Landing page: register/download/install/onboard; Gitea hosting in deploy docs

.gitignore

@@ -1,3 +1,4 @@
 /target
 /frx-data/
 /comments.txt
+/relay.log

DEPLOY.md

@@ -47,7 +47,7 @@ Run `frxd` on loopback and terminate TLS with Caddy:
 caddy reverse-proxy --from relay.federatedsearch.org --to 127.0.0.1:7700
 ```
 
-Caddyfile equivalent (apex is the public front door, `ma.` the membership service, `relay.` the relay — all on one host):
+Caddyfile equivalent (apex is the public front door, `ma.` the membership service, `relay.` the relay, `git.` the code host — all on one host):
 
 ```
 federatedsearch.org {
@@ -61,6 +61,10 @@ ma.federatedsearch.org {
 relay.federatedsearch.org {
     reverse_proxy 127.0.0.1:7700
 }
+
+git.federatedsearch.org {
+    reverse_proxy 127.0.0.1:3000
+}
 ```
 
 Relay command (peers and registry gated by the MA):
@@ -112,6 +116,77 @@ frxd registry --dir /var/lib/frxd/registry serve --listen 127.0.0.1:7800
 
 Put the same Caddy in front, or distribute `registry.json` out of band (it is signed, so the channel does not matter). The snapshot is versioned; nodes reject rollback and fail static during outages.
 
+## Code hosting and downloads (Gitea)
+
+The public source and release binaries live at `git.federatedsearch.org` (Gitea), so the
+download step on the membership page stays on infrastructure the federation operates.
+
+One-time install on the server (root):
+
+```
+VER=1.27.3
+curl -fsSLO https://dl.gitea.com/gitea/$VER/gitea-$VER-linux-amd64{,.sha256}
+sha256sum -c gitea-$VER-linux-amd64.sha256
+install -m 0755 gitea-$VER-linux-amd64 /usr/local/bin/gitea
+adduser --system --shell /bin/bash --gecos 'Gitea' --home /home/git --group git
+mkdir -p /var/lib/gitea/{custom,data,log} /etc/gitea && chown -R git:git /var/lib/gitea /etc/gitea
+```
+
+`/etc/gitea/app.ini` essentials (rest defaults; secrets via `gitea generate secret`):
+
+```ini
+WORK_PATH = /var/lib/gitea
+
+[database]
+DB_TYPE = sqlite3
+PATH = /var/lib/gitea/data/gitea.db
+
+[server]
+DOMAIN = git.federatedsearch.org
+SSH_DOMAIN = git.federatedsearch.org
+ROOT_URL = https://git.federatedsearch.org/
+HTTP_ADDR = 127.0.0.1
+HTTP_PORT = 3000
+
+[security]
+INSTALL_LOCK = true
+
+[service]
+DISABLE_REGISTRATION = true
+REQUIRE_SIGNIN_VIEW = false
+```
+
+systemd unit (`User=git`, `ExecStart=/usr/local/bin/gitea web --config /etc/gitea/app.ini`,
+`WorkingDirectory=/var/lib/gitea`), then `gitea migrate --config /etc/gitea/app.ini` as the
+`git` user and `systemctl enable --now gitea`. Git-over-SSH uses the host sshd via the `git`
+user's Gitea-managed `authorized_keys`; HTTPS pushes can use an access token instead.
+
+Admin bootstrap (as `git` user):
+
+```
+gitea admin user create --admin --username <you> --email <you>@federatedsearch.org --random-password --config /etc/gitea/app.ini
+gitea admin user generate-access-token -u <you> -t bootstrap --scopes all --config /etc/gitea/app.ini
+```
+
+The org is `frx`, the repo `frxd` → clone URL
+`https://git.federatedsearch.org/frx/frxd.git`. Membership stays closed (signup code);
+repo reads are public.
+
+Publishing a release (from the checkout):
+
+```
+git tag v0.1.0 && git push gitea v0.1.0
+# build static binaries (see next section), then attach via the API:
+curl -X POST https://git.federatedsearch.org/api/v1/repos/frx/frxd/releases \
+  -H "Authorization: token <token>" -H 'content-type: application/json' \
+  -d '{"tag_name":"v0.1.0","name":"v0.1.0"}'
+curl -X POST https://git.federatedsearch.org/api/v1/repos/frx/frxd/releases/<id>/assets?name=frxd-linux-amd64 \
+  -H "Authorization: token <token>" -F attachment=@frxd-linux-amd64
+```
+
+Asset URLs follow `/frx/frxd/releases/download/<tag>/<file>` — the membership page pins
+those. Bump the page when a release changes.
+
 ## Private networks and custom CAs
 
 - `ca_cert = "/etc/ssl/private-ca.pem"` in `[node]`, or `--ca-cert` on the relay: adds a private/corporate root CA for relay and registry connections.
@@ -125,7 +200,15 @@ rustup target add x86_64-unknown-linux-musl
 cargo build --release --target x86_64-unknown-linux-musl
 ```
 
-`[profile.release]` enables LTO and stripping. All dependencies are pure Rust, so the musl build has no system-library requirements.
+`[profile.release]` enables LTO and stripping. All dependencies are pure Rust, so the musl build has no system-library requirements. `ring` needs a musl C toolchain (`musl-tools`); without host sudo, build in a container instead:
+
+```
+docker run --rm -v "$PWD":/src -w /src rust:1-slim-bookworm bash -c \
+  "apt-get update -qq && apt-get install -y -qq musl-tools && rustup target add x86_64-unknown-linux-musl && cargo build --release --target x86_64-unknown-linux-musl"
+```
+
+Binaries land in `target/x86_64-unknown-linux-musl/release/`; rename to
+`frxd-linux-amd64` / `frx-linux-amd64` for release assets, with `sha256sum` sidecar files.
 
