# Rikaha NodeOps APT repository

This directory is the static repository root published by the release
workflow. It is served beneath the configured package endpoint:

```text
https://packages.rikaha.com/apt
```

The endpoint is intentionally independent of the source repository name. It
must use HTTPS and be configured in the GitHub repository variable
`RIKAHA_APT_BASE_URL`.

The repository has two suites:

- `canary` — explicitly selected test releases, beginning with Work02;
- `stable` — accepted releases for normal node installation and upgrades.

The release workflow publishes signed `InRelease` metadata, the detached
`Release.gpg` signature, the public archive keyring, and a fully configured
`install-rikaha-nodeops.sh` bootstrap wrapper. The private signing key is a
GitHub Actions secret and is never committed or published.

## One-time node bootstrap

After the release endpoint is live, a new Debian/Ubuntu node uses:

```bash
curl --fail --silent --show-error --location \
  https://packages.rikaha.com/apt/install-rikaha-nodeops.sh \
  | sudo bash -s -- --apply
sudo apt update
sudo apt install rikaha-nodeops
rikaha update --profile ubuntu-desktop --channel stable --apply
```

The profile layer must match the node: use `linux-headless` for lightweight
servers and VMs, `proxmox` for PVE hosts, and `ubuntu-desktop` for supported
workstations. The bootstrap script only installs the archive keyring and APT
source; it does not run `apt update` or install the package implicitly.

## Existing node upgrade

```bash
sudo apt update
sudo apt upgrade
rikaha update --profile <layer> --channel stable --apply
rikaha doctor
```

APT upgrades the universal client and packaged payload. The explicit
per-user `rikaha update` keeps home-directory mutation auditable and avoids
guessing which users or desktop preferences a system package should touch.