Open Terminal fleet for all accounts + OpenWebUI UAT pass (#610)

open-terminal 0.11.34 bare-metal (human-authorized host install) with a
systemd template unit: reachableceo on tailscale-only :30000 (cwd
~/projects) and all 8 other accounts on :30001-30008, each with its own
key kept out of ps in per-user TOMLs, all users added to the docker group.
Keys live in ~/.creds + /etc/ukrrs/open-terminal, never in this repo.

UAT: throwaway OpenWebUI v0.11.1 (matched to the human's Cloudron prod)
driven purely over its HTTP API against the beta gateway lane - connection
verify/config PASS, direct exec as uid 1001 PASS, and the chat round trip
PASS: the model emitted run_command, we executed it through OpenWebUI's
terminal proxy (server holds the key), and the final answer named 9/9 real
project directories; earlier negative runs prove the test catches
hallucinated output. Ops note OPEN-TERMINAL.md documents production wiring
(prod openwebui container v0.3.10 is too old and needs an upgrade first).

Also tonight: agent-stack relaunchers removed (6-, backups kept) so no
screen/crush sessions auto-start on reboot; 22:00 night-profile flip
observed live; docs synced for the earlier teardown.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
[#610]

7-open-terminal-install.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# 7-open-terminal-install.sh — OpenWebUI Open Terminal for reachableceo (#610).
+# Bare-metal (human-authorized one-case host install, ruling 2026-08-31):
+#   - binary via uv tool install (pinned open-terminal==0.11.34, managed py3.12)
+#     → /usr/local/bin/open-terminal, venvs under /opt/uv-tools
+#   - per-user TOML config keeps the API key OUT of ps/cmdline (docs' advice)
+#   - binds TAILSCALE ONLY (100.101.187.119, human ruling 2026-08-31 night):
+#     reachable from openwebui containers + tailscale clients, never the LAN
+#   - systemd template unit open-terminal@.service → instance per account
+#   - this script creates the reachableceo instance: port 30000, cwd ~/projects
+#   - key copy for the human lands in ~/.creds/open-terminal.env (0600)
+# Self-elevating. Run:  ~/projects/ultix/7-open-terminal-install.sh
+set -euo pipefail
+[ "$EUID" -eq 0 ] || exec sudo bash "$0"
+
+OUT=/home/reachableceo/projects/ultix/7-open-terminal-install.out
+exec > >(tee "$OUT") 2>&1
+echo "== open-terminal install $(date -Is) =="
+
+UV=/home/reachableceo/.local/bin/uv
+VER=0.11.34
+UV_TOOL_DIR=/opt/uv-tools UV_TOOL_BIN_DIR=/usr/local/bin \
+  UV_PYTHON_INSTALL_DIR=/opt/uv-python \
+  $UV tool install --python 3.12 "open-terminal==$VER" \
+  || UV_TOOL_DIR=/opt/uv-tools UV_TOOL_BIN_DIR=/usr/local/bin \
+     UV_PYTHON_INSTALL_DIR=/opt/uv-python $UV tool install --reinstall --python 3.12 "open-terminal==$VER"
+chmod -R a+rX /opt/uv-tools /opt/uv-python
+/usr/local/bin/open-terminal --help >/dev/null && echo "open-terminal $VER ok"
+
+mkdir -p /etc/ukrrs/open-terminal /etc/systemd/system
+
+KEY=$(openssl rand -hex 32)
+cat > /etc/ukrrs/open-terminal/reachableceo.toml <<EOF
+host = "100.101.187.119"
+port = 30000
+api_key = "$KEY"
+EOF
+chown root:reachableceo /etc/ukrrs/open-terminal/reachableceo.toml
+chmod 640 /etc/ukrrs/open-terminal/reachableceo.toml
+
+cat > /etc/systemd/system/open-terminal@.service <<'EOF'
+[Unit]
+Description=Open Terminal (%i)
+Documentation=https://docs.openwebui.com/features/open-terminal/
+After=network-online.target tailscaled.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=%i
+EnvironmentFile=/etc/ukrrs/open-terminal/%i.env
+ExecStart=/usr/local/bin/open-terminal run --config /etc/ukrrs/open-terminal/%i.toml --cwd ${OPEN_TERMINAL_CWD}
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+printf 'OPEN_TERMINAL_CWD=/home/reachableceo/projects\n' \
+  > /etc/ukrrs/open-terminal/reachableceo.env
+chown root:reachableceo /etc/ukrrs/open-terminal/reachableceo.env
+chmod 640 /etc/ukrrs/open-terminal/reachableceo.env
+
+systemctl daemon-reload
+systemctl enable --now open-terminal@reachableceo
+
+CREDS=/home/reachableceo/.creds/open-terminal.env
+{
+  echo "# Open Terminal fleet — added 2026-08-31 (#610). 0600, never repo."
+  echo "REACHABLECEO_URL=http://100.101.187.119:30000"
+  echo "REACHABLECEO_API_KEY=$KEY"
+} > "$CREDS"
+chown reachableceo:reachableceo "$CREDS"
+chmod 600 "$CREDS"
+
+sleep 2
+for _ in 1 2 3 4 5 6 7 8; do
+  STATE=$(systemctl is-active open-terminal@reachableceo || true)
+  [ "$STATE" = active ] && break
+  sleep 2
+done
+echo "-- verify --"
+echo "unit: $STATE"
+curl -s -m 10 http://100.101.187.119:30000/health && echo
+echo "== done $(date -Is) =="