 ## What TLS does and does not cover
 

src/commands.rs

@@ -713,8 +713,11 @@ const REGISTRY_PAGE: &str = r##"<!doctype html>
   button:hover { background: #0f3d91; }
   #out { display: none; background: #101418; color: #d6f5d6; padding: 0.85rem 1rem;
          border-radius: 8px; white-space: pre-wrap; word-break: break-all; margin-top: 1rem; }
+  pre.cmd { background: #101418; color: #d6f5d6; padding: 0.85rem 1rem;
+            border-radius: 8px; overflow-x: auto; }
   .muted { color: #666; font-size: 0.92rem; }
   ol { padding-left: 1.3rem; }
+  li { margin: 0.35rem 0; }
   a { color: #174ea6; }
 </style>
 </head>
@@ -726,7 +729,7 @@ small: signed messages, budgets, honest truncation, aggregate courtesy. No annou
 scores on the wire, no in-protocol payment.</p>
 <p>Everything else — matching, ranking, retention, trust — is local.</p>
 
-<h2>Join the federation</h2>
+<h2>1. Register</h2>
 <div class="card">
 <form id="f">
 <label>Organization or handle<br>
@@ -736,14 +739,47 @@ scores on the wire, no in-protocol payment.</p>
 <button type="submit">Request membership</button>
 </form>
 <pre id="out"></pre>
+<p class="muted">Your identifier is <code>&lt;label&gt;.frx.federatedsearch.org</code> — no domain or DNS of
+your own is needed. Registration returns a one-time credential block:
+<code>id=... token=... registry=... ma_key=...</code>.</p>
 </div>
 
-<h2>After you get credentials</h2>
+<h2>2. Download</h2>
+<div class="card">
+<p>Static Linux x86_64 binaries (musl — no runtime dependencies):</p>
+<pre class="cmd">curl -LO https://git.federatedsearch.org/frx/frxd/releases/download/v0.1.0/frxd-linux-amd64
+curl -LO https://git.federatedsearch.org/frx/frxd/releases/download/v0.1.0/frxd-linux-amd64.sha256
+curl -LO https://git.federatedsearch.org/frx/frxd/releases/download/v0.1.0/frx-linux-amd64
+curl -LO https://git.federatedsearch.org/frx/frxd/releases/download/v0.1.0/frx-linux-amd64.sha256</pre>
+<p class="muted">All releases: <a href="https://git.federatedsearch.org/frx/frxd/releases">git.federatedsearch.org/frx/frxd/releases</a>.
+Source and spec (<code>rfc.txt</code>): <a href="https://git.federatedsearch.org/frx/frxd">git.federatedsearch.org/frx/frxd</a>.</p>
+</div>
+
+<h2>3. Install</h2>
+<div class="card">
+<pre class="cmd">sha256sum -c frxd-linux-amd64.sha256
+chmod +x frxd-linux-amd64 frx-linux-amd64
+sudo mv frxd-linux-amd64 /usr/local/bin/frxd
+sudo mv frx-linux-amd64 /usr/local/bin/frx</pre>
+<p class="muted">No sudo? Run them in place — each is a single self-contained binary.</p>
+</div>
+
+<h2>4. Onboard</h2>
+<div class="card">
+<pre class="cmd">frxd --onboarding</pre>
 <ol>
-<li>Install the single static binary: <code>frxd</code>.</li>
+<li>Paste the credential block from step 1.</li>
-<li>Run <code>frxd --onboarding</code> and paste the credential block it gives you.</li>
+<li>The wizard generates your keys, enrolls them with the MA, verifies the signed registry
-<li>The wizard binds your keys, verifies the signed registry, and wires your relays — no domains, DNS, or ports needed on your side.</li>
+against the pinned MA key, and wires the federation relays — no domains, DNS, or open ports
+needed on your side.</li>
+<li>Index a directory and mark what you share:</li>
 </ol>
+<pre class="cmd">frxd add ~/documents --name docs --shared --exposure metadata
+frxd serve</pre>
+<p class="muted">Search local-first with <code>frx search "..."</code>; broadcast to the federation with
+<code>frx query "..."</code>. Nothing is shared until a collection is explicitly marked
+<code>--shared</code>.</p>
+</div>
 
 <h2>Who is in</h2>
 <p class="muted" id="members">…</p>
@@ -762,7 +798,7 @@ document.getElementById("f").onsubmit = async (e) => {
   const body = await res.json();
   out.style.display = "block";
   out.textContent = res.ok
-    ? "Membership approved.\n\nRun `frxd --onboarding` and paste this block:\n\n" + body.credentials + "\n"
+    ? "Membership approved.\n\nNext: download frxd (step 2), install it (step 3), then run `frxd --onboarding` and paste this block:\n\n" + body.credentials + "\n"
     : "Failed: " + (body.error || ("http " + res.status));
 };