mirror of
https://github.com/elder-plinius/OBLITERATUS.git
synced 2026-08-30 06:30:37 +02:00
82 lines
3.2 KiB
YAML
82 lines
3.2 KiB
YAML
apiVersion: setup.aiwg.io/v1
|
|
kind: SetupManifest
|
|
metadata:
|
|
name: obliteratus-dev
|
|
version: 1.0.0
|
|
description: Provider-orchestrated Linux setup with optional NVIDIA CUDA and scoped OpenBao runtime credentials.
|
|
install_type: developer
|
|
execution_mode: provider-orchestrated
|
|
spec:
|
|
platforms:
|
|
- os: linux
|
|
arch: [x86_64, arm64]
|
|
shell: bash
|
|
params:
|
|
- name: ENABLE_CUDA
|
|
type: choice
|
|
choices: [auto, "true", "false"]
|
|
default: auto
|
|
description: Install the matching CUDA PyTorch wheel when NVIDIA hardware is available.
|
|
- name: ENABLE_OPENBAO
|
|
type: choice
|
|
choices: [auto, "true", "false"]
|
|
default: auto
|
|
description: Configure the scoped OBLITERATUS AppRole through the sibling itops repository.
|
|
- name: OPENBAO_ITOPS_ROOT
|
|
type: path
|
|
default: "${HOME}/dev/itops"
|
|
description: Trusted itops checkout containing OpenBao policy and token helpers.
|
|
prerequisites:
|
|
- name: python
|
|
detect: "python3 --version | awk '{print $2}'"
|
|
version_min: "3.10"
|
|
install_hint: Install Python 3.10 or newer.
|
|
- name: uv
|
|
detect: "uv --version | awk '{print $2}'"
|
|
install_hint: Install uv from https://docs.astral.sh/uv/.
|
|
- name: git
|
|
detect: "git --version | awk '{print $3}'"
|
|
version_min: "2.30"
|
|
install_hint: Install Git from https://git-scm.com/.
|
|
- name: disk-space
|
|
detect: "df --output=avail -BG . | tail -1 | tr -d ' G'"
|
|
version_min: "12"
|
|
install_hint: At least 12 GB free space is required for dependencies and a test model.
|
|
- name: ram
|
|
detect: "awk '/MemTotal/ {printf \"%.0f\", $2/1024/1024}' /proc/meminfo"
|
|
version_min: "8"
|
|
install_hint: At least 8 GB RAM is required; 16 GB or more is recommended.
|
|
steps:
|
|
- id: install-runtime
|
|
type: script
|
|
script: scripts/setup.sh
|
|
verify: ".venv/bin/python -c 'import gradio, torch, transformers'"
|
|
- id: configure-openbao
|
|
type: agentic
|
|
depends_on: [install-runtime]
|
|
instruction: |
|
|
When ENABLE_OPENBAO is true, or auto and OPENBAO_ITOPS_ROOT is usable,
|
|
follow that repository's AGENTS.md and security SOP. Reuse or provision a
|
|
least-privilege obliteratus-local AppRole restricted to reads of
|
|
kv_internal/data/{huggingface/read-token,openrouter/automation-agent-key}
|
|
and their exact metadata leaves. Seal the AppRole bootstrap to the host
|
|
TPM when available. Install a mode-0700 OBLITERATUS_SECRET_COMMAND broker
|
|
that maps only HF_TOKEN and OPENROUTER_API_KEY. Verify intended reads and
|
|
an adjacent 403 denial. Never print secret values. Do not map the read-only
|
|
HF token to HF_PUSH_TOKEN or OBLITERATUS_HUB_TOKEN.
|
|
- id: verify-runtime
|
|
type: script
|
|
script: scripts/verify.sh
|
|
depends_on: [install-runtime, configure-openbao]
|
|
briefing:
|
|
success: OBLITERATUS developer runtime is ready.
|
|
next_steps:
|
|
- Run installer/scripts/launch-local.sh and open http://127.0.0.1:7860.
|
|
- Use a separate write-scoped HF_PUSH_TOKEN or OBLITERATUS_HUB_TOKEN only when testing Hub publishing.
|
|
recovery:
|
|
- id: reinstall-runtime
|
|
steps:
|
|
- id: reinstall
|
|
type: script
|
|
script: scripts/setup.sh
|