fix(install): fetch from scm.tikali.ai (public project) — Gitea name is split-horizon inside the estate

Inside the estate gitea.cbs.tikali.net resolves to jump1's RED EIP (10.10.0.175),
which has no HTTP ingress, so backend boxes could not download the install
artefacts from the Gitea mirror (cbs/iac#102). scm.tikali.ai is reachable from
those boxes and the project is now public, so the GitLab generic package
registry becomes the PRIMARY source:

- packaging/install.sh: default source = scm.tikali.ai generic package registry
  (projects/69/packages/generic/monky-deployd/<ver>/...); `--source gitea` /
  MONKY_DEPLOYD_SOURCE=gitea keeps the Gitea release as the off-estate
  alternative; --base-url / MONKY_DEPLOYD_BASE_URL still override the base.
- ansible role defaults: monky_deployd_base_url/_deb_url point at the registry,
  Gitea layout kept as a commented alternative.
- README / docs/OPERATIONS.md / CLAUDE.md / CI comments + release description:
  both locations keep being published (release + release:gitea).
- Version 0.1.1 (the tag gate refuses v* tags whose version != __version__);
  tests compare against __version__ instead of a literal. No agent change.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1

.gitlab-ci.yml

@@ -8,6 +8,10 @@
 #
 # CI/CD variables (project or group level):
 #   GITEA_TOKEN   — Gitea API token (write:repository) for `release:gitea`; without it the job is manual
+#
+# Release assets are published to BOTH the GitLab generic package registry (the installer's primary
+# source — the project is public; gitea.cbs.tikali.net is split-horizon inside the estate, cbs/iac#102)
+# and the Gitea mirror release (`install.sh --source gitea`, off-estate).
 #   GITLAB_TRANSLATE_TOKEN — used by the translate-docs component (group level)
 
 include:
@@ -139,7 +143,8 @@ package:
       dotenv: build.env
     expire_in: 90 days
 
-# --- GitLab release (v* tags): generic package registry + release with asset links -------------
+# --- GitLab release (v* tags): generic package registry (the PRIMARY download) + release ---------
+# install.sh / the ansible role fetch ${CI_API_V4_URL}/projects/69/packages/generic/monky-deployd/<ver>/...
 release:
   stage: release
   image:
@@ -155,15 +160,15 @@ release:
     - 'DEB=$(basename dist/*.deb)'
     - >-
       release-cli create --name "monky-deployd $CI_COMMIT_TAG" --tag-name "$CI_COMMIT_TAG"
-      --description "See CHANGELOG.md. Public install assets are on the Gitea mirror: https://gitea.cbs.tikali.net/mdella/monky-deployd/releases/tag/$CI_COMMIT_TAG"
+      --description "See CHANGELOG.md. Install assets: this release's package registry links (primary; the install.sh default) and the Gitea mirror for off-estate use: https://gitea.cbs.tikali.net/mdella/monky-deployd/releases/tag/$CI_COMMIT_TAG"
       --assets-link "{\"name\":\"$DEB\",\"url\":\"$PKG/$DEB\",\"link_type\":\"package\"}"
       --assets-link "{\"name\":\"$DEB.sha256\",\"url\":\"$PKG/$DEB.sha256\",\"link_type\":\"other\"}"
       --assets-link "{\"name\":\"install.sh\",\"url\":\"$PKG/install.sh\",\"link_type\":\"other\"}"
 
-# --- Gitea release (the PUBLIC download the installer uses) ------------------------------------------
+# --- Gitea release (the off-estate alternative: install.sh --source gitea) -----------------------
-# The GitLab project is private, so install.sh fetches from the Gitea mirror
+# Same assets at https://gitea.cbs.tikali.net/mdella/monky-deployd/releases/download/v<ver>/... .
-# https://gitea.cbs.tikali.net/mdella/monky-deployd/releases/download/v<ver>/... . This job
+# Not the default: inside the estate that name is split-horizon to jump1's RED EIP (cbs/iac#102).
-# waits for the pull-mirror to carry the tag, creates the release and uploads the assets.
+# This job waits for the pull-mirror to carry the tag, creates the release and uploads the assets.
 # Automatic when GITEA_TOKEN is set; otherwise a manual, non-blocking job (docs/OPERATIONS.md
 # has the by-hand recipe).
 release:gitea:

