mrcharles
c810942239
open-terminal 0.11.34 bare-metal (human-authorized host install) with a systemd template unit: reachableceo on tailscale-only :30000 (cwd ~/projects) and all 8 other accounts on :30001-30008, each with its own key kept out of ps in per-user TOMLs, all users added to the docker group. Keys live in ~/.creds + /etc/ukrrs/open-terminal, never in this repo. UAT: throwaway OpenWebUI v0.11.1 (matched to the human's Cloudron prod) driven purely over its HTTP API against the beta gateway lane - connection verify/config PASS, direct exec as uid 1001 PASS, and the chat round trip PASS: the model emitted run_command, we executed it through OpenWebUI's terminal proxy (server holds the key), and the final answer named 9/9 real project directories; earlier negative runs prove the test catches hallucinated output. Ops note OPEN-TERMINAL.md documents production wiring (prod openwebui container v0.3.10 is too old and needs an upgrade first). Also tonight: agent-stack relaunchers removed (6-, backups kept) so no screen/crush sessions auto-start on reboot; 22:00 night-profile flip observed live; docs synced for the earlier teardown. 💘 Generated with Crush Assisted-by: Crush:glm-5.2 [#610]
69 lines
2.3 KiB
Bash
Executable File
69 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# 8-open-terminal-users.sh — per-user Open Terminal instances (#610).
|
|
# For each account: docker group membership (human ruling 2026-08-31) +
|
|
# own open-terminal instance on 30001+, own API key, TAILSCALE-ONLY bind
|
|
# (100.101.187.119, human ruling 2026-08-31 night), cwd ~/projects if it
|
|
# exists else $HOME. Wired for reboot via open-terminal@<user>.service.
|
|
# Ports: TSGCOO 30001 TSGCCO 30002 TSGCTO 30003 TSGBOD 30004
|
|
# COS-RCEO 30005 COS-WFO 30006 COS-TSG 30007 reachableceo-offstage 30008
|
|
# Keys append to ~/.creds/open-terminal.env (reachableceo, 0600).
|
|
# Run AFTER 7-open-terminal-install.sh. Self-elevating.
|
|
# ~/projects/ultix/8-open-terminal-users.sh
|
|
set -euo pipefail
|
|
[ "$EUID" -eq 0 ] || exec sudo bash "$0"
|
|
|
|
OUT=/home/reachableceo/projects/ultix/8-open-terminal-users.out
|
|
exec > >(tee "$OUT") 2>&1
|
|
echo "== open-terminal per-user install $(date -Is) =="
|
|
|
|
CREDS=/home/reachableceo/.creds/open-terminal.env
|
|
|
|
while read -r USER PORT; do
|
|
[ -z "$USER" ] && continue
|
|
if ! getent passwd "$USER" >/dev/null; then
|
|
echo "SKIP $USER (no such account)"
|
|
continue
|
|
fi
|
|
HOME_DIR=$(getent passwd "$USER" | cut -d: -f6)
|
|
if [ -d "$HOME_DIR/projects" ]; then CWD="$HOME_DIR/projects"; else CWD="$HOME_DIR"; fi
|
|
|
|
usermod -aG docker "$USER"
|
|
|
|
KEY=$(openssl rand -hex 32)
|
|
cat > "/etc/ukrrs/open-terminal/$USER.toml" <<EOF
|
|
host = "100.101.187.119"
|
|
port = $PORT
|
|
api_key = "$KEY"
|
|
EOF
|
|
chown "root:$USER" "/etc/ukrrs/open-terminal/$USER.toml"
|
|
chmod 640 "/etc/ukrrs/open-terminal/$USER.toml"
|
|
|
|
printf 'OPEN_TERMINAL_CWD=%s\n' "$CWD" > "/etc/ukrrs/open-terminal/$USER.env"
|
|
chown "root:$USER" "/etc/ukrrs/open-terminal/$USER.env"
|
|
chmod 640 "/etc/ukrrs/open-terminal/$USER.env"
|
|
|
|
systemctl enable --now "open-terminal@$USER"
|
|
|
|
URLVAR=$(echo "$USER" | tr '[:lower:]-' '[:upper:]_')
|
|
echo "${URLVAR}_URL=http://100.101.187.119:$PORT" >> "$CREDS"
|
|
echo "${URLVAR}_API_KEY=$KEY" >> "$CREDS"
|
|
|
|
sleep 1
|
|
STATE=$(systemctl is-active "open-terminal@$USER" || true)
|
|
HEALTH=$(curl -s -m 5 "http://100.101.187.119:$PORT/health" || echo unreachable)
|
|
printf '%-24s port %s cwd %s %s %s\n' "$USER" "$PORT" "$CWD" "$STATE" "$HEALTH"
|
|
done <<'LIST'
|
|
TSGCOO 30001
|
|
TSGCCO 30002
|
|
TSGCTO 30003
|
|
TSGBOD 30004
|
|
COS-RCEO 30005
|
|
COS-WFO 30006
|
|
COS-TSG 30007
|
|
reachableceo-offstage 30008
|
|
LIST
|
|
|
|
chown reachableceo:reachableceo "$CREDS"
|
|
chmod 600 "$CREDS"
|
|
echo "== done $(date -Is) =="
|