From e396fd650db87590c4a1c6f43eaad8113d28e436 Mon Sep 17 00:00:00 2001
From: "prompt.ac/@jeffrey" <mail@aesthetic.computer>
Date: Fri, 24 Apr 2026 14:23:55 -0700
Subject: [PATCH] lith/deploy.fish: ship DO Spaces creds for notepat build
 stream
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Decrypt aesthetic-computer-vault/spaces/.env.gpg during deploy,
scp the plaintext to /tmp/notepat-spaces.env on lith, source it for
just the build command, and remove. Keeps S3 keys off
/opt/ac/system/.env while still letting --sync-spaces push the
versioned amxd + latest.json to s3://assets-aesthetic-computer/m4l/
notepat.com/ on every deploy that triggered a rebuild.

Falls back to a build-without-sync (with a yellow warning) when the
vault file is absent or GPG can't decrypt without a passphrase
prompt — so deploys can still run in contexts where Spaces uploads
aren't required.
---
 lith/deploy.fish | 32 +++++++++++++++++++++++++++++---
 1 file changed, 29 insertions(+), 3 deletions(-)

diff --git a/lith/deploy.fish b/lith/deploy.fish
index 0c1c96727e..b8c7d45812 100644
--- a/lith/deploy.fish
+++ b/lith/deploy.fish
@@ -182,10 +182,36 @@ ssh -i $SSH_KEY $LITH_USER@$TARGET_HOST "cd $REMOTE_DIR/lith && npm install --om
 # when an amxd input actually changed since the last successful build
 # (via --if-stale), then push the versioned artifact + latest.json to
 # DO Spaces (--sync-spaces) so each release has a durable CDN URL
-# outside lith. Sourcing /opt/ac/system/.env before running picks up
-# DO_SPACES_* / AWS_* creds that lith.service already has configured.
+# outside lith.
+#
+# DO Spaces credentials live in aesthetic-computer-vault/spaces/.env
+# (canonical: spaces/.env.gpg). We decrypt locally, ship to /tmp on
+# lith for the build's lifetime, then remove — avoids storing S3 keys
+# permanently in /opt/ac/system/.env. If the vault file is missing or
+# GPG can't decrypt it, the build still runs — `--sync-spaces` just
+# gracefully skips the upload with a warning.
+set SPACES_ENV_SRC "$VAULT_DIR/spaces/.env"
+set SPACES_ENV_GPG "$VAULT_DIR/spaces/.env.gpg"
+set TMP_SPACES (mktemp)
+set SPACES_READY false
+if test -f $SPACES_ENV_SRC
+    cp $SPACES_ENV_SRC $TMP_SPACES
+    set SPACES_READY true
+else if test -f $SPACES_ENV_GPG
+    if gpg --batch --pinentry-mode loopback -d $SPACES_ENV_GPG >$TMP_SPACES 2>/dev/null
+        set SPACES_READY true
+    end
+end
+
 echo -e "$GREEN-> Refreshing notepat.com.amxd build stream...$NC"
-ssh -i $SSH_KEY $LITH_USER@$TARGET_HOST "cd $REMOTE_DIR && set -a && source system/.env 2>/dev/null || true; set +a; node ac-m4l/build-notepat.mjs --if-stale --sync-spaces"
+if test $SPACES_READY = true
+    scp -i $SSH_KEY -q $TMP_SPACES $LITH_USER@$TARGET_HOST:/tmp/notepat-spaces.env
+    ssh -i $SSH_KEY $LITH_USER@$TARGET_HOST "cd $REMOTE_DIR && set -a && . /tmp/notepat-spaces.env && set +a && node ac-m4l/build-notepat.mjs --if-stale --sync-spaces; rc=\$?; rm -f /tmp/notepat-spaces.env; exit \$rc"
+else
+    echo -e "$YELLOW   spaces creds unavailable — building without S3 sync.$NC"
+    ssh -i $SSH_KEY $LITH_USER@$TARGET_HOST "cd $REMOTE_DIR && node ac-m4l/build-notepat.mjs --if-stale"
+end
+rm -f $TMP_SPACES
 
 # Install service file + Caddy config from the deployed checkout
 echo -e "$GREEN-> Updating service + Caddy config...$NC"
-- 
2.51.2