CHANGELOG.md

@@ -1,6 +1,15 @@
 <!-- xlate:verbatim-fences -->
 # Changelog
 
+## v0.1.1 — 2026-09-05
+
+- `install.sh` / ansible role / README: the **primary download is the public GitLab project's generic
+  package registry on scm.tikali.ai** (`/api/v4/projects/69/packages/generic/monky-deployd/<ver>/…`);
+  the one-liner fetches the script from `scm.tikali.ai/…/-/raw/main/packaging/install.sh`. Inside the
+  estate `gitea.cbs.tikali.net` is split-horizon to jump1's RED EIP (no HTTP ingress), so backend
+  boxes could not fetch the artefacts (cbs/iac#102). The Gitea release stays the off-estate
+  alternative (`--source gitea` / `MONKY_DEPLOYD_SOURCE=gitea`). No agent behaviour change.
+
 ## v0.1.0 — 2026-09-05
 
 First release (MONKY-ADR-0028 §D, Reconciliation v2, Gate 1 v2).

CLAUDE.md

@@ -75,8 +75,9 @@ systemd-analyze verify packaging/systemd/*.service   # when available
 
 Bump `monky_deployd.__version__` + `pyproject.toml` + `packaging/install.sh` `DEFAULT_VERSION` +
 `CHANGELOG.md`, merge to `main`, tag `vX.Y.Z` (protected `v*`). The tag pipeline builds the `.deb`,
-publishes the GitLab release and — with `GITEA_TOKEN` — the **Gitea release** the installer
+publishes the **GitLab generic package registry + release** the installer downloads from (public
-downloads from (`docs/OPERATIONS.md` has the manual recipe). `lint` refuses a tag whose version
+project; the Gitea name is split-horizon inside the estate, cbs/iac#102) and — with `GITEA_TOKEN` —
+the **Gitea release** (`install.sh --source gitea`, off-estate; `docs/OPERATIONS.md` has the manual recipe). `lint` refuses a tag whose version
 differs from `__version__`.
 
 ## What NOT to do

README.md

@@ -21,17 +21,22 @@ An admin reveals the kit once in the console (`GET /v1/backends/{id}/agent/insta
 you the enrolment JWT and a one-time **bootstrap deploy grant**. On the box:
 
 ```sh
-curl -fsSL https://gitea.cbs.tikali.net/mdella/monky-deployd/raw/branch/main/packaging/install.sh \
+curl -fsSL https://scm.tikali.ai/tikali/applications/monky/monky-deployd/-/raw/main/packaging/install.sh \
   | sudo bash -s -- --env env-qa-02 --site cbs --enrol-jwt ./monky-host.env-qa-02.jwt < bootstrap.jwt
-#   [--transport sdk|proxy|system] [--version 0.1.0] [--laptop] [--bao-ca openbao-ca.pem]
+#   [--transport sdk|proxy|system] [--version 0.1.1] [--laptop] [--bao-ca openbao-ca.pem] [--source gitlab|gitea]
 ```
 
 `install.sh` installs `ziti-edge-tunnel` (OpenZiti `jammy` suite) and `docker-compose-plugin` if
-absent, downloads the pinned `.deb` + `.sha256` from the [Gitea release](https://gitea.cbs.tikali.net/mdella/monky-deployd/releases),
+absent, downloads the pinned `.deb` + `.sha256` from the [scm.tikali.ai generic package registry](https://scm.tikali.ai/tikali/applications/monky/monky-deployd/-/packages)
+(`https://scm.tikali.ai/api/v4/projects/69/packages/generic/monky-deployd/<ver>/monky-deployd_<ver>_amd64.deb`),
 enrols `monky-host.<env>` if the identity is missing, switches the tunneler to `run-host`,
 writes `/etc/monky-deployd/config.yaml`, grants the agent read access to the identity (ACL),
 stages the bootstrap grant (0600), enables `monky-deployd.timer`, runs one tick and deletes the
-JWT. The GitLab project is private, so **the public download is the Gitea mirror**.
+JWT. The GitLab project is **public**, so anonymous downloads work from scm.tikali.ai. Why not the
+Gitea mirror: inside the estate `gitea.cbs.tikali.net` is split-horizon to jump1's RED EIP
+(`10.10.0.175`), which has no HTTP ingress, so backend boxes cannot reach it (cbs/iac#102);
+`--source gitea` (or `MONKY_DEPLOYD_SOURCE=gitea`) keeps the
+[Gitea release](https://gitea.cbs.tikali.net/mdella/monky-deployd/releases) as the off-estate alternative.
 
