Console operations

Part	Where
Web app (React + Chakra UI, static)	apps/autorune-console → nginx web root of console.mindrune.xyz
Console API (Bun + Hono, loopback only)	apps/autorune-console-api, systemd unit autorune-console, own system user
Environment registry	infra/autorune-console/environments.json
Sudoers drop-in (generated)	infra/autorune-console/sudoers
nginx vhost	infra/nginx/autorune-console.conf (own Let's Encrypt certificate)
Netdata config	infra/netdata/netdata.conf (loopback only, no registry, no statsd)
Sessions and audit log	SQLite in the console's private state directory

Deploying

infra/deploy/console.sh

It builds the web app and publishes it, bundles the API into one file and installs it with a pinned copy of Bun, installs the config and registry, regenerates the sudoers drop-in, checks it against the committed copy and with visudo, installs it, and restarts the console. Secrets are created once, idempotently, by infra/autorune-console/setup-secrets.sh (it prints no values): the admin API shared secret (in a git-ignored env file of the environment's API, mode 600), the read-only database role and its password, and the console's own secrets file (root only, mode 600). --rotate makes a new admin secret and database password.

Adding an environment (for example PROD)

1. Give the new environment's API unit an admin secret and the allowlist file in its unit (EnvironmentFile), like TEST.
2. Fill in its entry in environments.json: links, admin API address and the name of its secret variable, read-only database URL variable, engine address, allowlist file, API unit and its units with their allowed actions.
3. Create its read-only database role (db-readonly.sql) and add its secrets to the console's secrets file.
4. Regenerate the sudoers drop-in (bun run sudoers in apps/autorune-console-api), commit it, deploy.

No code changes: every page works for any configured environment.

The sign-in allowlist of an environment

An environment's own sign-in allowlist (who may use the app) lives in a file the console manages, read by that environment's API unit on start. Edit it in Users & access; the previous version is kept next to it (last 20). It takes effect on the next API restart, which the page offers as a separate confirmed action. With open sign-up (Operations) the allowlist is ignored; the page shows the mode read-only, with the new accounts in the last hour and 24 hours. The mode itself is changed only in the environment's API env file.

Discord redirect

The console signs in with the same Discord application as the app. Its callback, https://console.mindrune.xyz/api/auth/callback, must be listed under OAuth2 → Redirects in the Discord developer portal. Until it is, Discord refuses the sign-in and the console stays closed.

Checks after a deploy

• https://console.mindrune.xyz shows only the sign-in button; every /api/* route and /netdata/ answer 401 without a session.
• sudo -l -U autorune-console lists only the generated rules; any other systemctl or journalctl command is refused.
• The console, admin API and Netdata listen on loopback only.