Add Linux deployment installer, supervised services and readiness checks

deploy/linux/api.env.example

@@ -0,0 +1,3 @@
+# Read by systemd as root, not by the web user. chmod 0600, owner root.
+# Configure once; never commit a filled copy.
+# VBA_INTAKE_TOKEN="replace-with-a-random-32-to-256-character-base64url-token"

deploy/linux/api.toml

@@ -0,0 +1,25 @@
+[api]
+workspace = "/var/lib/viano-bug-analysis"
+host = "127.0.0.1"
+port = 8080
+
+[auth]
+users_database = "/etc/viano-bug-analysis/auth/users.sqlite3"
+session_seconds = 3600
+
+[[projects]]
+id = "viano-core"
+type = "wow"
+profile = "vcore"
+adapter = "vcore"
+planning_mode = "joint"
+[projects.settings]
+project_config = "project.toml"
+llm_config = "llm.toml"
+investigation_config = "investigation.bounded.toml"
+budget_config = "budget.human-tests.toml"
+
+[[clients]]
+id = "wow-capture-worker"
+token_env = "VBA_INTAKE_TOKEN"
+projects = ["viano-core"]

deploy/linux/gitconfig

@@ -0,0 +1,2 @@
+[safe]
+    directory = /srv/viano-bug-analysis/viano-core

deploy/linux/nginx.conf.example

@@ -0,0 +1,29 @@
+# Replace domain and certificate paths. Install manually after nginx -t.
+# Root path on its own HTTPS hostname; upstream must remain loopback-only.
+server {
+    listen 80;
+    server_name buganalysis.example.org;
+    return 308 https://buganalysis.example.org$request_uri;
+}
+server {
+    listen 443 ssl;
+    server_name buganalysis.example.org;
+    ssl_certificate /etc/letsencrypt/live/buganalysis.example.org/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/buganalysis.example.org/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    client_max_body_size 768m;
+    client_body_timeout 120s;
+    location / {
+        proxy_pass http://127.0.0.1:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_request_buffering off;
+        proxy_read_timeout 180s;
+        proxy_send_timeout 180s;
+        proxy_cache off;
+        proxy_no_cache 1;
+    }
+}

deploy/linux/worker.env.example

@@ -0,0 +1,3 @@
+# Read by systemd as root. chmod 0600, owner root. No shell export statements.
+# GEMINI_API_KEY="your-cloud-key"
+# VIANO_DB_PASSWORD="your-read-only-database-password"

deploy/linux/worker.toml

@@ -0,0 +1,7 @@
+[worker]
+intake_config = "api.toml"
+poll_seconds = 5
+error_retry_seconds = 60
+max_inbox_per_pass = 20
+min_free_bytes = 536870912
+telemetry_config = "telemetry.toml"