# Running n-OS-tr ISO (Phase 2 Slice B+C)

This slice boots a live system with these services enabled:

- `n-os-tr-firstboot.service` (oneshot): generates a per-boot ginxsom identity and self-signed TLS cert.
- `ginxsom.service`: Blossom FastCGI server on `/run/ginxsom/ginxsom-fcgi.sock`.
- `nginx.service`: TLS front-end on `https://localhost/`.
- `fips.service` + `fips-dns.service`: mesh transport and DNS responder.
- `c-relay.service`: Nostr relay behind nginx.

## Endpoints

- Landing page: `https://localhost/`
- Relay websocket: `wss://localhost/relay`
- Relay admin/API: `https://localhost/admin/`

## Retrieve generated identity

- Ginxsom pubkey and key hints are shown in `/etc/motd`.
- Provisioning logs: `journalctl -u n-os-tr-firstboot.service`
- Ginxsom nsec: `cat /var/lib/n-os-tr/keys/ginxsom.nsec`
- fips node identity (npub): `fipsctl identity`
- c-relay admin key from first boot logs: `journalctl -u c-relay.service | grep 'Admin Private Key:'`

## Smoke test

Run [`n-os-tr-smoketest`](iso/config/includes.chroot/usr/local/bin/n-os-tr-smoketest) for a one-line-per-check health summary across core + blossom + fips + relay services, with output shaped like `[PASS|FAIL|SKIP]  <label>  (<detail>)` and a final PASS/FAIL/SKIP counter.

```bash
n-os-tr-smoketest
```

If terminal colours render poorly, use:

```bash
NO_COLOR=1 n-os-tr-smoketest
```

## Notes

- Identity is ephemeral by default in this slice.
- fips is configured for ethernet discovery and a static UDP bootstrap peer.