feat: add deployable alpha silo

hub/deploy/install_service.sh

@@ -12,16 +12,25 @@ set -euo pipefail
 
 BASE="${BASE:-/srv/curriculum-project-hub}"
 HUB_DIR="${HUB_DIR:-$BASE/hub}"
-SERVICE_USER="${SERVICE_USER:-cph-hub}"
+INSTANCE_ID="${INSTANCE_ID:?INSTANCE_ID is required (lowercase letters, digits, hyphens)}"
+if [[ ! "$INSTANCE_ID" =~ ^[a-z0-9]([a-z0-9-]{0,22}[a-z0-9])?$ ]]; then
+  echo "[install] error: invalid INSTANCE_ID: $INSTANCE_ID" >&2
+  exit 1
+fi
+SERVICE_UNIT="cph-hub-$INSTANCE_ID.service"
+SERVICE_USER="${SERVICE_USER:-cph-$INSTANCE_ID}"
 SERVICE_GROUP="${SERVICE_GROUP:-$SERVICE_USER}"
-SERVICE_HOME="${SERVICE_HOME:-/var/lib/cph-hub/home}"
-STATE_DIR="${STATE_DIR:-/var/lib/cph-hub/state}"
-CACHE_DIR="${CACHE_DIR:-/var/cache/cph-hub}"
-WORKSPACE_ROOT="${WORKSPACE_ROOT:-/var/lib/cph-hub/workspaces}"
+SERVICE_HOME="${SERVICE_HOME:-/var/lib/cph-hub/$INSTANCE_ID/home}"
+STATE_DIR="${STATE_DIR:-/var/lib/cph-hub/$INSTANCE_ID/state}"
+CACHE_DIR="${CACHE_DIR:-/var/cache/cph-hub/$INSTANCE_ID}"
+WORKSPACE_ROOT="${WORKSPACE_ROOT:-/var/lib/cph-hub/$INSTANCE_ID/workspaces}"
 HOST="${HOST:-127.0.0.1}"
-PORT="${PORT:-8788}"
-ENV_FILE="${ENV_FILE:-$BASE/.secrets/platform.env}"
-KEYRING_FILE="${KEYRING_FILE:-$BASE/.secrets/secret-keyring.json}"
+PORT="${PORT:?PORT is required and must be unique on the host}"
+ENV_FILE="${ENV_FILE:-$BASE/.secrets/$INSTANCE_ID/platform.env}"
+KEYRING_FILE="${KEYRING_FILE:-$BASE/.secrets/$INSTANCE_ID/secret-keyring.json}"
+MEMORY_MAX="${MEMORY_MAX:?MEMORY_MAX is required, for example 16G}"
+CPU_QUOTA="${CPU_QUOTA:?CPU_QUOTA is required, for example 400%}"
+TASKS_MAX="${TASKS_MAX:?TASKS_MAX is required, for example 512}"
 SYSTEMD_UNIT_DIR="${SYSTEMD_UNIT_DIR:-/etc/systemd/system}"
 NODE_BIN="${NODE_BIN:-$(command -v node || true)}"
 BWRAP_BIN="${BWRAP_BIN:-$(command -v bwrap || true)}"
@@ -108,6 +117,9 @@ for pair in \
   "RUNTIME_PATH:$RUNTIME_PATH"; do
   require_safe_unit_value "${pair%%:*}" "${pair#*:}"
 done
+[[ "$MEMORY_MAX" =~ ^[1-9][0-9]*[KMGT]$ ]] || fail "MEMORY_MAX must be a systemd byte size such as 16G"
+[[ "$CPU_QUOTA" =~ ^[1-9][0-9]*%$ ]] || fail "CPU_QUOTA must be a positive percentage such as 400%"
+[[ "$TASKS_MAX" =~ ^[1-9][0-9]*$ ]] || fail "TASKS_MAX must be a positive integer"
 
