Skip to content

Document deploying the git-ignored aegis sample artifact #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ErenAri merged 1 commit into from
Jun 19, 2026
Merged

Document deploying the git-ignored aegis sample artifact #17

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions docs/hetzner-runbook.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,29 @@ export HETZNER_HOST=<server-ip>
make hetzner-bootstrap-vm
```

## 1b) Install the "Try our aegis sample" artifact

The empty-state **"Try our aegis sample"** button serves
`examples/aegis-live/aegis.bpf.o`. That object is **git-ignored** (we never
commit built `.bpf.o`s), so a fresh checkout does not contain it and the
`/api/v1/sample/aegis/artifact` endpoint 404s until you copy it out-of-band.

Copy the sample to a path that survives re-provisioning (the state dir is not
wiped by re-clones) and point the server at it via `BPFCOMPAT_SAMPLE_ARTIFACT`:

```bash
scp examples/aegis-live/aegis.bpf.o \
root@$HETZNER_HOST:/var/lib/bpfcompat-demo/sample-aegis.bpf.o
ssh root@$HETZNER_HOST '
chown bpfcompat-demo:bpfcompat-demo /var/lib/bpfcompat-demo/sample-aegis.bpf.o
chmod 0644 /var/lib/bpfcompat-demo/sample-aegis.bpf.o
grep -q "^BPFCOMPAT_SAMPLE_ARTIFACT=" /etc/bpfcompat/serve.env \
&& sed -i "s|^BPFCOMPAT_SAMPLE_ARTIFACT=.*|BPFCOMPAT_SAMPLE_ARTIFACT=/var/lib/bpfcompat-demo/sample-aegis.bpf.o|" /etc/bpfcompat/serve.env \
|| echo "BPFCOMPAT_SAMPLE_ARTIFACT=/var/lib/bpfcompat-demo/sample-aegis.bpf.o" >> /etc/bpfcompat/serve.env'
```

(If the unit is already running, `systemctl restart bpfcompat-serve` after.)

## 2) Set the write key and start the demo server

The server binds `127.0.0.1:8080` only. Anonymous visitors may validate and read
Expand Down
6 changes: 6 additions & 0 deletions packaging/systemd/bpfcompat-serve.env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,12 @@ BPFCOMPAT_API_REDACT_RUNTIME_DETAILS=true
# Do not mirror demo runs into a cloud registry.
BPFCOMPAT_API_AUTO_SYNC_REGISTRY=false

# Path to the bundled "Try our aegis sample" artifact. The default
# (examples/aegis-live/aegis.bpf.o, relative to WorkingDirectory) is git-ignored,
# so on a fresh deployment copy the object out-of-band and point this at it (see
# docs/hetzner-runbook.md step 1b). Leave unset to use the in-repo default.
BPFCOMPAT_SAMPLE_ARTIFACT=/var/lib/bpfcompat-demo/sample-aegis.bpf.o

# Note: the run tree location is set via the --workdir flag in the unit's
# ExecStart (/var/lib/bpfcompat-demo), not an env var. .bpfcompat/runs/** under
# it holds per-run SSH keys, so it must stay inside the state dir only.