Rocky deployment, archives, and operational tooling

.github/workflows/ci.yml

@@ -22,10 +22,7 @@ jobs:
       - run: ruff check .
       - run: ruff format --check .
       - run: mypy
-      - run: |
-          threshold=95
-          if [ ! -f tests/test_operations.py ]; then threshold=80; fi
-          pytest -m "not browser" --cov --cov-report=term-missing --cov-fail-under="$threshold"
+      - run: pytest -m "not browser" --cov --cov-report=term-missing --cov-fail-under=95
       - run: git diff --check
 
   rocky-sqlite:
@@ -34,7 +31,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - run: dnf install -y epel-release
-      - run: dnf install -y python3.13 python3.13-pip sqlite
+      - run: dnf install -y python3.13 python3.13-pip sqlite poppler-utils
       - run: python3.13 -m pip install --require-hashes -r requirements.lock
       - run: python3.13 -m pip install --require-hashes -r requirements-test.lock
       - run: python3.13 -m pytest -m "not browser"
@@ -49,7 +46,7 @@ jobs:
       - run: python -m pip install --require-hashes -r requirements.lock
       - run: python -m pip install --require-hashes -r requirements-test.lock
       - run: python -m playwright install --with-deps webkit
-      - run: pytest -m browser || test "$?" -eq 5
+      - run: pytest -m browser
 
   security:
     runs-on: ubuntu-latest

deploy/README.md

@@ -0,0 +1,35 @@
+# Rocky deployment
+
+The application listens only on `127.0.0.1:8766`. Tailscale Serve is the
+network authorization boundary; there is deliberately no application login.
+
+Install the checked-out stack tip:
+
+```sh
+sudo dnf install -y epel-release
+sudo dnf install -y python3.13 python3.13-pip sqlite poppler-utils
+./driving-log bootstrap
+./driving-log install --public-host HOSTNAME:8443 --public-scheme http
+loginctl enable-linger "$USER"
+./driving-log start
+tailscale serve --bg --http=8443 http://127.0.0.1:8766
+```
+
+Before changing Serve, save `tailscale serve status --json` and verify the
+existing HTTP port 80 handler still forwards to Wordle on
+`127.0.0.1:8765`. Never use Funnel and never bind this application to a LAN or
+tailnet address.
+
+The environment file is mode `0600` at
+`~/.config/driving-log/environment`. Mutable state is mode `0700` beneath
+`~/.local/state/driving-log`; the database and archives are mode `0600`.
+Configure `DRIVING_LOG_EXTERNAL_ARCHIVE_DIR` to protect against loss of the
+Rocky disk.
+
+Microsoft Forms remains an adapter contract only. No workbook ID or
+credentials were available for this release.
+
+The restore helper is used only for a restore initiated by the running web
+application, so it deliberately restarts that application after the helper
+finishes. A direct CLI restore instead requires the web service to be stopped
+and does not invoke the helper unit.

deploy/systemd/driving-log-archive.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Create and verify Daniel driving-log archive
+
+[Service]
+Type=oneshot
+WorkingDirectory=%h/work/driving-record
+EnvironmentFile=-%h/.config/driving-log/environment
+ExecStart=%h/work/driving-record/driving-log archive create
+ExecStart=%h/work/driving-record/driving-log archive replicate
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=full
+UMask=0077

deploy/systemd/driving-log-archive.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Daily Daniel driving-log archive
+
+[Timer]
+OnCalendar=daily
+Persistent=true
+RandomizedDelaySec=15m
+
+[Install]
+WantedBy=timers.target

deploy/systemd/driving-log-restore@.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Restore Daniel driving-log operation %i
+Conflicts=driving-log-web.service
+
+[Service]
+Type=oneshot
+WorkingDirectory=%h/work/driving-record
+EnvironmentFile=-%h/.config/driving-log/environment
+ExecStart=%h/work/driving-record/driving-log archive restore-request %i
+ExecStopPost=systemctl --user start driving-log-web.service
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ReadWritePaths=%h/.local/state/driving-log
+UMask=0077

deploy/systemd/driving-log-web.service

@@ -0,0 +1,19 @@
+[Unit]
+Description=Daniel supervised driving log
+After=network.target tailscaled.service
+
+[Service]
+Type=simple
+WorkingDirectory=%h/work/driving-record
+EnvironmentFile=-%h/.config/driving-log/environment
+ExecStart=%h/work/driving-record/driving-log serve
+Restart=on-failure
+RestartSec=3
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ReadWritePaths=%h/.local/state/driving-log
+UMask=0077
+
+[Install]
+WantedBy=default.target