 ## Transports
 
@@ -140,9 +145,10 @@ systemd-analyze verify packaging/systemd/*.service   # where systemd is availabl
 egress to github.com and pypi.org) and `package` builds the `.deb` with `nfpm` (binary from GitHub
 releases, goreleaser apt repo as fallback). Both were proven on the v0.1.0 tag pipeline and are
 blocking on `main`/tags (manual on MRs); the `.deb` always ships the SDK wheel. On a `v*` tag
-`release` uploads to the GitLab generic package registry + release, and `release:gitea` publishes
+`release` uploads to the GitLab generic package registry + release (**the primary download**, public
-the same assets on the public Gitea mirror (automatic when `GITEA_TOKEN` is set, manual otherwise
+project), and `release:gitea` publishes the same assets on the Gitea mirror (the `--source gitea`
-— see `docs/OPERATIONS.md` for the by-hand recipe).
+alternative; automatic when `GITEA_TOKEN` is set, manual otherwise — see `docs/OPERATIONS.md` for
+the by-hand recipe). Both locations keep being published.
 
 ## See also
 

ansible/roles/monky_deployd/README.md

@@ -4,7 +4,7 @@ Installs and configures [monky-deployd](https://scm.tikali.ai/tikali/application
 (the Monky backend pull agent, MONKY-ADR-0028) on a docker host that already carries an enrolled
 host identity (`roles/ziti_tunneler`, run-host mode). Skeleton for **osg1-07**; copy it there.
 
-What it does: pin + download the `.deb` from the Gitea release (sha256 verified) → ACL
+What it does: pin + download the `.deb` from the scm.tikali.ai package registry (sha256 verified; `monky_deployd_base_url`/`_deb_url` switch to the Gitea release off-estate) → ACL
 `u:monky-deployd:r` on the identity (`rx` on the dir) → `/etc/monky-deployd/config.yaml` from the
 template → optional openbao-ca PEM → optional `monky-deployd-proxy.service` (`transport: proxy`)
 → the **one-time bootstrap deploy grant** from a vault var (0600, `no_log`) → `monky-deployd.timer`
@@ -14,7 +14,7 @@ template → optional openbao-ca PEM → optional `monky-deployd-proxy.service`
 
 | var | note |
 |---|---|
-| `monky_deployd_version` | pinned release, e.g. `0.1.0` |
+| `monky_deployd_version` | pinned release, e.g. `0.1.1` |
 | `monky_deployd_env_id` / `_site` / `_transport` | per host (`env-dev-06`, `cbs`, `sdk`) |
 | `monky_deployd_bootstrap_grant` | tenancy-minted deploy grant (1 h) — `ansible-vault` or a lookup at play time; empty keeps the existing token |
 | `monky_deployd_bao_ca_pem` | the `openbao-ca` certificate (PEM) |

