From 07e29144a4fbcf0d5317bc14b873fa46238687e4 Mon Sep 17 00:00:00 2001
From: Jeffrey Alan Scudder <me@jas.life>
Date: Sat, 28 Mar 2026 22:28:20 -0700
Subject: [PATCH] Improve host access in devcontainer

---
 .devcontainer/config.fish       | 49 ++++++++++++++++++++++++---------
 .devcontainer/devcontainer.json | 23 +++++++++-------
 lith/.env.example               |  7 +++++
 lith/README.md                  | 24 ++++++++++++++++
 4 files changed, 80 insertions(+), 23 deletions(-)
 create mode 100644 lith/.env.example
 create mode 100644 lith/README.md

diff --git a/.devcontainer/config.fish b/.devcontainer/config.fish
index 05559df0c..c6326e505 100644
--- a/.devcontainer/config.fish
+++ b/.devcontainer/config.fish
@@ -3208,16 +3208,35 @@ function ac-ableton-tunnel-simple --description "Simple UDP listener (run on Mac
     echo "   nc -lu 7777 | while read line; do echo \"\$(date '+%H:%M:%S') \$line\"; done"
 end
 
-# 🖥️ Machine Info / SSH Helpers
-# Read machine configs from vault/machines.json
-
-function ac-host --description "Show current host SSH config from machines.json"
-    set -l machines_file "/workspaces/aesthetic-computer/aesthetic-computer-vault/machines.json"
-    
-    if not test -f $machines_file
-        echo "❌ machines.json not found at $machines_file"
-        return 1
-    end
+# 🖥️ Machine Info / SSH Helpers
+# Read machine configs from vault/machines.json
+
+function __ac_machines_file --description "Resolve machines.json with local cache fallback"
+    set -l machines_file "/workspaces/aesthetic-computer/aesthetic-computer-vault/machines.json"
+    set -l machines_cache "$HOME/.cache/ac/machines.json"
+
+    if test -f $machines_file
+        mkdir -p (dirname $machines_cache)
+        cp $machines_file $machines_cache 2>/dev/null
+        echo $machines_file
+        return 0
+    end
+
+    if test -f $machines_cache
+        echo $machines_cache
+        return 0
+    end
+
+    return 1
+end
+
+function ac-host --description "Show current host SSH config from machines.json"
+    set -l machines_file (__ac_machines_file)
+
+    if test $status -ne 0 -o -z "$machines_file"
+        echo "❌ machines.json not found in vault or local cache"
+        return 1
+    end
     
     set -l machine_key $argv[1]
     
@@ -3320,9 +3339,13 @@ function ac-machines --description "List all machines from vault/machines.json"
     ac-host
 end
 
-function ac-host-nmap --description "Run nmap scan on local network via current host"
-    set -l machines_file "/workspaces/aesthetic-computer/aesthetic-computer-vault/machines.json"
-    set -l search_term $argv[1]
+function ac-host-nmap --description "Run nmap scan on local network via current host"
+    set -l machines_file (__ac_machines_file)
+    if test $status -ne 0 -o -z "$machines_file"
+        echo "❌ machines.json not found in vault or local cache"
+        return 1
+    end
+    set -l search_term $argv[1]
 
     set -l hosts_to_try (jq -r '
         .machines
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 45939d1b3..84a3a2950 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -248,16 +248,19 @@
   //
   // --tmpfs: In-memory /tmp for faster temp file operations
   //
-  // --ulimit nofile: Raise open file limit for Vite's many watchers
-  //
-  // NOTE: Explicit -p port mappings removed - forwardPorts handles this
-  //       and avoids "port already in use" errors on restart
-  "runArgs": [
-    "-v", "/tmp/.X11-unix:/tmp/.X11-unix",
-    "-q",
-    "--cap-add=SYS_PTRACE",
-    "--security-opt=apparmor=unconfined",
-    "--security-opt", "label:disable",
+  // --ulimit nofile: Raise open file limit for Vite's many watchers
+  // --add-host: Force Docker host alias inside the container
+  //             Needed when Docker Desktop doesn't inject host.docker.internal
+  //
+  // NOTE: Explicit -p port mappings removed - forwardPorts handles this
+  //       and avoids "port already in use" errors on restart
+  "runArgs": [
+    "-v", "/tmp/.X11-unix:/tmp/.X11-unix",
+    "-q",
+    "--add-host=host.docker.internal:host-gateway",
+    "--cap-add=SYS_PTRACE",
+    "--security-opt=apparmor=unconfined",
+    "--security-opt", "label:disable",
     "--name", "aesthetic",
     "--hostname", "aesthetic",
     "--init",
diff --git a/lith/.env.example b/lith/.env.example
new file mode 100644
index 000000000..4e71e685d
--- /dev/null
+++ b/lith/.env.example
@@ -0,0 +1,7 @@
+# Production monolith env for lith deploys.
+# This file is copied to /opt/ac/system/.env on the remote host.
+
+NODE_ENV=production
+CONTEXT=production
+PORT=8888
+DEPLOY_SECRET=replace-with-production-secret
diff --git a/lith/README.md b/lith/README.md
new file mode 100644
index 000000000..edc033768
--- /dev/null
+++ b/lith/README.md
@@ -0,0 +1,24 @@
+# lith
+
+Secrets and runtime env for the Aesthetic Computer monolith deploy.
+
+`lith/deploy.fish` expects:
+- `aesthetic-computer-vault/lith/.env`
+
+That file is uploaded to:
+- `/opt/ac/system/.env`
+
+Why `system/.env` on the server:
+- [`lith.service`](/workspaces/aesthetic-computer/lith/lith.service) uses `EnvironmentFile=/opt/ac/system/.env`
+- The monolith serves the main site and API from the shared `system/` tree
+
+Minimum required keys:
+- `NODE_ENV=production`
+- `CONTEXT=production`
+- `DEPLOY_SECRET=...`
+
+Recommended workflow:
+1. Copy `.env.example` to `.env`
+2. Fill in the real production values
+3. Re-run `fish vault-tool.fish status` to confirm `lith/.env` is tracked
+4. Deploy with `fish /workspaces/aesthetic-computer/lith/deploy.fish`
-- 
2.51.2