feat: add deployer host installer (#22)

deploy/deployer/ci-fleet-deployer-cleanup.service

@@ -0,0 +1,19 @@
+[Unit]
+Description=Run application-owned scoped deployer cleanup
+After=docker.service
+Wants=docker.service
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/opt/ci-fleet-deployer/current/scripts/deployer-runtime.sh cleanup
+Environment=CI_FLEET_DEPLOYER_CONFIG=/var/lib/ci-fleet-deployer/active-policy.conf
+TimeoutStartSec=15min
+UMask=0077
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectHome=yes
+ProtectSystem=strict
+ReadOnlyPaths=/etc/ci-fleet-deployer /opt/ci-fleet-deployer
+ReadWritePaths=/var/lib/ci-fleet-deployer /var/log/ci-fleet-deployer /var/lock/ci-fleet-deployer /run/docker.sock
+RestrictSUIDSGID=yes

deploy/deployer/ci-fleet-deployer-cleanup.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Run scoped ci-fleet deployer cleanup daily
+
+[Timer]
+OnCalendar=daily
+RandomizedDelaySec=15min
+Persistent=true
+Unit=ci-fleet-deployer-cleanup.service
+
+[Install]
+WantedBy=timers.target

deploy/deployer/ci-fleet-deployer-drain.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Drain the ci-fleet deployer before maintenance
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/opt/ci-fleet-deployer/current/scripts/deployer-runtime.sh drain
+Environment=CI_FLEET_DEPLOYER_CONFIG=/var/lib/ci-fleet-deployer/active-policy.conf
+TimeoutStartSec=2min
+UMask=0077
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectHome=yes
+ProtectSystem=strict
+ReadOnlyPaths=/etc/ci-fleet-deployer /opt/ci-fleet-deployer
+ReadWritePaths=/var/lib/ci-fleet-deployer /var/log/ci-fleet-deployer /var/lock/ci-fleet-deployer
+RestrictSUIDSGID=yes

deploy/deployer/ci-fleet-deployer-health.service

@@ -0,0 +1,19 @@
+[Unit]
+Description=Check ci-fleet deployer health
+After=docker.service
+Wants=docker.service
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/opt/ci-fleet-deployer/current/scripts/deployer-runtime.sh health
+Environment=CI_FLEET_DEPLOYER_CONFIG=/var/lib/ci-fleet-deployer/active-policy.conf
+TimeoutStartSec=2min
+UMask=0077
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectHome=yes
+ProtectSystem=strict
+ReadOnlyPaths=/etc/ci-fleet-deployer /opt/ci-fleet-deployer
+ReadWritePaths=/var/lib/ci-fleet-deployer /var/log/ci-fleet-deployer /var/lock/ci-fleet-deployer /run/docker.sock
+RestrictSUIDSGID=yes

deploy/deployer/ci-fleet-deployer-health.timer

@@ -0,0 +1,12 @@
+[Unit]
+Description=Check ci-fleet deployer health every five minutes
+
+[Timer]
+OnActiveSec=2min
+OnUnitActiveSec=5min
+RandomizedDelaySec=30s
+Persistent=true
+Unit=ci-fleet-deployer-health.service
+
+[Install]
+WantedBy=timers.target

deploy/deployer/ci-fleet-deployer.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=Run one approved ci-fleet deployment
+After=docker.service network-online.target
+Wants=docker.service network-online.target
+
+[Service]
+Type=oneshot
+User=root
+Group=root
+ExecStart=/opt/ci-fleet-deployer/current/scripts/deployer-runtime.sh deploy
+Environment=CI_FLEET_DEPLOYER_CONFIG=/var/lib/ci-fleet-deployer/active-policy.conf
+Environment=CI_FLEET_DEPLOYER_REQUEST=/var/lib/ci-fleet-deployer/request.conf
+TimeoutStartSec=45min
+# A hung adapter must not hold the lock or inhibitor beyond the documented
+# 45-minute deployment bound; stop quickly after TERM and let KILL follow.
+TimeoutStopSec=30s
+UMask=0077
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectHome=yes
+ProtectSystem=strict
+ReadOnlyPaths=/etc/ci-fleet-deployer /opt/ci-fleet-deployer
+ReadWritePaths=/var/lib/ci-fleet-deployer /var/log/ci-fleet-deployer /var/lock/ci-fleet-deployer /run/docker.sock
+RestrictSUIDSGID=yes
+LockPersonality=yes

docs/README.md

@@ -21,6 +21,7 @@ New operator? Follow the [Quickstart](QUICKSTART.md): what ci-fleet does, instal
 | Make a project compliant | [Project CI standard](PROJECT-STANDARD.md) and [compliance checklist](COMPLIANCE-CHECKLIST.md) |
 | Split tests across parallel workers | [Project CI standard](PROJECT-STANDARD.md) and the [parallel workflow example](../examples/workflows/parallel-ci.yml.example) |
 | Configure automatic updates and cleanup | [Host maintenance](HOST-MAINTENANCE.md) |
+| Install or operate a dedicated deployment host | [Deployer host installation](DEPLOYER-HOST.md) |
 | Monitor hosts and detect missed reports | [Fleet health monitoring](HEALTH-MONITORING.md) and [authenticated status reporting](STATUS-REPORTING.md) |
 | Handle GitHub App, workflow, or deployment secrets | [Secrets model](SECRETS.md) and [security policy](../SECURITY.md) |
 | Review accepted implementation scope | [Design decisions](DESIGN-DECISIONS.md) |
@@ -42,6 +43,7 @@ New operator? Follow the [Quickstart](QUICKSTART.md): what ci-fleet does, instal
 | Test shard | One bounded slice of a larger test suite, designed to run independently and usually finish within five minutes. |
 | Private delivery configuration | Repository allowlists, logical controllers, capacity budgets, environment policy, and required secret names kept in a private but secret-free repository. |
 | Desired state | A reviewed schema-v3 declaration of runner pools and logical controllers stored in a private, secret-free Git repository. |
+| Deployer host | A dedicated non-runner Linux host that applies exact-head approved immutable artifacts through application-owned deployment logic. |
 
 ## Design and boundaries
 
@@ -72,6 +74,7 @@ These pages are normative for compatible projects and hosts:
 - [Run the live pilot](LIVE-PILOT.md)
 - [Add a host](ADDING-A-HOST.md)
 - [Install, adopt, check, upgrade, roll back, or remove a controller](DESIRED-STATE.md)
+- [Install, check, repair, upgrade, drain, roll back, or remove a deployer](DEPLOYER-HOST.md)
 - [Add a project](ADDING-A-PROJECT.md)
 - [Deploy the current experimental prototype](DEPLOYMENT-PROTOTYPE.md)
 - [Maintain, drain, clean, update, and reboot hosts](HOST-MAINTENANCE.md)