smesh-deploy

Deploys smesh frontend assets to a running orly server. Bundles the asset directory as tar.xz -9, signs the bundle hash with BIP-340, uploads in 512 KB chunks, and the server does an atomic symlink pivot to the new version.

Prerequisites

• xz installed on both client and server
• A deploy nsec (bech32-encoded Nostr secret key)
• The server must have the corresponding hex pubkey set in ORLY_DEPLOY_PUBKEY
• The server must be running in disk mode (ORLY_SMESH3_DIR set)

Usage

go run ./cmd/sm3sh-deploy --url https://smesh.lol --dir app/smesh3

Flags

Flag	Default	Description
--url	(required)	smesh base URL
--dir	app/smesh3	directory to bundle
--nsec		deploy nsec (bech32)

Environment

Variable	Description
DEPLOY_NSEC	Fallback for --nsec flag. Store in ~/.config/smesh-deploy.env or equivalent.

How it works

Client (cmd/sm3sh-deploy/main.go)

1. Walks --dir, creates an in-memory tar archive
2. Pipes through xz -9 --stdout for compression
3. Computes SHA-256 of the compressed bundle
4. Signs the hash with BIP-340 (Schnorr over secp256k1)
5. POST /__deploy?action=begin — opens a session with hash and part count
6. POST /__deploy?action=part — uploads each 512 KB chunk
7. POST /__deploy?action=apply — sends signature in X-Sig header, triggers extraction

Server (app/deploy.go)

1. begin — creates a deploy session keyed by bundle hash
2. part — stores chunks (max 1 MB each, 50 MB total)
3. apply — reassembles chunks, verifies SHA-256 matches, verifies BIP-340 signature against ORLY_DEPLOY_PUBKEY, then:

- Decompresses with xz -d --stdout and extracts tar to a versioned directory ({dir}-{hash8}) - Creates a new symlink {dir}.new → versioned directory - Atomic rename(2) swaps the symlink into place (first deploy: renames old dir out of the way, creates symlink) - Deletes the previous version directory - Bumps the internal version counter (triggers SSE reload to all connected clients)

Server config

Set ORLY_DEPLOY_PUBKEY to the 64-char hex x-only pubkey. The client prints its pubkey on startup.