update

scripts/create-network.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env sh
+set -eu
+NETWORK="${CORE_NETWORK:-glpi-ai-core}"
+if docker network inspect "$NETWORK" >/dev/null 2>&1; then
+  echo "Docker-Netzwerk $NETWORK existiert bereits."
+else
+  docker network create "$NETWORK" >/dev/null
+  echo "Docker-Netzwerk $NETWORK wurde angelegt."
+fi

scripts/health.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env sh
+set -eu
+AGENT_URL="${AGENT_URL:-http://127.0.0.1:9980}"
+KNOWLEDGE_URL="${KNOWLEDGE_URL:-http://127.0.0.1:9981}"
+printf 'Agent /healthz: '
+curl -fsS "$AGENT_URL/healthz" || true
+echo
+printf 'Agent /readyz: '
+curl -fsS "$AGENT_URL/readyz" || true
+echo
+printf 'Knowledge /api/health: '
+curl -fsS "$KNOWLEDGE_URL/api/health" || true
+echo

scripts/preflight-role.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env sh
+set -eu
+ROLE="${1:-}"
+case "$ROLE" in agent|knowledge|ollama|combined) ;; *) echo "Usage: $0 agent|knowledge|ollama|combined" >&2; exit 2;; esac
+DIR="$(CDPATH= cd -- "$(dirname -- "$0")/../deployments/$ROLE" && pwd)"
+ENVFILE="$DIR/.env"
+[ -f "$ENVFILE" ] || { echo "Fehlt: $ENVFILE" >&2; exit 1; }
+if grep -Eq '^[A-Z0-9_]+=CHANGE_ME' "$ENVFILE"; then
+  echo "Hinweis: CHANGE_ME-Werte vorhanden:"
+  grep -E '^[A-Z0-9_]+=CHANGE_ME' "$ENVFILE" | cut -d= -f1
+  if [ "$ROLE" = agent ] || [ "$ROLE" = combined ]; then exit 1; fi
+fi
+mkdir -p "$DIR/../../runtime/agent-data" "$DIR/../../runtime/knowledge" "$DIR/../../runtime/backups" "$DIR/../../runtime/staging" "$DIR/../../runtime/ollama"
+if command -v docker >/dev/null 2>&1; then
+  (cd "$DIR" && docker compose config >/dev/null)
+  echo "docker compose config: OK ($ROLE)"
+else
+  echo "Docker CLI nicht vorhanden; YAML wurde beim Release statisch geprüft."
+fi

scripts/secret-scan.sh

@@ -23,7 +23,11 @@ fi
 
 # Private keys and common live-token shapes must not be committed. Placeholders in
 # templates/docs are intentionally allowed.
-if grep -E '(^|/)\.env$|\.pem$|\.p12$|\.pfx$|(^|/)id_rsa$|(^|/)id_ed25519$' "$FILES" >/dev/null; then
+# Distributed deployment bundles intentionally contain three complete `.env`
+# templates. They must remain placeholder-only; every other private env/key file
+# is still forbidden.
+if grep -E '(^|/)\.env$|\.pem$|\.p12$|\.pfx$|(^|/)id_rsa$|(^|/)id_ed25519$' "$FILES" \
+    | grep -Ev '^deployments/(master|cpu-subagent|gpu-subagent|agent|knowledge|ollama|combined)/\.env$' >/dev/null; then
   bad "private environment/key material found"
 fi
 
@@ -47,6 +51,30 @@ else
   fi
 fi
 
+# Checked-in deployment .env files are templates, never live configuration.
+for envf in \
+  deployments/master/.env \
+  deployments/cpu-subagent/.env \
+  deployments/gpu-subagent/.env \
+  deployments/agent/.env \
+  deployments/knowledge/.env \
+  deployments/ollama/.env \
+  deployments/combined/.env; do
+  [ -f "$envf" ] || continue
+  if awk -F= '
+    /^[[:space:]]*#/ || NF < 2 { next }
+    {
+      key=$1; sub(/^[[:space:]]+/, "", key); sub(/[[:space:]]+$/, "", key)
+      val=$0; sub(/^[^=]*=/, "", val)
+      if (key ~ /(TOKEN|PASSWORD|SECRET|CLIENT_ID|CLIENT_SECRET|API_KEY)$/ && val != "" && val !~ /^CHANGE_ME/) {
+        print FILENAME ":" NR ": live-looking secret in " key > "/dev/stderr";
+        bad=1
+      }
+    }
+    END { exit bad ? 1 : 0 }
+  ' "$envf"; then :; else bad "deployment template contains a non-placeholder secret: $envf"; fi
+done
+
 # Reject accidental binary blobs outside explicitly expected assets.
 while IFS= read -r f; do
   [ -f "$f" ] || continue

scripts/verify-package.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env sh
+set -eu
+ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+cd "$ROOT"
+
+for f in \
+  services/agent/Dockerfile \
+  services/knowledge/Dockerfile \
+  .gitea/workflows/ci.yml \
+  .gitea/workflows/release.yml \
+  docker-bake.hcl; do
+  test -f "$f" || { echo "missing: $f" >&2; exit 1; }
+done
+
+grep -q '^FROM ' services/agent/Dockerfile
+grep -q 'AS data-init' services/agent/Dockerfile
+grep -q '^FROM ' services/knowledge/Dockerfile
+
+echo "OK: Dockerfiles and repository workflows are present."