Agent host: SilverBullet serves the vault as its one space, behind Authelia

The operator chose single-space mode: the vault is mounted at /data, with
memory/ read-only over it, and there are no accounts or setup wizard;
Authelia in the operator's Caddy is the login. SB_NAME forces the mode, so
an empty vault can't boot the wizard. SilverBullet's own data folder is
gone. check now fails if the wizard could be open. The README says how to
make memory/ writable for a while and back.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

tests/deploy/test_agent_host.py

@@ -46,12 +46,14 @@ def test_the_agents_memory_is_read_only_and_the_rest_of_the_vault_is_not() -> No
     assert sorted(others) == [VAULT, f"{VAULT}/memory"]
 
 
-def test_it_sees_nothing_of_the_host_but_the_vault_and_its_own_data() -> None:
-    assert sorted(source for source, _, _ in mounts()) == [
-        "/srv/nisse/silverbullet",
-        VAULT,
-        f"{VAULT}/memory",
-    ]
+def test_it_sees_nothing_of_the_host_but_the_vault() -> None:
+    assert sorted(source for source, _, _ in mounts()) == [VAULT, f"{VAULT}/memory"]
+
+
+def test_the_vault_is_its_space() -> None:
+    # One space, the vault, at the data folder: no accounts or settings of its
+    # own outside the vault.
+    assert (VAULT, "/data", "rw") in mounts()
 
 
 def test_the_image_is_pinned_to_a_release() -> None:
@@ -67,10 +69,13 @@ def test_no_secrets_in_the_compose_file() -> None:
     assert not [k for k in environment if re.search(r"USER|TOKEN|PASS|SECRET|KEY", k)]
 
 
-def test_it_boots_into_accounts_and_the_vault_not_a_bare_space() -> None:
-    # SB_NAME alone switched 2.11 to single-space mode: no accounts, no setup
-    # wizard, and /data served in place of the vault.
-    assert set(silverbullet()["environment"]) == {"PUID", "PGID"}
+def test_it_boots_one_space_never_the_setup_wizard() -> None:
+    # Any SB_* setting forces 2.11's single-space mode. Without one, an empty
+    # vault would boot the setup wizard, whose first visitor makes the admin.
+    environment = silverbullet()["environment"]
+    assert any(name.startswith("SB_") for name in environment)
+    # No credentials: the operator logs in through Authelia in front.
+    assert not {"SB_USER", "SB_AUTH"} & set(environment)
 
 
 def test_its_port_caddys_and_the_firewalls_agree() -> None:
@@ -127,7 +132,10 @@ SCRIPT = HOST.parents[1] / "scripts" / "agent-host.sh"
 
 
 def _fake_host(
-    tmp_path: Path, *, memory_writable: bool, boot: str = "multi-space"
+    tmp_path: Path,
+    *,
+    memory_writable: bool,
+    boot: str = "single-space (folder is not empty)",
 ) -> dict[str, str]:
     """Commands standing in for the host's: ssh runs the command here, sudo
     just runs it, and docker reads all of stdin, as docker compose exec does."""
@@ -143,7 +151,7 @@ def _fake_host(
             'case "$*" in\n'
             '  *"ps --status running"*) echo abc123 ;;\n'
             f'  *" logs "*) echo "boot mode: {boot}" ;;\n'
-            f'  *"/vault/memory/"*) exit {0 if memory_writable else 1} ;;\n'
+            f'  *"/data/memory/"*) exit {0 if memory_writable else 1} ;;\n'
             "esac"
         ),
     }
@@ -176,7 +184,7 @@ def test_the_check_runs_every_step_even_though_docker_reads_stdin(
     assert result.returncode == 0, result.stdout + result.stderr
     assert result.stdout.splitlines() == [
         "ok:   SilverBullet is running",
-        "ok:   it keeps accounts (no single-space boot)",
+        "ok:   it serves the vault as one space (no setup wizard)",
         "ok:   it answers locally (200)",
         "ok:   the operator's folders are writable",
         "ok:   memory/ is read-only to SilverBullet",
@@ -196,7 +204,9 @@ def test_a_writable_memory_folder_fails_the_check(tmp_path: Path) -> None:
     assert "all checks passed" not in result.stdout
 
 
-def test_a_single_space_boot_fails_the_check(tmp_path: Path) -> None:
-    result = _check(_fake_host(tmp_path, memory_writable=False, boot="single-space"))
+def test_a_setup_wizard_boot_fails_the_check(tmp_path: Path) -> None:
+    result = _check(_fake_host(tmp_path, memory_writable=False, boot="unconfigured"))
     assert result.returncode == 1
-    assert "FAIL: it booted a single space with no accounts" in result.stdout
+    assert (
+        "FAIL: it didn't boot one space: the setup wizard may be open" in result.stdout
+    )