Phase E: provision VITE_SPIRE_SEED for bunker pairing (#52) #63

Merged

padreug merged 1 commit from phase-e-provisioning into dev

2026-06-21 12:56:02 +00:00

padreug commented

2026-06-21 10:50:07 +00:00

Owner

Phase E of the bunker migration (#52) — the deploy/provisioning slice. Now that C (#60) and D (#61) are on dev, this is the single remaining commit (rebased onto dev, just 8a02d72).

Validated on real hardware — this is the exact provisioning path used to pair the Sintra in the 2026-06-21 bunker smoke (~/dev/coordination/smoke-bunker-pairing-sintra.md; legs 1/2/5/7/8/9 all passed).

Changes

provision-atm.sh — writes VITE_SPIRE_SEED (the spire-seed:v1: pairing seed from spirekeeper) as the production identity, validating the scheme prefix; the generated nsec path is kept only as a dev fallback when SPIRE_SEED is unset. Relay default moved to the LNbits bundled nostrrelay (ws://$HOST_IP:5001/nostrrelay/test).
.env templates (live.nix + the flake's installed-default) — swap VITE_ATM_PRIVATE_KEY → VITE_SPIRE_SEED, drop the dead LP-era vars.
README — note that state.db now also holds the bunker binding (keep it or re-pair).

Note

The smoke surfaced that the Sintra's nixos-upgrade.timer reverts a nixos-rebuild test deploy at 04:00 (channel/dev build) — a deploy-methodology gotcha, not a code issue. Not addressed here; flagged for test-unit ops.

Do NOT use the MCP merge endpoint — merge via the Forgejo UI after review.

🤖 Generated with Claude Code

Phase E of the bunker migration (#52) — the deploy/provisioning slice. Now that C (#60) and D (#61) are on `dev`, this is the single remaining commit (rebased onto `dev`, just `8a02d72`). **Validated on real hardware** — this is the exact provisioning path used to pair the Sintra in the 2026-06-21 bunker smoke (`~/dev/coordination/smoke-bunker-pairing-sintra.md`; legs 1/2/5/7/8/9 all passed). ### Changes - **`provision-atm.sh`** — writes `VITE_SPIRE_SEED` (the `spire-seed:v1:` pairing seed from spirekeeper) as the production identity, validating the scheme prefix; the generated nsec path is kept only as a dev fallback when `SPIRE_SEED` is unset. Relay default moved to the LNbits bundled nostrrelay (`ws://$HOST_IP:5001/nostrrelay/test`). - **`.env` templates** (`live.nix` + the flake's installed-default) — swap `VITE_ATM_PRIVATE_KEY` → `VITE_SPIRE_SEED`, drop the dead LP-era vars. - **README** — note that `state.db` now also holds the bunker binding (keep it or re-pair). ### Note The smoke surfaced that the Sintra's `nixos-upgrade.timer` reverts a `nixos-rebuild test` deploy at 04:00 (channel/dev build) — a deploy-methodology gotcha, not a code issue. Not addressed here; flagged for test-unit ops. Do NOT use the MCP merge endpoint — merge via the Forgejo UI after review. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

padreug added 1 commit

2026-06-21 10:50:07 +00:00

feat(deploy): provision VITE_SPIRE_SEED for bunker pairing (Phase E) 8a02d72bd1

provision-atm.sh now writes VITE_SPIRE_SEED (the spire-seed:v1: pairing seed
from spirekeeper) as the production identity, validating the scheme prefix;
the generated nsec path is kept only as a dev fallback when SPIRE_SEED is
unset. Relay default moved to the LNbits bundled nostrrelay
(ws://$HOST_IP:5001/nostrrelay/test). .env templates (live.nix + the flake's
installed-default) swap VITE_ATM_PRIVATE_KEY → VITE_SPIRE_SEED and drop the
dead LP-era vars. README notes state.db now also holds the bunker binding
(keep it or re-pair).

Part of Phase E, aiolabs/bitspire#52. Unblocks the Sintra live-pairing smoke.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

padreug merged commit 212ba9bbc6 into dev

2026-06-21 12:56:02 +00:00

padreug deleted branch phase-e-provisioning

2026-06-21 12:56:02 +00:00

padreug referenced this pull request from a commit

2026-06-21 12:56:03 +00:00

Merge pull request 'Phase E: provision VITE_SPIRE_SEED for bunker pairing (#52)' (#63) from phase-e-provisioning into dev

padreug referenced this pull request

2026-06-21 13:28:36 +00:00

track: consume LNbits sidecar bunker (replace VITE_ATM_PRIVATE_KEY with bunker:// URL) #52