ansible/roles/monky_deployd/defaults/main.yml

@@ -1,10 +1,15 @@
 ---
 # monky_deployd — install and configure the Monky backend pull agent (MONKY-ADR-0028 §D).
 # Copy this role into osg1-07 (roles/monky_deployd) and roll to env-dev-06..09 after the pilot.
-monky_deployd_version: "0.1.0"
+monky_deployd_version: "0.1.1"
-monky_deployd_base_url: "https://gitea.cbs.tikali.net/mdella/monky-deployd"
 monky_deployd_deb: "monky-deployd_{{ monky_deployd_version }}_amd64.deb"
-monky_deployd_deb_url: "{{ monky_deployd_base_url }}/releases/download/v{{ monky_deployd_version }}/{{ monky_deployd_deb }}"
+# PRIMARY download = the public GitLab project's generic package registry on scm.tikali.ai. Inside the
+# estate gitea.cbs.tikali.net is split-horizon to jump1's RED EIP (10.10.0.175, no HTTP ingress), so
+# backend boxes cannot fetch from the Gitea mirror (cbs/iac#102). Off-estate alternative (Gitea release):
+#   monky_deployd_base_url: "https://gitea.cbs.tikali.net/mdella/monky-deployd"
+#   monky_deployd_deb_url: "{{ monky_deployd_base_url }}/releases/download/v{{ monky_deployd_version }}/{{ monky_deployd_deb }}"
+monky_deployd_base_url: "https://scm.tikali.ai/api/v4/projects/69/packages/generic/monky-deployd"
+monky_deployd_deb_url: "{{ monky_deployd_base_url }}/{{ monky_deployd_version }}/{{ monky_deployd_deb }}"
 monky_deployd_deb_sha256_url: "{{ monky_deployd_deb_url }}.sha256"
 
 # per host (inventory / host_vars)

ansible/roles/monky_deployd/tasks/main.yml

@@ -22,7 +22,7 @@
   changed_when: false
   failed_when: false
 
-- name: monky_deployd | download .deb + sha256 from the Gitea release
+- name: monky_deployd | download .deb + sha256 from the scm.tikali.ai package registry
   when: monky_deployd_installed.stdout != monky_deployd_version
   block:
     - name: monky_deployd | fetch sha256

config.example.yaml

@@ -1,4 +1,4 @@
-# /etc/monky-deployd/config.yaml — monky-deployd v0.1.0 (MONKY-ADR-0028 §D)
+# /etc/monky-deployd/config.yaml — monky-deployd v0.1.1 (MONKY-ADR-0028 §D)
 # Written by packaging/install.sh (or the ansible role monky_deployd). YAML *subset*: maps, scalars,
 # simple lists, comments. Keys not listed here are a config error.
 

docs/OPERATIONS.md

@@ -86,6 +86,17 @@ the picker, nothing is retired automatically.
 `docker image prune -f` after a successful apply. The state dir and the token survive `apt remove`;
 `apt purge` deletes them.
 
+## Where the installer downloads from
+
+The primary source is the **scm.tikali.ai generic package registry** of this (public) project:
+`https://scm.tikali.ai/api/v4/projects/69/packages/generic/monky-deployd/<ver>/<file>` for
+`monky-deployd_<ver>_amd64.deb`, `.sha256` and `install.sh`; the one-liner fetches the script from
+`https://scm.tikali.ai/tikali/applications/monky/monky-deployd/-/raw/main/packaging/install.sh`.
+Inside the estate `gitea.cbs.tikali.net` is split-horizon to jump1's RED EIP (`10.10.0.175`), which
+has no HTTP ingress, so backend boxes cannot fetch from the Gitea mirror (cbs/iac#102). Off-estate,
+`install.sh --source gitea` (ansible: `monky_deployd_base_url`/`_deb_url`) uses the Gitea release
+instead. The tag pipeline publishes to both (`release`, `release:gitea`).
+
 ## Publishing a release to Gitea by hand
 
