CONFIG_DIR: &str = "server-configs-192.168.100.21";
 const README: &str = r#"ActivityWatch DetMir Windows Install Kit

 Includes:
@@ -19,10 +17,13 @@ Includes:
 - ansible/* (Windows and AW server playbooks, examples, inventory, tasks)
 - aw-server/* (server installer, health orchestrator, RU patch loader, host groups, default settings)
 - scripts/* (install-kit rebuild/validation, quality gates, browser/web smoke checks)
- server-configs-192.168.100.18/* (working Windows/RDP config snapshots)

 Source:
 - Local project snapshot at build time.
+
+Customer-specific deployment configs, inventories, passwords, tokens, domains,
+IP addresses and runtime snapshots are intentionally excluded from this public
+install-kit.
 "#;

 const ANSIBLE_FILES: &[&str] = &[
@@ -124,7 +125,6 @@ fn run() -> Result<()> {

 fn rebuild(root: &Path) -> Result<()> {
    let kit = root.join(KIT_DIR);
-    let preserved_configs = preserve_server_configs(&kit)?;
    for name in ["ansible", "aw-server", "windows", "scripts"] {
        remove_if_exists(&kit.join(name))?;
    }
@@ -139,16 +139,6 @@ fn rebuild(root: &Path) -> Result<()> {
        copy_file(root, &kit, rel)?;
    }

-    let server_config_dir = kit.join(SERVER_CONFIG_DIR);
-    fs::create_dir_all(&server_config_dir)
-        .with_context(|| format!("create {}", server_config_dir.display()))?;
-    for (name, bytes) in preserved_configs {
-        let path = server_config_dir.join(name);
-        write_file_replace(&path, &bytes).with_context(|| {
-            format!("restore server config into {}", server_config_dir.display())
-        })?;
-    }
-
    write_file_replace(&kit.join("README-INSTALL-KIT.txt"), README.as_bytes())
        .with_context(|| format!("write {}", kit.join("README-INSTALL-KIT.txt").display()))?;
    write_manifest(root, &kit)?;
@@ -157,32 +147,6 @@ fn rebuild(root: &Path) -> Result<()> {
    Ok(())
 }

-fn preserve_server_configs(kit: &Path) -> Result<Vec<(String, Vec<u8>)>> {
-    let mut out = std::collections::BTreeMap::new();
-    for dir in [OLD_SERVER_CONFIG_DIR, SERVER_CONFIG_DIR] {
-        let path = kit.join(dir);
-        if !path.is_dir() {
-            continue;
-        }
-        for entry in fs::read_dir(&path).with_context(|| format!("read dir {}", path.display()))? {
-            let entry = entry.with_context(|| format!("read dir entry {}", path.display()))?;
-            let entry_path = entry.path();
-            if entry_path
-                .file_name()
-                .and_then(|name| name.to_str())
-                .is_some_and(|name| name.ends_with(".deployment-config.json"))
-                && entry_path.is_file()
-            {
-                let name = entry.file_name().to_string_lossy().to_string();
-                let bytes = fs::read(&entry_path)
-                    .with_context(|| format!("read {}", entry_path.display()))?;
-                out.insert(name, bytes);
-            }
-        }
-    }
-    Ok(out.into_iter().collect())
-}
-
 fn remove_server_config_dirs(kit: &Path) -> Result<()> {
    if !kit.is_dir() {
        return Ok(());
@@ -343,23 +307,7 @@ mod tests {

    use tempfile::tempdir;

-    use super::{preserve_server_configs, remove_server_config_dirs};
-
-    #[test]
-    fn preserves_new_server_configs_over_old_duplicates() {
-        let tmp = tempdir().unwrap();
-        let kit = tmp.path();
-        let old = kit.join("server-configs-192.168.100.21");
-        let new = kit.join("server-configs-192.168.100.18");
-        fs::create_dir_all(&old).unwrap();
-        fs::create_dir_all(&new).unwrap();
-        fs::write(old.join("a.deployment-config.json"), "old").unwrap();
-        fs::write(new.join("a.deployment-config.json"), "new").unwrap();
-        let configs = preserve_server_configs(kit).unwrap();
-        assert_eq!(configs.len(), 1);
-        assert_eq!(configs[0].0, "a.deployment-config.json");
-        assert_eq!(configs[0].1, b"new");
-    }
+    use super::remove_server_config_dirs;

    #[test]
    fn removes_server_config_dirs_only() {
@@ -11,7 +11,7 @@ use serde::Serialize;
 const DEFAULT_HEARTBEAT_FILE: &str = "/opt/infra-admin/.state/tsj_guardian_heartbeat";
 const DEFAULT_SERVICE_NAME: &str = "tsj-guardian-bot.service";
 const DEFAULT_GOST_SERVICE_NAME: &str = "gost-tg.service";
-const DEFAULT_GOST_PATTERN: &str = "/usr/local/bin/gost -L http+socks5://127.0.0.1:11090 -F socks5+wss://gw.iri1968.dpdns.org:4443";
+const DEFAULT_GOST_PATTERN: &str = "/usr/local/bin/gost -L http+socks5://127.0.0.1:11090 -F socks5+wss://gw.example.local:4443";

 #[derive(Debug, Parser)]
 #[command(about = "TSJ Guardian bot heartbeat watchdog and gost duplicate guard.")]