 KEYRING_CREATED=false
 if [ -L "$KEYRING_FILE" ]; then
@@ -146,9 +158,8 @@ if [ ! -e "$ENV_FILE" ]; then
 # rerunning install_service.sh; failed preflight never installs the unit.
 NODE_ENV=production
 DATABASE_URL=
-FEISHU_APP_ID=
-FEISHU_APP_SECRET=
-FEISHU_BOT_OPEN_ID=
+HUB_SILO_ORGANIZATION_ID=
+HUB_SYSTEMD_UNIT=$SERVICE_UNIT
 CPH_BIN=$CPH_BIN_DEFAULT
 HOST=$HOST
 PORT=$PORT
@@ -156,6 +167,13 @@ HUB_PROJECT_WORKSPACE_ROOT=$WORKSPACE_ROOT
 HUB_PUBLIC_BASE_URL=
 HUB_SESSION_SECRET=
 HUB_AGENT_MAX_TURNS=25
+HUB_AGENT_MAX_CONCURRENT_RUNS=
+HUB_AGENT_MAX_RUN_SECONDS=
+HUB_HTTP_BODY_LIMIT_BYTES=
+HUB_MAX_FILES_PER_MESSAGE=
+HUB_MAX_FILE_BYTES=
+HUB_HTTP_REQUESTS_PER_MINUTE=
+HUB_FEISHU_EVENTS_PER_MINUTE=
 HUB_FEISHU_LISTENER_ENABLED=true
 CPH_SANDBOX_EXTRA_DENY_READ=$ENV_FILE:$KEYRING_FILE
 EOF
@@ -185,6 +203,7 @@ PREFLIGHT_ARGS=(
   --state-dir "$STATE_DIR"
   --cache-dir "$CACHE_DIR"
   --workspace-root "$WORKSPACE_ROOT"
+  --service-unit "$SERVICE_UNIT"
   --bwrap-bin "$BWRAP_BIN"
   --socat-bin "$SOCAT_BIN"
   --pg-isready-bin "$PG_ISREADY_BIN"
@@ -267,7 +286,7 @@ provision_directory "$WORKSPACE_ROOT"
 # the unit. This catches symlink or ownership changes between the two phases.
 "${PREFLIGHT_ARGS[@]}" --service-uid "$SERVICE_UID" --service-gid "$SERVICE_GID"
 
-UNIT="$SYSTEMD_UNIT_DIR/cph-hub.service"
+UNIT="$SYSTEMD_UNIT_DIR/$SERVICE_UNIT"
 install -d -o root -g root -m 0755 "$SYSTEMD_UNIT_DIR"
 TMP_UNIT="$(mktemp)"
 trap 'rm -f "$TMP_UNIT"' EXIT
@@ -285,11 +304,15 @@ sed \
   -e "s|__BWRAP_BIN__|$BWRAP_BIN|g" \
   -e "s|__SOCAT_BIN__|$SOCAT_BIN|g" \
   -e "s|__RUNTIME_PATH__|$RUNTIME_PATH|g" \
+  -e "s|__INSTANCE_ID__|$INSTANCE_ID|g" \
+  -e "s|__MEMORY_MAX__|$MEMORY_MAX|g" \
+  -e "s|__CPU_QUOTA__|$CPU_QUOTA|g" \
+  -e "s|__TASKS_MAX__|$TASKS_MAX|g" \
   "$SCRIPT_DIR/cph-hub.service" >"$TMP_UNIT"
 install -o root -g root -m 0644 "$TMP_UNIT" "$UNIT"
 
 systemctl daemon-reload
-systemctl enable cph-hub.service
-echo "[install] installed cph-hub.service for $SERVICE_USER:$SERVICE_GROUP"
+systemctl enable "$SERVICE_UNIT"
+echo "[install] installed $SERVICE_UNIT for $SERVICE_USER:$SERVICE_GROUP"
 echo "[install] home=$SERVICE_HOME state=$STATE_DIR cache=$CACHE_DIR workspaces=$WORKSPACE_ROOT"
-echo "[install] start with: systemctl start cph-hub.service"
+echo "[install] start with: systemctl start $SERVICE_UNIT"