 When `release:gitea` is manual (no `GITEA_TOKEN` in CI) — from jump1 with the Gitea API token:
@@ -100,10 +111,10 @@ for f in monky-deployd_0.1.0_amd64.deb monky-deployd_0.1.0_amd64.deb.sha256 inst
 ```
 
 The assets are then at `https://gitea.cbs.tikali.net/mdella/monky-deployd/releases/download/v0.1.0/<file>`,
-which is what `install.sh` fetches (GitLab artifacts from the tag pipeline's `package` job).
+which is what `install.sh --source gitea` fetches (GitLab artifacts from the tag pipeline's `package` job).
 
 ## Ansible (osg1-07)
 
-`ansible/roles/monky_deployd/` is the role skeleton to copy into osg1-07: `.deb` from the Gitea
+`ansible/roles/monky_deployd/` is the role skeleton to copy into osg1-07: `.deb` from the
-release (sha256-verified), config template, bootstrap grant from a vault var, ACL on the identity,
+scm.tikali.ai package registry (sha256-verified), config template, bootstrap grant from a vault var, ACL on the identity,
 timer, one tick. Rolled to env-dev-06..09 after the env-qa-02 pilot; env-dev-01 last.

monky_deployd/__init__.py

@@ -4,4 +4,4 @@ Dials monky-tenancy over the mesh with the box's host identity, fetches the rend
 leases a deploy grant, logs in to OpenBao, reads its own secrets, runs `docker compose`,
 reports. Stdlib only; the optional `openziti` SDK is the `sdk` transport."""
 
-__version__ = "0.1.0"
+__version__ = "0.1.1"

packaging/install.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 # monky-deployd installer — Ubuntu 26.04 (verified target).
 #
-#   curl -fsSL https://gitea.cbs.tikali.net/mdella/monky-deployd/raw/branch/main/packaging/install.sh \
+#   curl -fsSL https://scm.tikali.ai/tikali/applications/monky/monky-deployd/-/raw/main/packaging/install.sh \
-#     | sudo bash -s -- --env env-qa-02 --site cbs [--transport sdk|proxy|system] [--version 0.1.0] \
+#     | sudo bash -s -- --env env-qa-02 --site cbs [--transport sdk|proxy|system] [--version 0.1.1] \
-#     [--enrol-jwt /path/monky-host.env-qa-02.jwt] [--laptop] < bootstrap.jwt
+#     [--enrol-jwt /path/monky-host.env-qa-02.jwt] [--laptop] [--source gitlab|gitea] < bootstrap.jwt
 #
 # stdin (or --bootstrap-file): the ONE-TIME bootstrap deploy grant from the install kit
 # (GET /v1/backends/{id}/agent/install). The enrolment JWT is read from --enrol-jwt or
@@ -11,7 +11,8 @@
 #
 # What it does (idempotent):
 #   1. apt: ziti-edge-tunnel (OpenZiti `jammy` suite) if absent, docker-compose-plugin, acl
-#   2. downloads the pinned monky-deployd_<ver>_amd64.deb + .sha256 from the Gitea release, verifies, installs
+#   2. downloads the pinned monky-deployd_<ver>_amd64.deb + .sha256 from the scm.tikali.ai package registry
+#      (--source gitea: the Gitea release, off-estate), verifies, installs
 #   3. enrols /opt/openziti/etc/identities/monky-host.<env>.json if absent (ziti-edge-tunnel enroll),
 #      chown ziti:ziti 0600, switches ziti-edge-tunnel.service to `run-host` via a drop-in
 #   4. writes /etc/monky-deployd/config.yaml, ACLs so user monky-deployd can read the identity,
@@ -20,8 +21,16 @@
 set -euo pipefail
 umask 077
 
-DEFAULT_VERSION="0.1.0"
+DEFAULT_VERSION="0.1.1"
-BASE_URL="${MONKY_DEPLOYD_BASE_URL:-https://gitea.cbs.tikali.net/mdella/monky-deployd}"
+# Download source. PRIMARY is the public GitLab project's generic package registry on scm.tikali.ai:
+# inside the estate gitea.cbs.tikali.net is split-horizon to jump1's RED EIP (10.10.0.175), which has
+# no HTTP ingress, so backend boxes cannot reach the Gitea mirror (cbs/iac#102); scm.tikali.ai they can.
+# `--source gitea` keeps the Gitea release as the off-estate alternative. --base-url / MONKY_DEPLOYD_BASE_URL
