43 lines
2.2 KiB
Markdown
43 lines
2.2 KiB
Markdown
|
# thermograph-infra — agent instructions
|
||
|
|
|
||
|
|
How and where the already-built Thermograph app images run. This repo owns
|
||
|
|
Terraform, the SOPS+age secrets vault, compose files, deploy scripts, host
|
||
|
|
provisioning, and the ops cron (DB backup + IndexNow). The app repos
|
||
|
|
(`thermograph-backend`, `thermograph-frontend`) own building and testing the
|
||
|
|
images; this repo never checks out app source. The old monorepo
|
||
|
|
(`emi/thermograph`) is archived — do not point anything at it.
|
||
|
|
|
||
|
|
## The four machines
|
||
|
|
|
||
|
|
Same as ACCESS.md: **dev machine** (operator's box, LAN dev server, CI runner),
|
||
|
|
**prod** (`169.58.46.181`, thermograph.org, `agent` user, passwordless sudo),
|
||
|
|
**beta** (`75.119.132.91`, beta.thermograph.org + Forgejo, `agent` user). Hosts'
|
||
|
|
`/opt/thermograph` (and LAN's `~/thermograph-dev`) are checkouts of THIS repo.
|
||
|
|
|
||
|
|
## Deploys
|
||
|
|
|
||
|
|
- `deploy/deploy.sh` — the one deploy path (prod/beta): resets this repo's
|
||
|
|
checkout, renders secrets from the SOPS vault, pulls the per-service image
|
||
|
|
tags (`BACKEND_IMAGE_TAG`/`FRONTEND_IMAGE_TAG`, persisted in untracked
|
||
|
|
`deploy/.image-tags.env`), rolls the target service, health-checks via
|
||
|
|
container healthchecks. Invoked over SSH by the app repos' deploy workflows.
|
||
|
|
- `deploy/deploy-dev.sh` — thin LAN-dev wrapper around deploy.sh (dev compose
|
||
|
|
overlay, `~/thermograph-dev`, branch `dev`).
|
||
|
|
- Branch model: see README — infra `main` is live on prod+beta, `dev` on LAN;
|
||
|
|
`release` is currently unused. App code is env-staged via image tags; infra
|
||
|
|
is not.
|
||
|
|
|
||
|
|
## Rules
|
||
|
|
|
||
|
|
- **Never run `terraform apply` casually** — no tfstate exists anywhere (never
|
||
|
|
persisted), so an apply would attempt full re-provisioning of live hosts.
|
||
|
|
Terraform here is executable documentation until state is bootstrapped.
|
||
|
|
- Secrets: only via the SOPS vault (`deploy/secrets/*.yaml`, `sops edit` +
|
||
|
|
commit + deploy). Never hand-edit `/etc/thermograph.env` on a SOPS-enabled
|
||
|
|
host — it's a rendered artifact. `secrets-guard` CI rejects plaintext.
|
||
|
|
- The ops cron (`.forgejo/workflows/ops-cron.yml`) is THE prod backup — it uses
|
||
|
|
this repo's `PROD_SSH_*` Actions secrets. If you touch it, verify a dump
|
||
|
|
actually lands in `agent@prod:~/thermograph-backups/`.
|
||
|
|
- Commits/PRs: concise and technical; never mention AI/assistants/automated
|
||
|
|
authorship.
|