# Seedbox Command Center

A unified, mobile-first command and observability layer for private tracker seedbox operations. See [PROJECT.md](PROJECT.md) for the full architectural specification.

> **Current status:** Phase 0 — foundation only. The dashboard, integrations, intelligence features, and conversational layer arrive in subsequent phases per [PROJECT.md §9](PROJECT.md). See [PHASES.md](PHASES.md) for the full forward plan; per-phase briefs are in `CLAUDE-phase1.md` through `CLAUDE-phase15.md`.

## What Phase 0 delivers

- A Go module (`github.com/operator/command-center`) with the directory layout the rest of the project will populate.
- A single static binary that boots, reads its config, opens SQLite + DuckDB, and serves HTTP on the Tailscale interface (with a `dev_mode` fallback for development).
- Structured logging (zerolog) with credential redaction verified by tests.
- An age-based secrets primitive (`internal/secrets`) with round-trip-tested encryption.
- A config-as-code loader (`internal/config`) with schema validation and fsnotify hot reload.
- A health endpoint (`GET /api/system/health`) and a system events endpoint (`GET /api/system/events`).
- A Vite + React + TypeScript + Tailwind + shadcn/ui frontend skeleton with a valid PWA manifest, embedded into the Go binary via `go:embed`.
- A systemd unit (`systemd/command-center.service`) configured for auto-restart with rate limiting.

Phase 0 is foundation only — there are no user-facing features yet.

## Quick start (development)

Prerequisites: Go 1.22+, Node.js 20+, a C compiler if you want a full DuckDB build (omit DuckDB with `-tags no_duckdb` if you don't).

```bash
./scripts/dev.sh
```

This builds the frontend, stages it into the embed path, and runs the Go binary with `./config/system.yaml` (which has `dev_mode: true`).

Open https://127.0.0.1:8443/ to see "Hello Command Center" and the live `/api/system/health` payload.

## Production deployment

See [DEPLOYMENT.md](DEPLOYMENT.md) for the full operator-runnable install steps.

## Layout

```
cmd/command-center/         # Single binary entry point (main package)
internal/
  config/                   # YAML loader, schema, fsnotify hot reload
  db/                       # SQLite, DuckDB, migration runner
  logging/                  # zerolog setup + credential redaction
  observability/            # health endpoint, system events
  secrets/                  # age-based encrypted secrets store
  server/                   # HTTP server, Tailscale interface binding
  webui/dist/               # Built frontend, copied here by scripts/build.sh
web/                        # Frontend source (Vite + React + TS + Tailwind)
config/                     # Default config-as-code directory
migrations/                 # SQLite numbered migrations
systemd/                    # Systemd unit file
scripts/                    # build.sh, dev.sh
embed.go                    # Module-root go:embed for migrations + webui
```

See [PROJECT.md](PROJECT.md) for the directories that subsequent phases will add.

## Verifying Phase 0

See [TESTING.md](TESTING.md) for the operator-facing verification checklist and instructions for running the automated test suite.

## Architectural decisions

Deviations from `PROJECT.md` and choices not specified there are documented in [DECISIONS.md](DECISIONS.md). Notable Phase 0 decisions:

- `modernc.org/sqlite` (pure-Go) for SQLite, `marcboeker/go-duckdb/v2` (CGO) for DuckDB.
- Chi as the HTTP router.
- A `dev_mode` config flag that lets the server bind to `127.0.0.1` when Tailscale isn't present, with production deployments setting `dev_mode: false`.
- Age identity loaded from a file path (system keyring integration deferred).

## License

Single-operator self-hosted project; license TBD by the operator.