Module hostspec 

Pure host-add logic: the POSIX probe script and its parser.

host add runs PROBE_SCRIPT on the target over the operator’s SSH before writing a single byte to it. parse_probe turns the captured key=value output into ProbeFacts for the capability check (next task).

Structs

HostPlan

What host add will do to a host that passed capability assessment.

ProbeFacts

Facts about a probed host, parsed from PROBE_SCRIPT’s output.

Constants

PROBE_SCRIPT

POSIX sh — no bashisms — run on the target host over the operator’s SSH. Emits one key=value line per fact; order doesn’t matter to the parser.

Functions

assess

Decide whether a probed host is capable of hosting git-ark, and if so, plan how. Collects every blocking reason rather than stopping at the first, so the operator sees the whole picture before fixing anything.

forced_command_line

The exact authorized_keys entry for the forced-command key: restricted to running git-ark shell against this host’s own config, with no pty, port/agent/X11 forwarding. Uses the absolute install_dir — sshd does not expand $HOME in command=.

parse_probe

Parse PROBE_SCRIPT’s key=value output into ProbeFacts.

per_host_prefix

A host’s effective S3 prefix: the base prefix namespaced by host name, so each host writes to its own subtree (independent 1:1 copies).

render_config

Render the host’s config.toml: repos_root under install_dir, the age recipient (public key only — the private identity never leaves the client), and an [s3] table. endpoint is included only when the S3 config has one (real AWS S3 otherwise). mirror = true is appended only when mirror is set — the host’s backup arm gates the GitHub mirror on this line, so a non-mirror host omits it entirely rather than writing mirror = false.

render_secrets

Render the host’s secrets.toml: the write-only S3 credential, [aws], plus an optional [github] token. Written chmod 600 by the caller; never printed. The token is the client-enforced singleton mirror’s credential — present only on the one host currently designated mirror.

ssh_config_block

A client ~/.ssh/config block wiring git push git-ark-<name>:<repo> to the host over the forced-command key.