0c9bea72e0
Two groups of changes, committed together as the follow-up to the initial push: 1. .gitmodules — submodule Qwen3-TTS now points at the internal Gitea fork (ssh://git@mini-eq:2222/umbragit/Qwen3-TTS.git) instead of upstream GitHub, so a clone actually gets the UmbraAudio branding/integration commit 012e452 rather than vanilla upstream. 2. New infra/ tooling for the cross-machine work in spec 21: agent_bridge, remote_credential_broker (Keychain-backed, secrets read at runtime and generated via read_secret/random_secret — no hardcoded credentials), the enterprise bootstrap scripts, and the oldbox SSH/auth prompts. Plus backup/ restore scripts, two specs (18 UmbraTrans, 19 enterprise control plane), umbraaudio/voices/lmstudio_gate.py, and in-flight edits to the discovery/attribution/profiling modules, config, chapter_builder, emotion, pronunciation, qwen_tts and routes. Also adds *.db to .gitignore: SQLite project databases are runtime state and no .db file was tracked before. Verified before staging: .env's only change is UMBRA_TTS__QWEN_TTS_HELPER_URL and the committed copy has zero secret-looking values; the broker ships only config.example.json.
2.5 KiB
2.5 KiB
Umbra enterprise phase-one bootstrap
This directory contains the first, infrastructure-only bootstrap for the UmbraTrans enterprise control plane.
It is designed for Linux Mint 22.1 (Ubuntu 24.04-family) and is intentionally conservative:
- It does not modify Qwen.
- It does not stop or alter Docker containers.
- It does not change firewall rules.
- It does not install application code or systemd application units yet.
- It does not place PostgreSQL on SMB/NAS.
- It creates database roles, a local database, core identity/tenancy tables, row-level-security policies, a one-time bootstrap administrator, and least-privilege service accounts.
Files
bootstrap_enterprise_mint.sh— root bootstrap and read-only inspection tool.enterprise-bootstrap.env.example— non-secret configuration template.postgres/001_control_plane.sql— initial identity, organization, project, role, invitation, session, MFA, bootstrap-token, audit, and RLS schema.
Safe usage on oldbox
The script is intended to be copied to the umbra account and reviewed there:
ssh umbra@oldbox.bdmurphy.me
mkdir -p ~/umbra-enterprise-bootstrap
# copy the three files into that directory
cp enterprise-bootstrap.env.example enterprise-bootstrap.env
$EDITOR enterprise-bootstrap.env
bash -n bootstrap_enterprise_mint.sh
./bootstrap_enterprise_mint.sh --check
./bootstrap_enterprise_mint.sh --dry-run --config "$PWD/enterprise-bootstrap.env"
sudo ./bootstrap_enterprise_mint.sh --apply --config /home/umbra/umbra-enterprise-bootstrap/enterprise-bootstrap.env
The root password is entered only in the user's terminal. It is not stored in the configuration file or command line.
After a successful apply:
sudo ./bootstrap_enterprise_mint.sh --verify --config /home/umbra/umbra-enterprise-bootstrap/enterprise-bootstrap.env
The initial one-time administrator token is stored root-only at:
/root/umbra-enterprise-bootstrap.token
Do not paste that token into chat. The application bootstrap flow will consume it and replace it with normal authentication.
Deliberate exclusions
The script does not yet:
- create or install the UmbraTrans API/worker application;
- install a reverse proxy or certificate;
- expose Qwen to other machines;
- add Qwen authentication or rate limiting;
- modify UFW/nftables/iptables;
- migrate existing Docker, MySQL, LM Studio, Ollama, or Qwen data.
Those are separate reviewed changes after the host and database foundation are verified.