Post-reboot audit PASS + night window extended to 22:00-07:00 (#610)

Verified after the 22:53 multiqueue bounce: NIC queues live at 4/4 and 2/2 (the whole point of the reboot), PVE config clean with nothing pending, both gateway lanes healthy, all 9 Open Terminal ports bound on the tailscale IP, PSI metrics fresh, and no removed relaunchers respawned. Moved the day-profile flip from 05:00 to 07:00 per human ruling (live timer re-armed + staged copy and docs synced; the gateway z.ai peak ladder is untouched). Also staged a ready-to-run script that drops each account's own Open Terminal key into its ~/.creds as openwebui.creds - not run yet; the master key list stays at ~/.creds/open-terminal.env. 💘 Generated with Crush Assisted-by: Crush:glm-5.2 [#610]
2026-09-01 07:30:59 -05:00
parent c810942239
commit b08d354a51
10 changed files with 131 additions and 20 deletions
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# 10-distribute-openwebui-creds.sh — per-account openwebui.creds (#610).
+# For each of the 9 Open Terminal accounts: write THAT account's own
+# URL + API key into <home>/.creds/openwebui.creds (mkdir -p .creds),
+# 0600, owned by the account. Source of truth = the per-user TOML in
+# /etc/ukrrs/open-terminal/ (keys read from there, NEVER echoed here,
+# never on a command line, never in this repo or the .out log).
+#   ~/projects/ultix/10-distribute-openwebui-creds.sh
+set -euo pipefail
+[ "$EUID" -eq 0 ] || exec sudo bash "$0"
+
+OUT=/home/reachableceo/projects/ultix/10-distribute-openwebui-creds.out
+exec > >(tee "$OUT") 2>&1
+echo "== openwebui.creds distribution $(date -Is) =="
+
+TOML_DIR=/etc/ukrrs/open-terminal
+
+while read -r USER; do
+  [ -z "$USER" ] && continue
+  HOME_DIR=$(getent passwd "$USER" | cut -d: -f6)
+  TOML="$TOML_DIR/$USER.toml"
+  if [ ! -r "$TOML" ]; then
+    echo "SKIP $USER (no TOML at $TOML)"
+    continue
+  fi
+
+  PORT=$(sed -n 's/^port = //p' "$TOML" | tr -d ' ')
+  KEY=$(sed -n 's/^api_key = "\(.*\)"$/\1/p' "$TOML")
+
+  mkdir -p "$HOME_DIR/.creds"
+  chown "$USER:$USER" "$HOME_DIR/.creds"
+  chmod 700 "$HOME_DIR/.creds"
+
+  CREDS="$HOME_DIR/.creds/openwebui.creds"
+  cat > "$CREDS" <<EOF
+# OpenWebUI Open Terminal wiring for $USER (#610). 0600, never repo/chat.
+# Admin UI: Settings -> Admin -> Integrations -> Open Terminal -> "+"
+OPENWEBUI_TERMINAL_URL=http://100.101.187.119:$PORT
+OPENWEBUI_TERMINAL_API_KEY=$KEY
+OPENWEBUI_TERMINAL_AUTH=bearer
+EOF
+  chown "$USER:$USER" "$CREDS"
+  chmod 600 "$CREDS"
+
+  HEALTH=$(curl -s -m 5 "http://100.101.187.119:$PORT/health" || echo unreachable)
+  MODE=$(stat -c '%U:%G %a' "$CREDS")
+  printf '%-24s port %s  %s  %s  health: %s\n' "$USER" "$PORT" "$CREDS" "$MODE" "$HEALTH"
+done <<'LIST'
+reachableceo
+TSGCOO
+TSGCCO
+TSGCTO
+TSGBOD
+COS-RCEO
+COS-WFO
+COS-TSG
+reachableceo-offstage
+LIST
+
+chown reachableceo:reachableceo "$OUT" 2>/dev/null || true
+echo "== done $(date -Is) =="