zwitschi
5d81f617f0
- deploy.sh: clean-tree guard + git fetch && git pull --ff-only + optional dep reinstall + app.db --migrate + restart. - restart-service.sh: supervisor-agnostic restart (systemd or fallback), waits for an in-flight scan. - check_runtime_git.sh: proves no scan writes git-tracked runtime data. - ids.service: systemd unit template. - tests/test_deployment.py: stdlib unittest invariant tests for the deployment runtime-isolation guarantee.
14 lines
527 B
Markdown
14 lines
527 B
Markdown
#!/usr/bin/env bash
|
|
#
|
|
# Deployment support for the intrusion-detection IDS.
|
|
#
|
|
# This directory is intentionally small and uses no external framework:
|
|
# deploy.sh conflict-free `git pull` update wrapper (D004)
|
|
# ids.service systemd unit template (D005)
|
|
# restart-service.sh supervisor-agnostic restart shim (D005)
|
|
# check_runtime_git.sh proves a scan never dirties tracked runtime files (D001)
|
|
#
|
|
# See .github/instructions/DEPLOYMENT.md for the full plan.
|
|
|
|
set -euo pipefail
|