f3f579f5a8
P1-D: bump package.json version 1.7.2 → 1.8.0 and add [1.8.0] CHANGELOG
entry documenting the infra/vps/ PRAB generation orchestrator addition.
P2 (security): replace StrictHostKeyChecking=no with StrictHostKeyChecking=accept-new
in all three SSH invocations in orchestrate-generation.sh. Add
UserKnownHostsFile=${KNOWN_HOSTS} (-o) to pin key verification to the
pre-seeded file rather than the root known_hosts.
install-orchestrator.sh: add ssh-keyscan step that pre-populates
/opt/prab-orchestrator/known_hosts with Hostinger's host key on first
install. Graceful degradation: if ssh-keyscan fails, logs WARN and
proceeds (accept-new will add the key on first real connect).
prab-generation.service: add justifying comment for User=root (root holds
the Hostinger SSH key + known_hosts in /root/.ssh/ and /opt/prab-orchestrator/).
Agent-Session: prab-reliability-remediation-20260622
23 lines
995 B
Desktop File
23 lines
995 B
Desktop File
[Unit]
|
|
Description=PRAutoBlogger article generation (VPS orchestrator)
|
|
Documentation=https://github.com/peptide-repo/peptide-e2e/tree/main/infra/vps/
|
|
After=network.target
|
|
# Do not start if the timer fires while another instance is still running.
|
|
# Type=oneshot + TimeoutStartSec enforce this at the systemd level.
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
# root owns /root/.ssh/hostinger_prod_ed25519 and /opt/prab-orchestrator/known_hosts;
|
|
# a dedicated service user would need its own keypair + sudo-less SSH access.
|
|
# Acceptable on this dedicated lab VPS (not shared); revisit if VPS is multi-tenant.
|
|
User=root
|
|
ExecStart=/opt/prab-orchestrator/orchestrate-generation.sh
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=prab-generation
|
|
# Allow up to 2 hours for a full generation run (orchestrate + draft LLM calls).
|
|
# The longest observed single LLM call was 1925s (~32 min); normal runs 2-5 min.
|
|
TimeoutStartSec=7200
|
|
# Do not restart on failure — the timer will retry the next day.
|
|
Restart=no
|