+# override the base for whichever layout is selected.
+GITLAB_BASE_URL="https://scm.tikali.ai/api/v4/projects/69/packages/generic/monky-deployd"
+GITEA_BASE_URL="https://gitea.cbs.tikali.net/mdella/monky-deployd"
+SOURCE="${MONKY_DEPLOYD_SOURCE:-gitlab}"
+BASE_URL="${MONKY_DEPLOYD_BASE_URL:-}"
 OPENZITI_SUITE="${OPENZITI_SUITE:-jammy}"
 IDENTITY_DIR="/opt/openziti/etc/identities"
 ETC="/etc/monky-deployd"
@@ -41,6 +50,7 @@ while [ $# -gt 0 ]; do
     --bootstrap-file) BOOTSTRAP_FILE="$2"; shift 2 ;;
     --bao-ca) BAO_CA="$2"; shift 2 ;;
     --base-url) BASE_URL="$2"; shift 2 ;;
+    --source) SOURCE="$2"; shift 2 ;;
     --laptop) LAPTOP="true"; shift ;;
     --no-run) NO_RUN=1; shift ;;
     --force-config) FORCE_CONFIG=1; shift ;;
@@ -56,6 +66,7 @@ done
 SITE="${SITE,,}"
 [[ "$SITE" =~ ^(cbs|pdx)$ ]] || die "site must be cbs|pdx"
 [[ "$TRANSPORT" =~ ^(sdk|proxy|system)$ ]] || die "transport must be sdk|proxy|system"
+[[ "$SOURCE" =~ ^(gitlab|gitea)$ ]] || die "source must be gitlab|gitea"
 IDENTITY="$IDENTITY_DIR/monky-host.$ENV_ID.json"
 export DEBIAN_FRONTEND=noninteractive
 
@@ -98,7 +109,11 @@ if [ "$installed" = "$VERSION" ]; then
 else
   tmp="$(mktemp -d)"; trap 'rm -rf "$tmp"' EXIT
   deb="monky-deployd_${VERSION}_amd64.deb"
-  url="$BASE_URL/releases/download/v${VERSION}"
+  if [ "$SOURCE" = gitlab ]; then
+    url="${BASE_URL:-$GITLAB_BASE_URL}/${VERSION}"
+  else
+    url="${BASE_URL:-$GITEA_BASE_URL}/releases/download/v${VERSION}"
+  fi
   log "downloading $deb from $url"
   curl -fsSL -o "$tmp/$deb" "$url/$deb"
   curl -fsSL -o "$tmp/$deb.sha256" "$url/$deb.sha256"

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "monky-deployd"
-version = "0.1.0"
+version = "0.1.1"
 description = "Monky backend pull agent: checkin -> bundle -> lease -> OpenBao -> docker compose -> report, over the ziti mesh (MONKY-ADR-0028)"
 readme = "README.md"
 requires-python = ">=3.12"

tests/test_agent.py

@@ -7,6 +7,7 @@ import os
 import time
 from pathlib import Path
 
+from monky_deployd import __version__
 from monky_deployd import state as statemod
 from monky_deployd.agent import EX_ENV_MISMATCH, EX_FAIL, EX_OK, EX_TEMPFAIL, Agent
 from monky_deployd.bundle import bundle_sha
@@ -24,7 +25,7 @@ def test_first_tick_bootstraps_applies_and_reports(bootstrapped, tenancy, bao, f
     assert not Path(cfg.bootstrap_path).exists()
     assert cfg.token_path.exists() and (cfg.token_path.stat().st_mode & 0o777) == 0o600
     # protocol: checkin -> bundle -> lease -> report applied
-    assert tenancy.checkins[0]["env_id"] == ENV and tenancy.checkins[0]["agent_version"] == "0.1.0"
+    assert tenancy.checkins[0]["env_id"] == ENV and tenancy.checkins[0]["agent_version"] == __version__
     assert tenancy.checkins[0]["host"]["docker"] == "28.3.0"
     assert len(tenancy.leases) == 1 and tenancy.leases[0]["reason"] == "apply"
     assert [r["result"] for r in tenancy.reports] == ["applied"]

tests/test_cli.py

@@ -1,7 +1,7 @@
 import json
 from pathlib import Path
 
-from monky_deployd import cli
+from monky_deployd import __version__, cli
 from monky_deployd.agent import EX_OK
 
 
@@ -49,7 +49,7 @@ def test_bootstrap_command(bootstrapped, bao, capsys):
 
 def test_version_and_bad_config(capsys, tmp_path):
     assert cli.main(["version"]) == 0
-    assert capsys.readouterr().out.strip() == "0.1.0"
+    assert capsys.readouterr().out.strip() == __version__
     bad = tmp_path / "c.yaml"
     bad.write_text("env_id: nope\nsite: cbs\n")
     assert cli.main(["-c", str(bad), "status"]) == 78