sunfish-admin
12d2179c20
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
133 lines
3.6 KiB
Markdown
133 lines
3.6 KiB
Markdown
# Quickstart / validation: 001-development-environment
|
|
|
|
Use after `/speckit-implement` on a real `rom-dev01`. Until the VM exists, treat
|
|
this as the acceptance script shape.
|
|
|
|
## Prerequisites
|
|
|
|
- Host: `a15.ssystems.de` (`49.13.104.83`), SSH port **37037**, guest name `rom-dev01`
|
|
- Laptop key: `~/.ssh/id_ed25519_rom_dev01` + Host aliases in
|
|
`misc/config.d/a15-rom-dev01` (see `docs/001-host-runbook.md`)
|
|
- Laptop has `rsync`, `ssh`, Cursor Remote SSH, `adb`/`fastboot`
|
|
|
|
## P1 validation path
|
|
|
|
### 1. Preflight captured
|
|
|
|
```bash
|
|
ssh rom-dev01-root 'less /srv/rom/logs/preflight/preflight-latest.txt'
|
|
```
|
|
|
|
### 2. Build user workspace
|
|
|
|
```bash
|
|
ssh rom-dev01 'whoami; hostname; test -f ~/sunfish-a16-rom/specs/001-development-environment/spec.md && echo SPEC_OK'
|
|
```
|
|
|
|
### 3. Toolchain smoke (clean shell)
|
|
|
|
```bash
|
|
ssh rom-dev01 'bash -l -c "git --version; git lfs version; repo --version; python3 --version; ccache -s"'
|
|
```
|
|
|
|
Expected: all commands succeed without sudo. See `/srv/rom/logs/toolchain-smoke.txt`.
|
|
|
|
### 4. Layout
|
|
|
|
```bash
|
|
namei -l /srv/rom /srv/rom/artifacts /srv/rom/ccache
|
|
touch /srv/rom/artifacts/.write_test && rm /srv/rom/artifacts/.write_test
|
|
```
|
|
|
|
### 5. Meta repo present on host (pre-Gitea OK)
|
|
|
|
```bash
|
|
test -d /home/android-build/sunfish-a16-rom/.git
|
|
test -f /home/android-build/sunfish-a16-rom/specs/001-development-environment/spec.md
|
|
```
|
|
|
|
### 6. Cursor Remote SSH
|
|
|
|
From laptop: open host workspace; edit a trivial file; confirm it is on the VM
|
|
disk (not only local).
|
|
|
|
### 7. Artifact rsync smoke
|
|
|
|
On host:
|
|
|
|
```bash
|
|
echo '001-smoke' > /srv/rom/artifacts/dummy-001.txt
|
|
sha256sum /srv/rom/artifacts/dummy-001.txt
|
|
```
|
|
|
|
On laptop:
|
|
|
|
```bash
|
|
rsync -avz USER@ROM_DEV01:/srv/rom/artifacts/dummy-001.txt ./
|
|
sha256sum ./dummy-001.txt # must match
|
|
```
|
|
|
|
## P2 validation path
|
|
|
|
### 8. Gitea private access
|
|
|
|
```bash
|
|
ssh -L 3000:127.0.0.1:3000 rom-dev01-root
|
|
# browser: http://127.0.0.1:3000/ (user sunfish-admin; password in host /srv/rom/secrets/)
|
|
```
|
|
|
|
Gitea binds **only** `127.0.0.1:3000`. Git over HTTP to that URL (no public `:2222`).
|
|
|
|
### 9. Four repos
|
|
|
|
In Gitea: `sunfish-a16-rom`, `sunfish-rom-manifest`, `sunfish-rom-build`,
|
|
`sunfish-rom-patches` (under `sunfish-admin/`).
|
|
|
|
### 10. Ansible CLI smoke
|
|
|
|
```bash
|
|
ssh rom-dev01 'cd ~/sunfish-rom-build && ansible-playbook -i ansible/inventory.ini ansible/smoke.yml'
|
|
```
|
|
|
|
### 11. Semaphore smoke (unprivileged)
|
|
|
|
```bash
|
|
ssh -L 3001:127.0.0.1:3001 rom-dev01-root
|
|
# http://127.0.0.1:3001/ project sunfish-rom / template env-smoke
|
|
```
|
|
|
|
Semaphore clones canonical `sunfish-rom-build` from Gitea and runs the smoke
|
|
playbook without sudo. Evidence: `/srv/rom/logs/semaphore-smoke.txt`.
|
|
|
|
### 12. Off-VM mirrors
|
|
|
|
Laptop path: `/home/aventura/Archives/sunfish-rom-mirrors/*.git` (rsync from
|
|
`/srv/rom/artifacts/gitea-mirrors/` on host).
|
|
|
|
```bash
|
|
# refresh mirrors (host builds mirrors; laptop pulls via rsync — no token on laptop)
|
|
rsync -a android-build@a15.ssystems.de:/srv/rom/artifacts/gitea-mirrors/ \
|
|
~/Archives/sunfish-rom-mirrors/
|
|
git -C ~/Archives/sunfish-rom-mirrors/sunfish-a16-rom.git fsck
|
|
```
|
|
|
|
### 13. Restart survival
|
|
|
|
```bash
|
|
ssh rom-dev01-root 'systemctl restart gitea semaphore; curl -fsS -o /dev/null http://127.0.0.1:3000/; curl -fsS -o /dev/null http://127.0.0.1:3001/'
|
|
```
|
|
|
|
Evidence: `/srv/rom/logs/restart-smoke.txt`.
|
|
|
|
### 14. Isolation checklist
|
|
|
|
- No required internal NIC for workflow
|
|
- Gitea/Semaphore binds only `127.0.0.1`
|
|
- SSH still works after service restarts
|
|
- Day-to-day docs do not require company VPN/internal DNS/LDAP/GitLab
|
|
|
|
## Done means
|
|
|
|
`001` complete → start **`002`** (AXP capture).
|
|
Do **not** start Lineage `repo sync` / build as part of `001` success.
|