auto: docs sync 2026-07-15T06:00:18+00:00

Files changed: credentials engine/lint-report.md vault/.obsidian/workspace.json vault/runbooks/conduit-operations.md

vault/runbooks/conduit-operations.md

@@ -8,7 +8,7 @@ related:
   - [[conduit]]
   - [[central]]
   - [[navi]]
-updated: 2026-07-14
+updated: 2026-07-15
 ---
 
 # Conduit — Operations Runbook
@@ -61,6 +61,26 @@ curl -sS -o /dev/null -w '%{http_code}\n' http://localhost:8010/up/tomtom_flow_t
 
 ---
 
+## Fresh deploy from scratch
+
+`scripts/provision.sh` (repo root) is the canonical from-scratch installer — it stands up one Conduit instance from nothing: Postgres role + database (plain Postgres, no timescaledb/postgis), generated secrets (AES-256 master key + session secret), a uv-managed venv with an editable install, schema migrations, an optional GUI operator, and (optionally) a systemd unit. It takes every name/path/port as an env var or flag — no Matt-specific values are hardcoded, so it's the same script for the live deploy and for a disposable test instance.
+
+Example (adjust for a real deploy — this example matches the throwaway shape used to prove the script works):
+
+```bash
+DB_NAME=conduit_fresh DB_ROLE=conduit_fresh \
+INSTALL_DIR=/tmp/conduit-fresh ENV_FILE=/tmp/conduit-fresh/env \
+MASTER_KEY_PATH=/tmp/conduit-fresh/master.key BIND_PORT=8011 \
+SYSTEMD=off ADMIN_USER=admin SERVICE_NAME=conduit-fresh \
+/tmp/conduit-fresh/scripts/provision.sh
+```
+
+For a real systemd-managed deploy, set `SYSTEMD=on` plus `SERVICE_NAME`/`SERVICE_USER`/`SERVICE_GROUP`/`BIND_HOST`/`BIND_PORT` to taste; the script renders, installs, enables, and starts the unit. Run `scripts/provision.sh --help` for the full parameter list.
+
+**Migrations are schema-only.** As of the `feat/provisioning` schema-only-migrations change, `003_sources.sql` creates the `sources` table but seeds no rows — a fresh install's `sources` table is empty after `conduit-migrate`. Sources (and the API keys they reference) are provisioned **after** the schema exists, via the GUI or `conduit-admin`/SQL — see "Add a pull source" and "Provision an API key" below. (The live `conduit` DB's `tomtom_flow_tiles` row predates this change and is untouched — 003 already applied there and won't re-run.)
+
+---
+
 ## Add a pull source
 
 Sources are rows in the `sources` table — there is **no hot-reload**, `app.py` loads enabled sources once at startup. Any INSERT/UPDATE/DELETE requires a `systemctl restart conduit` to take effect.