move conf templates and conf_populate to Deployment/; add rogue-prevention rules to CLAUDE.md

CLAUDE.md

@@ -8,6 +8,13 @@
 - **No comments** unless the WHY is genuinely non-obvious.
 - The `.plg` symlinks the installed plugin location directly to this workspace — one copy, no drift.
 
+### Hard limits — do not cross these
+
+- **Never create or modify `.claude/settings.json`** in this repo. No workspace hooks, ever. The stale hook that existed here previously fired `Deployment/deploy.sh` (now deleted) on every file edit and caused unintended deploys. If you think a hook would help, ask first.
+- **Never change `HOST1_STORAGE_MODE_INTERNAL`** in `host1.conf`. Claude data belongs in `/mnt/user/appdata/claude-code/` — not inside this repo.
+- **Never run or reference anything in the stale dev folder** (`/mnt/user/Important Shit/Git/Development/Varaverk` or `/mnt/cloud-storage/...`). It does not exist for purposes of this project.
+- **Never move files between `Configurations/` and `Deployment/`** without explicit instruction. `Configurations/` = live runtime confs (gitignored). `Deployment/` = templates and setup tooling (tracked).
+
 ---
 
 ## Project: What Varaverk Is

Configurations/README.md

@@ -0,0 +1,15 @@
+# Configurations/
+
+Runtime home for the live conf files. These are gitignored — never committed.
+
+| File | Source |
+|------|--------|
+| `master.conf` | Seeded from `Deployment/master.conf.template` on first install |
+| `host1.conf` | Seeded from `Deployment/host.conf.template` on first install |
+| `host2.conf` | Seeded from `Deployment/host.conf.template` on first install |
+
+**Templates and tooling live in `Deployment/`:**
+- `Deployment/host.conf.template` — canonical template for new host confs
+- `Deployment/master.conf.template` — canonical template for master.conf
+- `Deployment/conf_upgrade.sh` — merges schema changes into existing confs
+- `Deployment/conf_populate.sh` — auto-detects and fills arr keys on first run

Deployment/conf_upgrade.sh

@@ -53,13 +53,13 @@
 # RUNTIME MODES
 # ==============================================================================================
 #
-# conf_upgrade.sh --template Configurations/master.conf.template --target Configurations/master.conf --dry-run
+# conf_upgrade.sh --template Deployment/master.conf.template --target Configurations/master.conf --dry-run
 #     Preview what would be added, removed, and kept — no changes written.
 #
-# conf_upgrade.sh --template Configurations/master.conf.template --target Configurations/master.conf --backup
+# conf_upgrade.sh --template Deployment/master.conf.template --target Configurations/master.conf --backup
 #     Apply the upgrade, writing a .bak first.
 #
-# conf_upgrade.sh --template Configurations/master.conf.template --target Configurations/master.conf
+# conf_upgrade.sh --template Deployment/master.conf.template --target Configurations/master.conf
 #     Apply the upgrade in-place with no backup.
 #
 # ==============================================================================================

Plugin/unraid/api/setup.php

@@ -55,7 +55,7 @@ if ($action === 'ssh_generate') {
 
 // ── POST: run conf_populate.sh ─────────────────────────────────────────────────────────────────
 if ($action === 'populate') {
-    $script = SCRIPTS_DIR . '/Plugin/unraid/Tools/conf_populate.sh';
+    $script = DEPLOY_DIR . '/conf_populate.sh';
     if (!file_exists($script)) {
         echo json_encode(['ok' => false, 'error' => 'conf_populate.sh not found']);
         exit;
@@ -137,7 +137,7 @@ if ($action === 'pull') {
     // Create host conf from template if it doesn't exist
     $confFile = $hostIdLow . '.conf';
     if (!file_exists(CONF_DIR . '/' . $confFile)) {
-        $template = @file_get_contents(CONF_DIR . '/host.conf.template') ?: '';
+        $template = @file_get_contents(DEPLOY_DIR . '/host.conf.template') ?: '';
         if ($template) {
             $bootPart2  = trim(shell_exec('findmnt -n -o SOURCE /boot 2>/dev/null') ?: '');
             $bootDisk2  = $bootPart2 ? trim(shell_exec('lsblk -no pkname ' . escapeshellarg($bootPart2) . ' 2>/dev/null') ?: '') : '';
@@ -229,7 +229,7 @@ if ($smParam === 'flash') {
 }
 
 if (!file_exists(CONF_DIR . '/' . $confFile)) {
-    $template = @file_get_contents(CONF_DIR . '/host.conf.template') ?: '';
+    $template = @file_get_contents(DEPLOY_DIR . '/host.conf.template') ?: '';
     if ($template) {
         $sshOwner   = strtolower(preg_replace('/^unraid-/i', '', $myHostname));
         $sshKeyPath = '/root/.ssh/' . $sshOwner . '_rsync_automation';

