thermograph/infra/deploy/provision-dev.sh

#!/usr/bin/env bash
# One-time bootstrap of the DEV environment on vps1.
#
#   sudo bash infra/deploy/provision-dev.sh
#
# Replaces provision-dev-lan.sh, which bootstrapped dev on the operator's
# desktop as a sudo-free systemd --user stack with `linger`. Dev is a normal
# fleet environment now: a checkout at /opt/thermograph-dev, secrets rendered
# from the SOPS vault at deploy time, deployed over SSH by CI like beta and
# prod. The desktop hosts no Thermograph environment at all.
#
# What dev keeps that beta and prod do not:
#   - It renders dev.yaml ALONE, never layering common.yaml (the fleet's shared
#     production credentials). vps1 also runs Forgejo and its CI, and dev runs
#     whatever branch is in flight — see the long note in render-secrets.sh.
#   - It binds LOOPBACK, never 0.0.0.0. Caddy fronts it at dev.thermograph.org
#     with TLS, basic auth and X-Robots-Tag: noindex (deploy/Caddyfile.vps1).
#     Binding loopback is what makes that guard total rather than decorative:
#     the site block is the only route in.
#
# Idempotent; re-run it after changing the branch or repointing the remote.
set -euo pipefail

SELF_DIR=$(cd "$(dirname "$0")" && pwd)
# shellcheck source=infra/deploy/env-topology.sh
. "$SELF_DIR/env-topology.sh"
thermograph_topology dev

REPO_URL="${REPO_URL:-http://10.10.0.2:3080/Jinemi/thermograph.git}"
APP_DIR="${APP_DIR:-$TG_APP_DIR}"
BRANCH="${BRANCH:-$TG_BRANCH}"

if [ "$(id -u)" -ne 0 ]; then
  echo "!! run this as root (it writes /opt and /etc/thermograph)" >&2
  exit 1
fi

echo "==> Checkout: $APP_DIR on $BRANCH"
if [ -d "$APP_DIR/.git" ]; then
  git -C "$APP_DIR" remote set-url origin "$REPO_URL"
  git -C "$APP_DIR" fetch --prune origin "$BRANCH"
  git -C "$APP_DIR" checkout -B "$BRANCH" "origin/$BRANCH"
else
  git clone --branch "$BRANCH" "$REPO_URL" "$APP_DIR"
fi

echo "==> Marking this checkout's environment"
mkdir -p /etc/thermograph
# The host marker still exists for by-hand runs. vps1 runs exactly one
# environment, so a marker is sufficient here — unlike vps2, where beta and prod
# share a box and THERMOGRAPH_ENV must be passed explicitly.
printf 'dev\n' > /etc/thermograph/secrets-env
# Dev is compose, not Swarm. env-topology.sh is what actually decides this; the
# marker is only the fallback for a checkout that predates it.
rm -f /etc/thermograph/deploy-mode

if [ ! -f /etc/thermograph/age.key ]; then
  cat >&2 <<'EOF'
!! No age key at /etc/thermograph/age.key.
!! Dev cannot render its vault without it, and deploy-dev.sh will fall back to
!! the un-vaulted defaults. Copy the key over (0400 root:root), then re-run:
!!   install -m 0400 -o root -g root age.key /etc/thermograph/age.key
EOF
fi

cat <<EOF

Done. Dev is checked out at $APP_DIR on $BRANCH.

Deploy it:
  SERVICE=all BACKEND_IMAGE_TAG=sha-<a> FRONTEND_IMAGE_TAG=sha-<b> \\
    $APP_DIR/infra/deploy/deploy-dev.sh

Reach it:
  https://dev.thermograph.org   (basic auth; see deploy/Caddyfile.vps1)

Confirm the app itself is NOT directly exposed — this must show
${TG_BIND_ADDR}:8137 and never 0.0.0.0:8137, so Caddy is the only way in:
  ss -ltnp | grep 8137
EOF