justinandClaude Opus 5
05aa57c880
The deploy/ directory had no entry point: how to stand the stack up lived only in comments inside docker-compose.yml, and the maintainer's own instance (provenance.paul.farm) was written down nowhere in the repo — it had to be rediscovered from an unrelated repo's research log. Add deploy/README.md covering the run/build commands, the LAN-push / FQDN-pull registry split, the env-driven site address, and the Watchtower + one-shot-migrate caveat, plus a "maintainer's instance" section with the URL, host, ingress and deploy path. Cross-reference it from CLAUDE.md. Also note the live instance reports "env":"development" — its .env never set APP_ENV=production. Informational only (app_env gates no behavior), but .env.example now says to set it on a real deployment. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01BeRh7Vwq8j9s6jshaMUNCd Signed-off-by: Justin Paul <[email protected]>
49 lines
1.9 KiB
Markdown
49 lines
1.9 KiB
Markdown
# Deploying Provenance
|
|
|
|
This directory is the self-host stack: `docker-compose.yml` (Postgres + MinIO +
|
|
Caddy + backend + worker + frontend, with a one-shot Alembic `migrate` job),
|
|
`Caddyfile` for the edge, `.env.example` for configuration, and `backup.sh` /
|
|
[BACKUP.md](BACKUP.md) for backup and restore.
|
|
|
|
## Run it
|
|
|
|
```bash
|
|
cp .env.example .env # fill in secrets, OWNER_EMAIL, APP_ENV=production
|
|
docker compose up -d # pulls backend/frontend images from git.jpaul.io
|
|
```
|
|
|
|
Images are **pulled** from the public `git.jpaul.io` registry (CI pushes them to
|
|
the LAN endpoint `192.168.0.2:1234`; see CLAUDE.md). To build locally instead,
|
|
layer the dev override:
|
|
|
|
```bash
|
|
docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d --build
|
|
```
|
|
|
|
Caddy's site address is env-driven (`PROVENANCE_SITE_ADDRESS`): `:80` for plain
|
|
HTTP behind a tunnel or for `http://localhost`, or a domain for automatic HTTPS.
|
|
Nothing in this repo hard-codes a hostname.
|
|
|
|
Note that a Watchtower image swap recreates only the long-running containers,
|
|
not the one-shot `migrate` job — pair auto-deploys with a `docker compose up`
|
|
so migrations re-run.
|
|
|
|
## The maintainer's instance
|
|
|
|
Justin's own deployment — the one holding the Paul/Reier family tree:
|
|
|
|
| | |
|
|
|---|---|
|
|
| **URL** | <https://provenance.paul.farm> |
|
|
| **Host** | `192.168.0.2` (the fleet host; also the LAN registry endpoint) |
|
|
| **Ingress** | Cloudflare Tunnel → `caddy:80`; Cloudflare terminates TLS, so `PROVENANCE_SITE_ADDRESS` stays `:80` |
|
|
| **Owner account** | `[email protected]` |
|
|
| **Deploys** | CI builds on merge to `main`; the host's global Watchtower swaps the `test-main` images |
|
|
|
|
Health check (no auth): `curl https://provenance.paul.farm/health`.
|
|
|
|
Known drift: that endpoint currently reports `"env":"development"` — the host's
|
|
`.env` never set `APP_ENV=production`. It is informational only (`app_env` is
|
|
reported by `/health` and `/api/v1/admin`; it gates no behavior), but it should
|
|
be corrected on the host.
|