🐼 CrumbZeros TTYD Deployment Scripts
For: TTYD user isolation + BashPanda Lektion 1 + Crumbmissions integration
Philosophy: Präzision über Geschwindigkeit
Date: 2026-02-21
🎯 Die drei Scripts
check.sh → Was ist im Wald? (Status Check)
test.sh → Was soll neu? (Test Suite)
make.sh → wuuuhuuu! (Deployment)
📋 1. check.sh - "Was ist im Wald?"
Purpose: Check current deployment status
What it checks:
- ✅ System prerequisites (ttyd, nginx, htpasswd)
- ✅ crumbforest group existence
- ✅ Krümel users & group membership
- ✅ Home directory permissions
- ✅ TTYD processes running
- ✅ Nginx configuration
- ✅ Password files
- ✅ BashPanda lektionen
- ✅ Crumbmissions integration
- ✅ External access (should be 401!)
Usage:
sudo ./check.sh
# Output:
# ✓ Shows what's deployed
# ✗ Shows what's missing
# Exit code = number of issues
When to use:
- Before deployment (see baseline)
- After deployment (verify success)
- Regular health checks
- Troubleshooting
🧪 2. test.sh - "Was soll neu?"
Purpose: Test plan & validation for new features
What it tests:
- ✅ User creation & isolation
- ✅ Directory permissions
- ✅ chmod basics (BashPanda Lektion 1)
- ✅ File ownership
- ✅ TTYD readonly mode
- ✅ htpasswd functionality
- ✅ Nginx configuration syntax
- ✅ Nginx proxy module
- ✅ Crumbmissions file structure
- ✅ Passkante scenarios (intentional failures)
Usage:
sudo ./test.sh
# Output:
# Shows test results
# Pass/Fail summary
# What's ready to deploy
Philosophy:
Test 3x:
1x = Glück (luck)
2x = Zufall (coincidence)
3x = Verstanden (understood)
When to use:
- Before make.sh (verify system ready)
- After make.sh (verify deployment)
- Development/testing
- Learning how it works
🚀 3. make.sh - "wuuuhuuu!"
Purpose: Deploy the complete TTYD user isolation system
What it deploys:
1. crumbforest Group
- Creates group for all krümel users
- Shared group, isolated homes
2. Krümel Users (default: 5)
kruemel1, kruemel2, kruemel3, kruemel4, kruemel5
- Home: /home/kruemelN
- Shell: /bin/bash
- Group: crumbforest
- Password: Random (saved to passwords.txt)
3. Home Directories
/home/kruemelN/
├── mein_verzeichnis/ (700 - protected!)
│ └── willkommen.txt (600 - welcome message)
└── .bashrc (user's environment)
Permissions:
/home/kruemelN → 700 (only user can access)
mein_verzeichnis → 700 (for Lektion 1 practice)
4. Authentication
/opt/crumbforest/auth/
├── .htpasswd-kruemel1
├── .htpasswd-kruemel2
├── ...
└── passwords.txt (admin reference - 600!)
5. TTYD Services
systemd services:
ttyd-kruemel1.service → port 7681
ttyd-kruemel2.service → port 7682
ttyd-kruemel3.service → port 7683
...
Features:
- Readonly mode (safe!)
- Per-user credentials
- Writable in home dir only
- Auto-restart
6. BashPanda Lektion 1
/opt/crumbforest/bashpanda/
└── lektion1.md
Topic: "Schütze dein Verzeichnis"
Teaches:
- chmod basics
- File permissions
- Directory protection
- Passkante (learning from mistakes)
7. Crumbmissions Framework
/opt/crumbforest/crumbmissions/
├── missions/
│ └── mission1.md → Links to BashPanda Lektion 1
└── progress/
(for tracking user progress)
8. Nginx Configuration
/etc/nginx/sites-available/ttyd.crumbforest.com
Routes:
https://ttyd.crumbforest.com/kruemel1 → port 7681
https://ttyd.crumbforest.com/kruemel2 → port 7682
...
Security:
- auth_basic (username/password required!)
- SSL/HTTPS
- Per-user htpasswd files
- Security headers
9. Service Start
- Enables all TTYD services
- Starts all TTYD instances
- Reloads nginx
- Verifies everything running
Usage:
# Default: 5 users
sudo ./make.sh
# Custom number of users
sudo NUM_KRUEMEL=10 ./make.sh
# Output:
# Step-by-step deployment
# Confirmation prompts
# Success summary
# Access URLs
# Credentials location
After deployment:
✓ crumbforest group created
✓ N krümel users created
✓ N protected home directories
✓ N TTYD instances running
✓ Nginx configured & reloaded
✓ Auth files created
✓ BashPanda Lektion 1 ready
✓ Crumbmissions framework deployed
🔄 Workflow
First Time Setup:
# 1. Check baseline
sudo ./check.sh
# → Shows what's missing
# 2. Run tests
sudo ./test.sh
# → Verify system ready
# 3. Deploy!
sudo ./make.sh
# → Follow prompts
# 4. Verify deployment
sudo ./check.sh
# → Should show 0 issues!
Regular Operations:
# Health check
sudo ./check.sh
# If issues found:
sudo ./make.sh # Re-deploy
🌐 Access After Deployment
URLs:
https://ttyd.crumbforest.com/kruemel1
https://ttyd.crumbforest.com/kruemel2
https://ttyd.crumbforest.com/kruemel3
...
