justinandClaude Opus 5
05aa57c880
The deploy/ directory had no entry point: how to stand the stack up lived only in comments inside docker-compose.yml, and the maintainer's own instance (provenance.paul.farm) was written down nowhere in the repo — it had to be rediscovered from an unrelated repo's research log. Add deploy/README.md covering the run/build commands, the LAN-push / FQDN-pull registry split, the env-driven site address, and the Watchtower + one-shot-migrate caveat, plus a "maintainer's instance" section with the URL, host, ingress and deploy path. Cross-reference it from CLAUDE.md. Also note the live instance reports "env":"development" — its .env never set APP_ENV=production. Informational only (app_env gates no behavior), but .env.example now says to set it on a real deployment. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01BeRh7Vwq8j9s6jshaMUNCd Signed-off-by: Justin Paul <[email protected]>
Deploying Provenance
This directory is the self-host stack: docker-compose.yml (Postgres + MinIO +
Caddy + backend + worker + frontend, with a one-shot Alembic migrate job),
Caddyfile for the edge, .env.example for configuration, and backup.sh /
BACKUP.md for backup and restore.
Run it
cp .env.example .env # fill in secrets, OWNER_EMAIL, APP_ENV=production
docker compose up -d # pulls backend/frontend images from git.jpaul.io
Images are pulled from the public git.jpaul.io registry (CI pushes them to
the LAN endpoint 192.168.0.2:1234; see CLAUDE.md). To build locally instead,
layer the dev override:
docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d --build
Caddy's site address is env-driven (PROVENANCE_SITE_ADDRESS): :80 for plain
HTTP behind a tunnel or for http://localhost, or a domain for automatic HTTPS.
Nothing in this repo hard-codes a hostname.
Note that a Watchtower image swap recreates only the long-running containers,
not the one-shot migrate job — pair auto-deploys with a docker compose up
so migrations re-run.
The maintainer's instance
Justin's own deployment — the one holding the Paul/Reier family tree:
| URL | https://provenance.paul.farm |
| Host | 192.168.0.2 (the fleet host; also the LAN registry endpoint) |
| Ingress | Cloudflare Tunnel → caddy:80; Cloudflare terminates TLS, so PROVENANCE_SITE_ADDRESS stays :80 |
| Owner account | [email protected] |
| Deploys | CI builds on merge to main; the host's global Watchtower swaps the test-main images |
Health check (no auth): curl https://provenance.paul.farm/health.
Known drift: that endpoint currently reports "env":"development" — the host's
.env never set APP_ENV=production. It is informational only (app_env is
reported by /health and /api/v1/admin; it gates no behavior), but it should
be corrected on the host.