umbragit/UmbraAudio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
0c9bea72e0d20af4f78bbcb35e671fce449e1d87
UmbraAudio/infra/README-enterprise-bootstrap.md
B.D. Murphy 0c9bea72e0 Add enterprise/infra tooling and repoint Qwen3-TTS submodule to internal fork 
Two groups of changes, committed together as the follow-up to the initial push:

1. .gitmodules — submodule Qwen3-TTS now points at the internal Gitea fork
   (ssh://git@mini-eq:2222/umbragit/Qwen3-TTS.git) instead of upstream GitHub,
   so a clone actually gets the UmbraAudio branding/integration commit
   012e452 rather than vanilla upstream.

2. New infra/ tooling for the cross-machine work in spec 21: agent_bridge,
   remote_credential_broker (Keychain-backed, secrets read at runtime and
   generated via read_secret/random_secret — no hardcoded credentials), the
   enterprise bootstrap scripts, and the oldbox SSH/auth prompts. Plus
   backup/ restore scripts, two specs (18 UmbraTrans, 19 enterprise control
   plane), umbraaudio/voices/lmstudio_gate.py, and in-flight edits to the
   discovery/attribution/profiling modules, config, chapter_builder, emotion,
   pronunciation, qwen_tts and routes.

Also adds *.db to .gitignore: SQLite project databases are runtime state and no
.db file was tracked before.

Verified before staging: .env's only change is UMBRA_TTS__QWEN_TTS_HELPER_URL and
the committed copy has zero secret-looking values; the broker ships only
config.example.json.
2026-10-06 06:57:41 -07:00

2.5 KiB
Raw Blame History

Umbra enterprise phase-one bootstrap

This directory contains the first, infrastructure-only bootstrap for the UmbraTrans enterprise control plane.

It is designed for Linux Mint 22.1 (Ubuntu 24.04-family) and is intentionally conservative:

  • It does not modify Qwen.
  • It does not stop or alter Docker containers.
  • It does not change firewall rules.
  • It does not install application code or systemd application units yet.
  • It does not place PostgreSQL on SMB/NAS.
  • It creates database roles, a local database, core identity/tenancy tables, row-level-security policies, a one-time bootstrap administrator, and least-privilege service accounts.

Files

  • bootstrap_enterprise_mint.sh — root bootstrap and read-only inspection tool.
  • enterprise-bootstrap.env.example — non-secret configuration template.
  • postgres/001_control_plane.sql — initial identity, organization, project, role, invitation, session, MFA, bootstrap-token, audit, and RLS schema.

Safe usage on oldbox

The script is intended to be copied to the umbra account and reviewed there:

ssh umbra@oldbox.bdmurphy.me
mkdir -p ~/umbra-enterprise-bootstrap
# copy the three files into that directory
cp enterprise-bootstrap.env.example enterprise-bootstrap.env
$EDITOR enterprise-bootstrap.env
bash -n bootstrap_enterprise_mint.sh
./bootstrap_enterprise_mint.sh --check
./bootstrap_enterprise_mint.sh --dry-run --config "$PWD/enterprise-bootstrap.env"
sudo ./bootstrap_enterprise_mint.sh --apply --config /home/umbra/umbra-enterprise-bootstrap/enterprise-bootstrap.env

The root password is entered only in the user's terminal. It is not stored in the configuration file or command line.

After a successful apply:

sudo ./bootstrap_enterprise_mint.sh --verify --config /home/umbra/umbra-enterprise-bootstrap/enterprise-bootstrap.env

The initial one-time administrator token is stored root-only at:

/root/umbra-enterprise-bootstrap.token

Do not paste that token into chat. The application bootstrap flow will consume it and replace it with normal authentication.

Deliberate exclusions

The script does not yet:

  • create or install the UmbraTrans API/worker application;
  • install a reverse proxy or certificate;
  • expose Qwen to other machines;
  • add Qwen authentication or rate limiting;
  • modify UFW/nftables/iptables;
  • migrate existing Docker, MySQL, LM Studio, Ollama, or Qwen data.

Those are separate reviewed changes after the host and database foundation are verified.