Credentials:
See: /opt/crumbforest/auth/passwords.txt
Format: username:password
Important: Change default passwords!
Test from outside:
# Should return 401 (auth required)
curl https://ttyd.crumbforest.com/kruemel1
# Output: 401 Unauthorized ← Good!
# Should NOT show terminal!
🐼 BashPanda Lektion 1
Once logged in as krümel:
# Read welcome message
cat ~/mein_verzeichnis/willkommen.txt
# Start Lektion 1
cat /opt/crumbforest/bashpanda/lektion1.md | less
# Practice!
cd ~/mein_verzeichnis
echo "Mein Geheimnis" > geheimes.txt
chmod 600 geheimes.txt
ls -la
# Check Mission 1
cat /opt/crumbforest/crumbmissions/missions/mission1.md
Learning Goals:
- ✅ Understand chmod
- ✅ Protect your directory (700)
- ✅ Protect your files (600)
- ✅ Learn from mistakes (Passkante!)
🔒 Security Features
Multi-Layer Protection:
Layer 1: Nginx auth_basic
→ Username/password required
→ Per-user htpasswd files
Layer 2: TTYD credentials
→ Additional credential check
→ Even if nginx bypassed
Layer 3: User isolation
→ Each user in own home
→ 700 permissions (only owner!)
→ Group membership (crumbforest)
Layer 4: Readonly mode
→ TTYD readonly by default
→ Writable only in home dir
→ Can't break system
Layer 5: Systemd isolation
→ Each user = own service
→ Service restart on failure
→ Monitored by systemd
Passkante (Conscious Risk):
Why TTYD in browser?
✅ Educational value (learn bash!)
✅ Low barrier to entry
✅ Accessible anywhere
✅ Protected by multiple layers
✅ Documented & transparent
= Pedagogical choice with safeguards
= Not reckless, but conscious
= As per Robotikids Manifest
🎯 Configuration
Environment Variables:
# Number of users to create
NUM_KRUEMEL=5 # Default
# Change it:
sudo NUM_KRUEMEL=10 ./make.sh
File Locations:
/opt/crumbforest/
├── auth/ (htpasswd files)
├── bashpanda/ (lektionen)
└── crumbmissions/ (missions framework)
/home/kruemelN/
└── mein_verzeichnis/ (practice space)
/etc/systemd/system/
└── ttyd-kruemelN.service (per-user services)
/etc/nginx/sites-available/
└── ttyd.crumbforest.com (nginx config)
🔧 Maintenance
View logs:
# TTYD service logs
journalctl -u ttyd-kruemel1 -f
# All TTYD services
journalctl -u 'ttyd-*' -f
# Nginx logs
tail -f /var/log/nginx/access.log
tail -f /var/log/nginx/error.log
Restart services:
# Single user
sudo systemctl restart ttyd-kruemel1
# All TTYD services
sudo systemctl restart 'ttyd-*'
# Nginx
sudo systemctl reload nginx
Add more users:
# Run make.sh again with higher number
sudo NUM_KRUEMEL=10 ./make.sh
# Will create kruemel6-10
💚 Philosophy
From Robotikids Manifest:
"Wir lehren Technik – aber mit Haltung.
Wir fördern Talente – aber ohne Druck.
Wir zeigen Möglichkeiten – aber mit Werten."
From BashPanda:
"Präzision über Geschwindigkeit.
Verstehen über Quick-Fix.
Atmen vor Ausführen."
From Passkante:
"Fehler sind Einladungen zum Verstehen,
keine Katastrophen."
🌲 Integration
CrumbZeros:
- Raspberry Pi Zero setups
- Pelicase deployments
- Offline-first architecture
Crumbmissions:
- Mission-based learning
- Progress tracking
- Gamification (optional)
Crumbforest:
- Local AI (Ollama)
- RAG (Qdrant)
- Crew characters
= Complete ecosystem for learning!
📚 Next Steps
After Deployment:
- Test Access
- Login to https://ttyd.crumbforest.com/kruemel1
-
Complete BashPanda Lektion 1
-
Monitor
- Check logs regularly
-
Run check.sh weekly
-
Expand
- Add more lektionen
- Create more missions
-
Integrate with Ollama AI
-
Share
- Document learnings
- Share with community
- Improve scripts
Version: 1.0
Date: 2026-02-21
For: TTYD + BashPanda + Crumbmissions
Philosophy: Passkante + Präzision + Crew
wuuuhuuu! 🐼🌲💚