hub v0.44.0: PBS DR tier SLICE 1 — felhom-tenantsync surface (script+client) + hub provisioning flow (consume-once host secret, pbs_dr desired-state descriptor, fail-closed + idempotent, re-issue)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/cmd/hub/main.go

@@ -23,6 +23,7 @@ import (
 	"gitea.dooplex.hu/admin/felhom-hub/internal/notify"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/store"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/web"
+	"gitea.dooplex.hu/admin/felhom-hub/internal/tenantsync"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/wgsync"
 	"gopkg.in/yaml.v3"
 )
@@ -366,6 +367,28 @@ func main() {
 		} else {
 			logger.Printf("[INFO] WG peer-sync disabled (endpoint not configured)")
 		}
+
+		// PBS DR tier (SLICE 1): the tenantsync client — same endpoint address + pinned host key
+		// as peersync, its OWN private key (the authorized_keys line selects the forced command).
+		tsKeyFile := os.Getenv("TENANTSYNC_SSH_KEY_FILE")
+		if wgAddr != "" && wgHostKey != "" && tsKeyFile != "" {
+			keyPEM, err := os.ReadFile(tsKeyFile)
+			if os.IsNotExist(err) {
+				// The env names the mount path unconditionally; the optional Secret may not exist yet.
+				logger.Printf("[INFO] PBS DR tenantsync disabled (key %s not present)", tsKeyFile)
+			} else if err != nil {
+				logger.Printf("[ERROR] PBS DR tenantsync disabled: read key file %s: %v", tsKeyFile, err)
+			} else if tsClient, err := tenantsync.New(tenantsync.Config{
+				Addr: wgAddr, User: wgUser, PrivateKey: keyPEM, HostKeyLine: wgHostKey,
+			}, logger); err != nil {
+				logger.Printf("[ERROR] PBS DR tenantsync disabled: %v", err)
+			} else {
+				webServer.SetTenantSync(tsClient)
+				logger.Printf("[INFO] PBS DR tenantsync enabled (endpoint %s, user %s)", wgAddr, wgUser)
+			}
+		} else {
+			logger.Printf("[INFO] PBS DR tenantsync disabled (key or endpoint not configured)")
+		}
 	}
 
 	// Session cleanup — removes expired sessions every hour