v0.0.3 - Add loglevel=1 to live boot args to suppress TTY console noise

docs/RUNNING.md

@@ -1,36 +1,118 @@
-# Running n-OS-tr ISO (Phase 2 Slice B+C)
+# Running n-OS-tr ISO (Manual-Start Baseline)
 
-This slice boots a live system with these services enabled:
+This ISO now boots to a plain Debian login prompt.
 
-- `n-os-tr-firstboot.service` (oneshot): generates a per-boot ginxsom identity and self-signed TLS cert.
-- `ginxsom.service`: Blossom FastCGI server on `/run/ginxsom/ginxsom-fcgi.sock`.
-- `nginx.service`: TLS front-end on `https://localhost/`.
-- `fips.service` + `fips-dns.service`: mesh transport and DNS responder.
-- `c-relay.service`: Nostr relay behind nginx.
+No n-OS-tr services auto-start at boot. This is intentional for deterministic troubleshooting.
 
-## Endpoints
+## Boot posture
+
+At boot, these units are **disabled** by default:
+
+- `n-os-tr-firstboot.service`
+- `nostr-id.service`
+- `nostr-id-tui.service`
+- `nostr-id-tui-services.service`
+- `didactyl.service`
+- `c-relay.service`
+- `ginxsom.service`
+- `fips.service`
+- `fips-dns.service`
+- `nginx.service`
+- `nostr-config-loader.service`
+- `nostr-config-writer.service`
+- `ssh.service`
+- `tor.service`
+
+Default Debian getty/login remains on tty1/tty2/tty3+.
+
+## Virtual terminals
+
+Use Linux VT hotkeys:
+
+- `Ctrl+Alt+F1` → tty1
+- `Ctrl+Alt+F2` → tty2
+- `Ctrl+Alt+F3` → tty3
+- `Ctrl+Alt+F4..F6` → additional shells
+
+## Recommended bring-up flow (which terminal to use)
+
+Use **one control shell** for commands: **tty3** (recommended).
+
+- tty1: run `n_signer` directly in foreground
+- tty2: optional service-menu UI (if started)
+- tty3: your command shell for setup/service commands
+
+### Step-by-step
+
+1) Log in on **tty3 only** (`Ctrl+Alt+F3`).
+
+2) On tty3, run first-boot provisioning:
+
+```bash
+sudo systemctl start n-os-tr-firstboot.service
+```
+
+3) Switch to **tty1** (`Ctrl+Alt+F1`) and start signer directly:
+
+```bash
+sudo /usr/local/bin/n_signer \
+  --socket n_os_tr \
+  --preapprove caller=uid:0,nostr_index=0 \
+  --preapprove caller=uid:0,nostr_index=1 \
+  --preapprove caller=uid:0,nostr_index=2 \
+  --preapprove caller=uid:0,nostr_index=3 \
+  --preapprove caller=uid:0,nostr_index=5
+```
+
+4) Keep signer running on tty1, then switch back to **tty3** (`Ctrl+Alt+F3`).
+
+5) Optional service start commands are run from **tty3** (not separate terminals required):
+
+```bash
+sudo systemctl start nginx.service
+sudo systemctl start ginxsom.service
+sudo systemctl start c-relay.service
+sudo systemctl start fips.service
+```
+
+## Status and logs
+
+Check core/optional service states:
+
+```bash
+systemctl --no-pager --full status n-os-tr-firstboot.service nginx.service ginxsom.service c-relay.service fips.service
+```
+
+Tail unit logs:
+
+```bash
+pgrep -a n_signer
+journalctl -fu nginx.service
+```
+
+Or standard journalctl:
+
+```bash
+journalctl -u n-os-tr-firstboot.service
+journalctl -u nostr-id-tui-services.service
+journalctl -u nginx.service
+```
+
+## Endpoints (when services are started)
 
 - Landing page: `https://localhost/`
 - Relay websocket: `wss://localhost/relay`
 - Relay admin/API: `https://localhost/admin/`
 
-## Retrieve generated identity
-
-- Ginxsom pubkey and key hints are shown in `/etc/motd`.
-- Provisioning logs: `journalctl -u n-os-tr-firstboot.service`
-- Ginxsom nsec: `cat /var/lib/n-os-tr/keys/ginxsom.nsec`
-- fips node identity (npub): `fipsctl identity`
-- c-relay admin key from first boot logs: `journalctl -u c-relay.service | grep 'Admin Private Key:'`
-
 ## Smoke test
 
-Run [`n-os-tr-smoketest`](iso/config/includes.chroot/usr/local/bin/n-os-tr-smoketest) for a one-line-per-check health summary across core + blossom + fips + relay services, with output shaped like `[PASS|FAIL|SKIP]  <label>  (<detail>)` and a final PASS/FAIL/SKIP counter.
+Run:
 
 ```bash
 n-os-tr-smoketest
 ```
 
-If terminal colours render poorly, use:
+No-color output:
 
 ```bash
 NO_COLOR=1 n-os-tr-smoketest
@@ -38,5 +120,5 @@ NO_COLOR=1 n-os-tr-smoketest
 
 ## Notes
 
-- Identity is ephemeral by default in this slice.
-- fips is configured for ethernet discovery and a static UDP bootstrap peer.
+- Identity remains ephemeral by default unless explicitly persisted.
+- Manual-start mode is intended to isolate failures stage-by-stage.