Science Commit 5.

Author: mearvk

.gitignore

@@ -78,3 +78,6 @@ modules/AE6E66/configuration/dns.settings
 
 ### Legal Documents ###
 modules/black/presidential/Brarner.M.Alete/data/legal/Legal Tasking Document - US Custodial Authority Above Territory.docx
+
+# TLS keystore (contains private key — never commit)
+psychiatry/secrets/server.p12

modules/red/Futures/data/uptime.accumulator

@@ -1 +1 @@
-32895
+33495

scripts/generate-tls-keystore.sh

@@ -0,0 +1,61 @@
+#!/bin/bash
+# NitroWebExpress™ — Generate TLS Keystore
+# Creates a self-signed PKCS12 keystore for TLS on all TCP services.
+# On next startup, TlsContextProvider will load this and enable TLS.
+#
+# For production, replace with a Let's Encrypt or CA-signed certificate:
+#   openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out psychiatry/secrets/server.p12
+#
+# Usage: bash scripts/generate-tls-keystore.sh
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
+KEYSTORE="$PROJECT_ROOT/psychiatry/secrets/server.p12"
+PASS="${NWE_KEYSTORE_PASS:-changeit}"
+
+if [ -f "$KEYSTORE" ]; then
+    echo "[*] Keystore already exists: $KEYSTORE"
+    keytool -list -keystore "$KEYSTORE" -storepass "$PASS" -storetype PKCS12 2>/dev/null | head -7
+    echo ""
+    read -rp "    Regenerate? (y/N): " REGEN
+    if [ "$REGEN" != "y" ] && [ "$REGEN" != "Y" ]; then
+        echo "    Keeping existing keystore."
+        exit 0
+    fi
+fi
+
+mkdir -p "$(dirname "$KEYSTORE")"
+
+echo "[*] Generating TLS keystore (EC secp256r1, TLSv1.3)..."
+echo "    Output: $KEYSTORE"
+echo ""
+
+keytool -genkeypair \
+    -alias nwe-server \
+    -keyalg EC \
+    -groupname secp256r1 \
+    -sigalg SHA384withECDSA \
+    -validity 365 \
+    -storetype PKCS12 \
+    -keystore "$KEYSTORE" \
+    -storepass "$PASS" \
+    -dname "CN=NitroWebExpress, OU=MEARVK LLC, O=MEARVK, L=Durham, ST=NC, C=US"
+
+chmod 600 "$KEYSTORE"
+
+echo ""
+echo "[✓] TLS keystore generated successfully"
+echo "    Algorithm:  EC secp256r1 (256-bit)"
+echo "    Signature:  SHA384withECDSA"
+echo "    Validity:   365 days"
+echo "    Keystore:   $KEYSTORE (mode 600)"
+echo ""
+echo "    TLS will activate on next backend startup."
+echo "    To set a custom password: export NWE_KEYSTORE_PASS=yourpassword"
+echo ""
+echo "    For production (Let's Encrypt / CA-signed):"
+echo "      openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem \\"
+echo "        -out $KEYSTORE -passout pass:\$NWE_KEYSTORE_PASS"
+echo ""

scripts/web/deploy-all.sh

@@ -50,14 +50,13 @@ for SCRIPT in $ENABLED; do
         echo ""
         echo "[*] [$CURRENT_MODULE/$TOTAL_MODULES] Deploying: $SCRIPT"
         set +e
-        DEPLOY_OUT=$(timeout 120 bash "$FULL_PATH" 2>&1)
-        EXIT_CODE=$?
+        timeout 180 bash "$FULL_PATH" 2>&1 | tail -20
+        EXIT_CODE=${PIPESTATUS[0]}
         set -e
-        echo "$DEPLOY_OUT" | tail -3
         if [ $EXIT_CODE -eq 0 ]; then
             PASS=$((PASS + 1))
         elif [ $EXIT_CODE -eq 124 ]; then
-            echo "[!] TIMEOUT (120s): $SCRIPT — skipping"
+            echo "[!] TIMEOUT (180s): $SCRIPT — skipping"
             FAIL=$((FAIL + 1))
         else
             echo "[!] Failed (exit $EXIT_CODE): $SCRIPT"