# Nexus Downloads — Coolify Static Update Channel

Public update channel for Ninja Nexus POC clients.

**Base URL:** https://nexus.ninjakernen.info

## Directory layout (volume: `./data`)

```
data/
  health                          # optional — nginx returns /health without file
  downloads/
    latest.json                   # no-cache — points to current release manifest
    sha256.txt                    # no-cache — SHA256 of root nexus-shell-poc.zip
    nexus-shell-poc.zip           # immutable cache — copy of latest release ZIP
    releases/
      0.1.0-poc1/
        manifest.json
        sha256.txt
        nexus-shell-poc.zip
```

## Publish

From repo root (after Jacob approval):

```powershell
# Build package + manifests locally
.\scripts\nexus-laptop-poc\build-package.ps1

# Dry-run (generates upload folder + evidence, no Coolify deploy)
.\scripts\nexus-laptop-poc\publish-coolify.ps1 -DryRun

# Publish (requires env vars — see below)
$env:COOLIFY_API_BASE_URL = "http://your-coolify:8000"
$env:COOLIFY_API_TOKEN = "<from-local-secrets>"
$env:NEXUS_COOLIFY_APP_UUID = "<nexus-downloads-app-uuid>"
.\scripts\nexus-laptop-poc\publish-coolify.ps1
```

Alternatively load secrets from `~/.renninja-secrets/coolify-api-token.ps1` (never commit).

## Environment variables

| Variable | Required | Description |
|----------|----------|-------------|
| `COOLIFY_API_BASE_URL` | Yes (for deploy) | Coolify API base URL |
| `COOLIFY_API_TOKEN` | Yes (for deploy) | Bearer token |
| `NEXUS_COOLIFY_APP_UUID` | Yes (for deploy) | `nexus-downloads` application UUID |
| `NEXUS_DOWNLOAD_BASE_URL` | No | Default `https://nexus.ninjakernen.info/downloads` |

## Coolify setup

1. Create Dockerfile or use this `docker-compose.yml` with persistent volume `./data`.
2. Map domain `https://nexus.ninjakernen.info`.
3. Copy `nginx.conf` into the container (see compose volume mount).
4. Do **not** enable directory listing.

## Verification

```powershell
Invoke-RestMethod https://nexus.ninjakernen.info/health
Invoke-RestMethod https://nexus.ninjakernen.info/downloads/latest.json
```

## Security

- No secrets in served files.
- POC manifests use `"signature": null` until code signing is enabled.
- Clients check only — no auto-install in POC 1.

See [architecture/NEXUS_UPDATE_SYSTEM.md](../../../architecture/NEXUS_UPDATE_SYSTEM.md).