Plugin/unraid/include/config.php

@@ -7,6 +7,7 @@ define('PLUGIN_CFG',  '/boot/config/plugins/varaverk/varaverk.cfg');
 $_vv_cfg = @parse_ini_file(PLUGIN_CFG) ?: [];
 define('SCRIPTS_DIR', $_vv_cfg['SCRIPTS_DIR'] ?? '/boot/config/plugins/varaverk');
 define('CONF_DIR',    SCRIPTS_DIR . '/Configurations');
+define('DEPLOY_DIR',  SCRIPTS_DIR . '/Deployment');
 define('DATA_DIR',    SCRIPTS_DIR . '/data');
 define('STATE_DIR',   SCRIPTS_DIR . '/State_Files');
 define('LOG_DIR',     '/var/log/varaverk');

Plugin/unraid/pages/setup.php

@@ -275,7 +275,7 @@ function vvRunPopulate() {
         : '✓ Auto-populate ran — arr keys will fill once services are running';
       el.style.color = '#4a8';
     } else {
-      el.textContent = 'Auto-populate skipped — run Tools/conf_populate.sh once your arr containers are up';
+      el.textContent = 'Auto-populate skipped — run Deployment/conf_populate.sh once your arr containers are up';
       el.style.color = '#555';
     }
     vvLoadChecklist();

Plugin/varaverk.plg

@@ -90,6 +90,7 @@ log() { echo "[$(date '+%H:%M:%S')] $*" | tee -a "$LOG"; }
 # Scripts live in the plugin dir on flash — no array needed.
 SCRIPTS_DIR="$CFG_DIR"
 CONF_DIR="$SCRIPTS_DIR/Configurations"
+DEPLOY_DIR="$SCRIPTS_DIR/Deployment"
 
 # ── Boot device check ─────────────────────────────────────────────────────────
 # Warn if /boot is on a USB/removable device. Varaverk is designed for internal
@@ -195,8 +196,8 @@ fi
 
 # Seed master.conf from template if absent.
 mkdir -p "$CONF_DIR"
-if [[ ! -f "$CONF_DIR/master.conf" && -f "$CONF_DIR/master.conf.template" ]]; then
+if [[ ! -f "$CONF_DIR/master.conf" && -f "$DEPLOY_DIR/master.conf.template" ]]; then
-    cp "$CONF_DIR/master.conf.template" "$CONF_DIR/master.conf"
+    cp "$DEPLOY_DIR/master.conf.template" "$CONF_DIR/master.conf"
     log "seeded master.conf from template"
 fi
 log "install step complete"

git_pull_execute.sh

@@ -282,6 +282,7 @@ echo "━━━ $ICON_GEAR Conf Upgrade ━━━"
 
 UPGRADE_SCRIPT="$TARGET_DIR/Deployment/conf_upgrade.sh"
 CONF_DIR="$TARGET_DIR/Configurations"
+DEPLOY_DIR="$TARGET_DIR/Deployment"
 
 if [[ ! -f "$UPGRADE_SCRIPT" ]]; then
     log "conf_upgrade.sh not found — skipping (pre-deployment-folder repo)"
@@ -291,9 +292,9 @@ elif [[ "$SYNC_SUCCESS" == true ]]; then
     _DRY=""
 
     # master.conf
-    if [[ -f "$CONF_DIR/master.conf.template" && -f "$CONF_DIR/master.conf" ]]; then
+    if [[ -f "$DEPLOY_DIR/master.conf.template" && -f "$CONF_DIR/master.conf" ]]; then
         bash "$UPGRADE_SCRIPT" \
-            --template "$CONF_DIR/master.conf.template" \
+            --template "$DEPLOY_DIR/master.conf.template" \
             --target   "$CONF_DIR/master.conf" \
             --backup   $_DRY
     else
@@ -302,11 +303,11 @@ elif [[ "$SYNC_SUCCESS" == true ]]; then
 
     # This server's host conf only — sparse checkout ensures we have it
     HOST_CONF="$CONF_DIR/${MY_ID,,}.conf"
-    if [[ -f "$CONF_DIR/host.conf.template" && -f "$HOST_CONF" ]]; then
+    if [[ -f "$DEPLOY_DIR/host.conf.template" && -f "$HOST_CONF" ]]; then
         # Template uses HOSTN_ as generic prefix. Substitute MY_ID before merging
         # so keys match the target (HOST1_* or HOST2_*) and real values are preserved.
         TMPL_RESOLVED=$(mktemp)
-        sed "s/HOSTN_/${MY_ID}_/g; s/REMOTE_ID/${REMOTE_ID}/g" "$CONF_DIR/host.conf.template" > "$TMPL_RESOLVED"
+        sed "s/HOSTN_/${MY_ID}_/g; s/REMOTE_ID/${REMOTE_ID}/g" "$DEPLOY_DIR/host.conf.template" > "$TMPL_RESOLVED"
         bash "$UPGRADE_SCRIPT" \
             --template "$TMPL_RESOLVED" \
             --target   "$HOST_CONF" \