Spaces:
Running
Running
Deploy Aureon OS (deploy/selfhost stack: nginx edge + fusion API x2 + console + HNC organ + redis + postgres; paper mode) (part 7)
c626614 verified | """Install the commissioning profile after complete authenticated restoration.""" | |
| import json, os, pathlib, pwd, shutil, subprocess, sys | |
| from cloud_organ import ENABLED, DEFERRED | |
| ROOT = pathlib.Path('/srv/aureon/runtime/workspace') | |
| VENV = pathlib.Path('/srv/aureon/venv') | |
| IMPORT = pathlib.Path('/srv/aureon/import') | |
| if os.geteuid() != 0 or not (ROOT/'aureon_fusion'/'queen_mind.py').exists(): | |
| raise RuntimeError('Run as root only after restoring the complete workspace') | |
| # Preserve imported process metadata. PIDs and dormant settings belong to the | |
| # original Windows host and cannot be applied to this new Linux host. | |
| registry_file = ROOT/'aureon_fusion'/'state'/'organ_registry.json' | |
| original = IMPORT/'original-organ-registry.json' | |
| if registry_file.exists() and not original.exists(): | |
| shutil.copy2(registry_file, original) | |
| if not (IMPORT/'services-installed.json').exists(): | |
| data={'organs': {name:{'pid':None,'dormant':False} for name in ENABLED}} | |
| data['organs'].update({name:{'pid':None,'dormant':True,'dormant_reason':reason} for name,reason in DEFERRED.items()}) | |
| registry_file.parent.mkdir(parents=True, exist_ok=True) | |
| registry_file.write_text(json.dumps(data, indent=2)) | |
| subprocess.run([str(VENV/'bin/python'), '-m', 'pip', 'install', '--disable-pip-version-check', | |
| '-r', str(ROOT/'aureon-os-upstream'/'requirements-linux.txt')], check=True) | |
| subprocess.run([str(VENV/'bin/python'), '-m', 'pip', 'check'], check=True) | |
| (IMPORT/'installed-python-packages.txt').write_text(subprocess.check_output([str(VENV/'bin/python'), '-m', 'pip', 'freeze'], text=True)) | |
| subprocess.run([str(VENV/'bin/python'), str(ROOT/'deployment/google-cloud/test_deployment_hold.py')], check=True, | |
| env={**os.environ,'PYTHONDONTWRITEBYTECODE':'1'}) | |
| cache=pathlib.Path('/srv/aureon/cache') | |
| cache.mkdir(exist_ok=True) | |
| account=pwd.getpwnam('aureon') | |
| os.chown('/srv/aureon', 0, account.pw_gid) | |
| os.chmod('/srv/aureon', 0o750) | |
| subprocess.run(['chmod', '-R', 'a+rX', str(VENV)], check=True) | |
| for base in (ROOT.parent, cache): | |
| subprocess.run(['chown','-R',str(account.pw_uid)+':'+str(account.pw_gid),str(base)],check=True) | |
| os.chmod(base,0o750) | |
| unit=f'''[Unit] | |
| Description=Aureon Sero organ %i (commissioning HOLD) | |
| After=network-online.target | |
| Wants=network-online.target | |
| StartLimitIntervalSec=300 | |
| StartLimitBurst=4 | |
| [Service] | |
| Type=simple | |
| User=aureon | |
| Group=aureon | |
| WorkingDirectory={ROOT} | |
| Environment=SERO_WORKSPACE={ROOT} | |
| Environment=PYTHONPATH={ROOT}:{ROOT}/aureon-os-upstream | |
| Environment=AUREON_DEPLOYMENT_HOLD=1 | |
| Environment=AUREON_SUPPRESS_IMPORT_SIDE_EFFECTS=1 | |
| Environment=AUREON_AUDIT_MODE=1 | |
| Environment=AUREON_SELF_QUESTIONING_AI=0 | |
| Environment=PYTHONUNBUFFERED=1 | |
| Environment=PYTHONDONTWRITEBYTECODE=1 | |
| Environment=XDG_CACHE_HOME={cache} | |
| Environment=MPLCONFIGDIR={cache}/matplotlib | |
| ExecStart={VENV}/bin/python {ROOT}/deployment/google-cloud/cloud_organ.py %i | |
| Restart=on-failure | |
| RestartSec=20 | |
| TimeoutStopSec=35 | |
| KillMode=control-group | |
| UMask=0077 | |
| NoNewPrivileges=true | |
| PrivateTmp=true | |
| ProtectHome=true | |
| ProtectSystem=strict | |
| ReadWritePaths={ROOT.parent} {cache} | |
| CapabilityBoundingSet= | |
| RestrictSUIDSGID=true | |
| LockPersonality=true | |
| RestrictRealtime=true | |
| TasksMax=256 | |
| Slice=aureon.slice | |
| [Install] | |
| WantedBy=multi-user.target | |
| ''' | |
| pathlib.Path('/etc/systemd/system/aureon-organ@.service').write_text(unit) | |
| pathlib.Path('/etc/systemd/system/aureon.slice').write_text('[Slice]\nMemoryMax=6500M\nTasksMax=1800\n') | |
| for name in ('queen_mind','hnc_core','soul_protection_daemon','sero_autonomous_expansion','aureon_radar_bridge','mind_neural_canvas'): | |
| dropin=pathlib.Path('/etc/systemd/system')/('aureon-organ@'+name+'.service.d') | |
| dropin.mkdir(exist_ok=True) | |
| (dropin/'network.conf').write_text('[Service]\nIPAddressDeny=any\nIPAddressAllow=localhost\n') | |
| subprocess.run(['systemd-analyze','verify','/etc/systemd/system/aureon-organ@.service'], check=True) | |
| subprocess.run(['systemctl','daemon-reload'], check=True) | |
| for name in ENABLED: | |
| subprocess.run(['systemctl','enable','--now','aureon-organ@'+name+'.service'], check=True) | |
| (IMPORT/'services-installed.json').write_text(json.dumps({'enabled':ENABLED,'deferred':DEFERRED,'deployment_hold':True},indent=2)) | |
| print('Commissioning services installed; validate liveness and outputs before declaring ready', flush=True) | |