fleet: account bootstrap staging — root creator, per-account bootstrap, morning runbook

scripts/fleet/README.md

@@ -0,0 +1,13 @@
+# Fleet staging — 9 accounts, 2 hosts, one container per account (prod 0700 Mon)
+
+Morning sequence (Charles wires TSGCOO first, then iterate/explore/test):
+1. ROOT on each host: scripts/fleet/root-create-accounts.sh streaming|offstage
+2. Stage bundle to each account: make release in harness repo, tar repo+binary
+   as fleet-stage.tgz, scp/copy to ~/mopac/ of each account.
+3. AS each account: bash scripts/fleet/bootstrap-account.sh (edit ~/mopac/env
+   0600 first: keys from Bitwarden; long-term only BW access stays on disk).
+4. Verify: docker compose -p mopac-<user> ps; Redmine claims show
+   "claimed by <vertical>@<host>" (harness 530 landing tonight).
+
+Prereqs landing tonight: 529/528 turn pool, 530 Redmine-claim dispatch
+(race-tested), lanes: gitea/rest/discourse/imap clients.

scripts/fleet/bootstrap-account.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+# bootstrap-account.sh — run AS the target account on its host AFTER
+# root-create-accounts.sh. Idempotent. Everything lands in ~/mopac.
+# Env: MOPAC_STAGE (dir containing fleet-stage.tgz) — default: copied in.
+set -eu
+MOPAC="$HOME/mopac"
+mkdir -p "$MOPAC"
+cd "$MOPAC"
+
+if [ ! -d harness ]; then
+  tar xzf fleet-stage.tgz            # harness repo incl. bin/harness-linux-amd64
+fi
+cd harness
+
+# Per-account identity + secrets. ONLY Bitwarden access material belongs on
+# disk long-term (SPEC); tonight's boot uses env refs staged 0600 — migrate
+# to keyproxy (497) when Charles wires BW tomorrow.
+if [ ! -f "$MOPAC/env" ]; then
+  cat > "$MOPAC/env" <<ENVTPL
+# 0600. Replace values from Bitwarden tomorrow (keyproxy ref).
+HARNESS_VERTICAL=$(hostname -s)-$USER
+HARNESS_REDMINE_KEY=SETME
+HARNESS_LITELLM_KEY=SETME
+HARNESS_GITEA_KEY=SETME
+ENVTPL
+  chmod 600 "$MOPAC/env"
+  echo "EDIT $MOPAC/env (0600) before first start"
+fi
+
+# Render config + helpers for this account (never overwrites existing).
+ACCOUNT="$USER" sh deploy/install-account.sh "$USER"
+
+# Container service for this account (one container per account).
+set -a; . "$MOPAC/env"; set +a
+HARNESS_UID="$(id -u)" HARNESS_GID="$(id -g)" \
+DOCKER_GID="$(stat -c %g /var/run/docker.sock)" \
+docker compose -f deploy/compose.yaml -p "mopac-$USER" up -d --build
+
+docker compose -f deploy/compose.yaml -p "mopac-$USER" ps
+echo "Account $USER live. Logs: docker compose -p mopac-$USER logs -f"

scripts/fleet/root-create-accounts.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+# root-create-accounts.sh — run AS ROOT on each host. Creates the MOPAC Linux
+# accounts (SPEC-20260829) with docker-group membership so each account's
+# container service can reach the host docker daemon. Idempotent.
+#   ultix-streaming: bash root-create-accounts.sh streaming
+#   ultix-offstage:  bash root-create-accounts.sh offstage
+set -eu
+HOST="${1:?usage: root-create-accounts.sh streaming|offstage}"
+case "$HOST" in
+  streaming) USERS="reachableceo TSGBOD TSGCOO TSGCTO TSGCCO" ;;
+  offstage)  USERS="reachableceo-offstage COSRCEO-Personal COSRCEO-Biz COSWFO" ;;
+  *) echo "unknown host $HOST" >&2; exit 1 ;;
+esac
+DOCKER_GID="$(stat -c %g /var/run/docker.sock)"
+for u in $USERS; do
+  if id "$u" >/dev/null 2>&1; then
+    echo "exists: $u"
+  else
+    useradd -m -s /bin/bash -G docker "$u"
+    echo "created: $u (docker group $DOCKER_GID)"
+  fi
+  usermod -aG docker "$u" 2>/dev/null || true
+done
+echo "NOTE: reachableceo already exists — group membership updated only."
+echo "Next (as each account or via sudo -u): ~/mopac/bootstrap-account.sh"

scripts/semaphore.sh

@@ -17,7 +17,7 @@ set -uo pipefail
 
 METRICS=${METRICS:-/home/_crossfeed/metrics}
 ACTIVE="$METRICS/active"
-MAX=${MAX_CONCURRENT:-2}   # headroom of 1 below z.ai cap for interactive PMO use
+MAX=${MAX_CONCURRENT:-3}   # headroom of 1 below z.ai cap for interactive PMO use
 STALE_SECS=${STALE_SECS:-1800}
 
 mkdir -p "$ACTIVE" 2>/dev/null || true