On-prem bundle (runbook 17)

Pack on the laptop, upload, extract, one command.

tools/ops/package.sh              # local society/* images
tools/ops/package.sh --build      # rebuild first
# → dist/sis-bundle-<ts>.tar.gz + .sha256

On the target (container orchestrator + Compose v2, outbound internet for public images):

tar xzf sis-bundle-<ts>.tar.gz
cd sis-bundle-<ts>
./install.sh

install.sh containers loads, creates .env autogenerating secrets (does not clobber an existing .env), pins homes under /opt/sis/* as uid 1001, and requires an LLM destination. Idempotent.

The bundle publishes to the host only 8093 / 8094 / 8091. Datastores and internal APIs stay on the compose network. Default SOCIETY_BIND_IP=127.0.0.1.

Access, from simplest to production: SSH tunnel → bind to a private-mesh IP → HTTPS reverse-proxy in front of 127.0.0.1. Do not set 0.0.0.0 without a firewall (sis-firewall.sh on the VPS boxes).