Docs: public README, setup guide and architecture, generic deploy files, and the T3 Code notice

scripts/hosts.conf.example

@@ -0,0 +1,15 @@
+# Settings for renew-hosts.sh. Copy to hosts.conf, which git ignores, and fill in your machines.
+
+# SSH target for the machine running the gateway container.
+GATEWAY_SSH="gateway.example.lan"
+# The container runtime there, podman or docker, and the container's name.
+GATEWAY_RUNTIME="podman"
+GATEWAY_CONTAINER="wristcode-gateway"
+
+# label | SSH host, or "local" for the machine running the script | T3 URLs
+# URLs are space separated, preferred first. The gateway uses the first one that answers, so put
+# direct LAN or VPN routes first and a public URL last as the fallback.
+HOSTS=(
+  "Desktop|local|http://desktop.lan:3773 https://t3-desktop.example.com"
+  "Mac mini|mac.lan|http://mac.lan:3773"
+)

scripts/renew-hosts.sh

@@ -4,28 +4,19 @@
 # on the gateway, so the credential is never printed. Run it from a machine that can SSH to every
 # host by name. The watch warns a week before a session expires.
 #
-#   scripts/renew-hosts.sh              renew every host below
+#   scripts/renew-hosts.sh              renew every host in hosts.conf
 #   scripts/renew-hosts.sh "Mac mini"   renew one host by label
 set -euo pipefail
 
-GATEWAY_SSH="${GATEWAY_SSH:-junior.gib}"
-# The container runtime on the gateway host: podman on junior, docker on the home server.
+# The host list and gateway settings live in hosts.conf beside this script, which git ignores.
+# Copy hosts.conf.example to start one.
+CONFIG="${RENEW_HOSTS_CONFIG:-$(dirname "$0")/hosts.conf}"
+[ -f "$CONFIG" ] || { echo "No $CONFIG. Copy hosts.conf.example and fill it in." >&2; exit 1; }
+# shellcheck source=hosts.conf.example
+source "$CONFIG"
 GATEWAY_RUNTIME="${GATEWAY_RUNTIME:-podman}"
 GATEWAY_CONTAINER="${GATEWAY_CONTAINER:-wristcode-gateway}"
 
-# label | SSH host, or "local" for the machine running this script | T3 URLs
-# URLs are space separated, preferred first. The gateway uses the first one that answers. Direct
-# routes come first: from junior they cross WireGuard straight to the machine, so they skip
-# Cloudflare and the home server's tunnel and proxy. The public URLs are the fallback. LittleMan is
-# junior itself, reached at its own WireGuard address.
-HOSTS=(
-  "Desktop|local|http://desktop.gib:3773 https://t3desktop.gbrown.org"
-  "Mac mini|mac.gib|http://mac.gib:3773 https://t3mac.gbrown.org"
-  "server-gib|server.gib|http://server.gib:3773 https://t3sr.gbrown.org"
-  "LittleMan|junior.gib|http://192.168.2.2:3773 https://t3jr.gbrown.org"
-  "Laptop|laptop.gib|http://laptop.gib:3773 http://laptopvpn.gib:3773 https://t3laptop.gbrown.org https://t3laptopvpn.gbrown.org"
-)
-
 # Prints a pairing credential. Runs on the T3 host. The CLI is not on PATH in non-login shells,
 # so it looks where T3 Code installs it.
 MINT='