lmcp: Debian packaging + CI publish via hertz reprepro

- debian/lmcp/build-deb.sh fetches the v0.3.0 tarball, lays out the
  filetree, and uses dpkg-deb to assemble lmcp_0.3.0-1_all.deb directly
  on the Arch aarch64 runner (no debhelper needed for a pure-Lua pkg).
- workflow job 'lmcp-debian' rsyncs the .deb to hertz's marfritrepo
  incoming dir, then ssh-triggers 'publish-deb <suite>' for both
  bookworm and trixie. publish-deb wraps 'reprepro includedeb' and
  rsyncs dists/+pool/ to nc.
- New secret MARFRIT_REPO_HERTZ_KEY uploaded to Gitea repo. Forced
  command on hertz routes rsync uploads vs publish-deb triggers.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -99,7 +99,56 @@ jobs:
 
       - name: wipe secrets
         if: always()
-        run: rm -f /root/repo_pass /root/.ssh/id_ed25519
+        run: rm -f /root/repo_pass /root/.ssh/id_ed25519 /root/.ssh/id_ed25519_hertz
+
+  # -------------------------------------------------------------------------
+  # lmcp Debian (Architecture: all) — built on the aarch64 runner using
+  # dpkg-deb (Arch ships dpkg in extra). The .deb is rsynced to hertz's
+  # incoming dir, then we trigger 'publish-deb' on hertz which runs
+  # reprepro and mirrors dists/+pool/ to nc.
+  # -------------------------------------------------------------------------
+  lmcp-debian:
+    needs: lmcp-any   # serialize after the Arch build to share the runner
+    runs-on: arch-aarch64
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: install dpkg
+        run: pacman -Syu --noconfirm --needed dpkg openssh rsync curl
+
+      - name: install hertz deploy ssh key
+        env:
+          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
+        run: |
+          mkdir -m700 -p /root/.ssh
+          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
+          chmod 600 /root/.ssh/id_ed25519_hertz
+          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
+
+      - name: build lmcp .deb
+        run: |
+          set -e
+          cd debian/lmcp
+          ./build-deb.sh
+          ls -la *.deb
+
+      - name: upload + publish to suites
+        run: |
+          set -e
+          cd debian/lmcp
+          DEB=$(ls lmcp_*.deb | head -1)
+          # Push the .deb into hertz's incoming dir via rrsync.
+          rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
+              marfritrepo@hertz.fritz.box:
+          # Trigger reprepro for each suite.
+          for suite in bookworm trixie; do
+              ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
+                  "publish-deb $suite $DEB"
+          done
+
+      - name: wipe secrets
+        if: always()
+        run: rm -f /root/.ssh/id_ed25519_hertz
 
   # -------------------------------------------------------------------------
   # lmcp is pure Lua (arch=any). One build on the aarch64 runner produces a

debian/lmcp/build-deb.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+# Build lmcp_<ver>_all.deb from this directory using dpkg-deb directly.
+# Run from inside the runner container, which has dpkg installed.
+#
+# This avoids dh/debhelper to keep the build simple and runnable on a
+# non-Debian builder. The resulting .deb is structurally a normal apt
+# package (Architecture: all, depends on lua + lua-socket).
+set -euo pipefail
+
+PKGVER=0.3.0
+PKGREL=1
+LMCP_TARBALL_SHA256=80a37fc41633ae285b86f2f6cdd97f0c922c03022dce09addd47aeb379f2bcff
+HERE=$(dirname "$(readlink -f "$0")")
+
+work=$(mktemp -d)
+trap "rm -rf $work" EXIT
+
+cd "$work"
+curl -sSLfo lmcp.tar.gz "https://git.reauktion.de/marfrit/lmcp/archive/v${PKGVER}.tar.gz"
+echo "$LMCP_TARBALL_SHA256  lmcp.tar.gz" | sha256sum -c
+tar xzf lmcp.tar.gz
+
+ROOT="$work/pkgroot"
+mkdir -p "$ROOT/DEBIAN" \
+         "$ROOT/usr/share/lua/5.4" \
+         "$ROOT/usr/bin" \
+         "$ROOT/usr/share/doc/lmcp"
+
+cp lmcp/lmcp.lua   "$ROOT/usr/share/lua/5.4/"
+cp lmcp/json.lua   "$ROOT/usr/share/lua/5.4/"
+cp lmcp/server.lua "$ROOT/usr/share/lua/5.4/"
+install -m 755 lmcp/example_server.lua "$ROOT/usr/bin/lmcp-example"
+cp lmcp/README.md  "$ROOT/usr/share/doc/lmcp/"
+cp "$HERE/debian/copyright" "$ROOT/usr/share/doc/lmcp/copyright"
+cp "$HERE/debian/changelog" "$ROOT/usr/share/doc/lmcp/changelog.Debian"
+gzip -9 -n "$ROOT/usr/share/doc/lmcp/changelog.Debian"
+
+cat > "$ROOT/DEBIAN/control" <<EOF
+Package: lmcp
+Version: ${PKGVER}-${PKGREL}
+Section: net
+Priority: optional
+Architecture: all
+Depends: lua5.4 | lua5.3 | lua, lua-socket
+Maintainer: Markus Fritsche <mfritsche@reauktion.de>
+Homepage: https://git.reauktion.de/marfrit/lmcp
+Description: Lightweight MCP server in pure Lua
+ lmcp is a small Model Context Protocol server written in Lua. It exposes
+ user-defined tools over HTTP for use by AI agents.
+ .
+ Library files install to /usr/share/lua/5.4/. The example server is
+ available as /usr/bin/lmcp-example.
+EOF
+
+# Build the .deb. Output to current dir of the caller.
+DEB_OUT=lmcp_${PKGVER}-${PKGREL}_all.deb
+dpkg-deb --root-owner-group --build "$ROOT" "$HERE/$DEB_OUT"
+echo "built: $HERE/$DEB_OUT"

debian/lmcp/debian/changelog

@@ -0,0 +1,5 @@
+lmcp (0.3.0-1) bookworm trixie; urgency=medium
+
+  * Initial release packaged for marfrit overlay repo.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Tue, 14 Apr 2026 22:00:00 +0200

debian/lmcp/debian/control

@@ -0,0 +1,17 @@
+Source: lmcp
+Section: net
+Priority: optional
+Maintainer: Markus Fritsche <mfritsche@reauktion.de>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.6.2
+Homepage: https://git.reauktion.de/marfrit/lmcp
+
+Package: lmcp
+Architecture: all
+Depends: ${misc:Depends}, lua5.4 | lua5.3 | lua, lua-socket
+Description: Lightweight MCP (Model Context Protocol) server in pure Lua
+ lmcp is a small Model Context Protocol server written in Lua. It exposes
+ user-defined tools over HTTP for use by AI agents.
+ .
+ Library files install to /usr/share/lua/5.4/. The example server is
+ available as /usr/bin/lmcp-example.

debian/lmcp/debian/copyright

@@ -0,0 +1,18 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: lmcp
+Source: https://git.reauktion.de/marfrit/lmcp
+
+Files: *
+Copyright: 2026 Markus Fritsche <mfritsche@reauktion.de>
+License: MIT
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in
+ all copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.