λgitsite

~ober/jerboa-site

Imported from ~/mine/jerboa-site

download snapshot

about

# jerboa-site

Private jerboa.sh website content built with `jerboa-sinatra`.

## Source of Truth

This repo owns the private site presentation and deployable web binary.
Canonical docs, examples, public assets, and machine-readable API or
feature data live in the adjacent or configured `jerboa` checkout.

Sync the pinned Jerboa metadata snapshot with:

```sh
make sync-jerboa
```

See [`docs/site-sync.md`](docs/site-sync.md) for the update workflow and
LLM-assisted documentation guardrails.

## Install Endpoint

The signed v0.2.5 release is live. `/install.sh` returns HTTP 200 with a
bootstrap script that downloads the SSH-signed installer from the canonical
Forgejo repo. The installer verifies an Ed25519-signed manifest before
trusting any artifact.

The public signer key (`ssh-ed25519 AAAAC3NzaC1...zeUQ`, identity `ober`)
is documented in the [release notes](https://git.jerboa.sh/ober/jerboa/releases/tag/v0.2.5)
and pinned in [`support/installer-release.lock`](support/installer-release.lock).

See [`docs/installer-trust.md`](docs/installer-trust.md) for the full trust
chain and [`docs/release-evidence.md`](docs/release-evidence.md) for
reproducibility evidence.

## Package Registry

The site documents the built-in `ober` TUF registry at `/packages/`.
The registry lives at [git.jerboa.sh/ober/jerboa-registry](https://git.jerboa.sh/ober/jerboa-registry)
and is served via Forgejo raw file endpoints.

## Build

This repo keeps only the site entry point and content. It builds against the
adjacent `../jerboa-sinatra` framework checkout by default. Override with
`JERBOA_SINATRA=/path/to/jerboa-sinatra` when needed.

```sh
make binary
```

## Deploy

Deployment is owned by the private infrastructure playbook configured by
`ANSIBLE_DIR` and `ANSIBLE_PLAYBOOK`:

```sh
make deploy
```

The playbook copies this reviewed source tree to the production host, rebuilds
Sinatra there, builds the site candidate with the host Jerboa toolchain, tests
that candidate over local TLS, and only then installs it over the production
binary and restarts the site service. A failed Sinatra build, site build, or
localhost test leaves the old production binary in place.

## Security Verification

```sh
make verify
make release-evidence
```

`make verify` checks content sanitization, generated metadata, high-confidence
secrets, private hostnames/paths, dependency lockfiles, and the deployable site
binary. Release evidence is written to `dist/release-evidence/`.

Run locally with TLS material:

```sh
TLS_CERT=/path/fullchain.pem TLS_KEY=/path/privkey.pem PORT=8443 ./dist/jerboa-site
```

For a fully static Linux amd64 binary:

```sh
make static-binary
```

The static output is `dist/jerboa-site-linux-amd64`.

recent commits