Jinemi/thermograph
4
0
Fork 0
Code Issues 2 Pull requests 9 Projects Releases Packages Wiki Activity Actions

Extract docs/ into thermograph-docs (repo-split Stage 6) (#20)

Browse source
This commit is contained in:
emi 2026-07-21 21:29:14 +00:00
parent fe14c7ab64
commit 90f313cf56
6 changed files with 12 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.forgejo/workflows/ops-cron.yml
View file

@ -4,7 +4,7 @@ name: Ops cron (backup + IndexNow)
# scheduler (notifications/scheduler.py, Track A chunk 5) because they're
# infra/ops concerns rather than app-domain background work -- see the job
# classification table in
# docs/architecture/repo-topology-and-infrastructure.md §7.
# thermograph-docs/architecture/repo-topology-and-infrastructure.md §7.
#
# Both jobs SSH into the prod host and run inside the already-running compose
# stack (docker compose exec), the same way deploy.sh already runs its own

6
INFRA.md
View file

@ -2,9 +2,9 @@
This covers three additive infrastructure layers on top of the app
containerization / Postgres / Terraform work described in
**`docs/runbooks/implementation-handoff.md`** (read that first — it's the
**`thermograph-docs/runbooks/implementation-handoff.md`** (read that first — it's the
canonical Track A/Track B plan this whole effort implements) and
`docs/architecture/repo-topology-and-infrastructure.md`. Terraform provisions
`thermograph-docs/architecture/repo-topology-and-infrastructure.md`. Terraform provisions
**prod** (the new 48 GB / 12-core box, `thermograph.org`) and **beta** (the
old VPS, `75.119.132.91`) — see `terraform/README.md` /
`terraform.tfvars.example`. **None of this touches `backend/`, `Dockerfile`,
@ -130,7 +130,7 @@ service anymore.
A second, independent set of Forgejo workflows
(`.forgejo/workflows/{ci,build-push,ops-cron}.yml`) was added by a parallel
effort implementing `docs/runbooks/implementation-handoff.md` Track A chunk
effort implementing `thermograph-docs/runbooks/implementation-handoff.md` Track A chunk
7 — see that doc and its own reconciliation PR (which already fixed its
runner-label and ssh-action guesses to match the real infrastructure here).
`ci.yml` duplicated this PR's `build.yml` exactly and was dropped in that

4
deploy/forgejo/README.md
View file

@ -8,7 +8,7 @@ Pinned to the **beta** node (old VPS) via the `role=forge` label from
The Actions **runner** is deliberately *not* part of this stack — it runs on
the **desktop** as a plain systemd service (`register-lan-runner.sh` below),
per `docs/runbooks/implementation-handoff.md` Track B step 5. That's the
per `thermograph-docs/runbooks/implementation-handoff.md` Track B step 5. That's the
canonical placement; an earlier revision of this stack ran the runner as a
Swarm-scheduled Docker-in-Docker sidecar pinned to beta, which is gone now.
@ -58,7 +58,7 @@ same pattern as its `thermograph.org` block, same automatic-HTTPS.
adjusting the domain if you didn't use the default, then `systemctl reload
caddy`.
3. That file also resolves the registry-exposure hazard (#15 in
`docs/runbooks/hop1-forgejo-registry-cutover.md`): `/v2/*` (the registry
`thermograph-docs/runbooks/hop1-forgejo-registry-cutover.md`): `/v2/*` (the registry
API) is blocked to everything except the WireGuard mesh CIDR
(`10.10.0.0/24`); the git/web UI stays public. CI runners and Swarm nodes
reach the registry over the mesh, not the public internet — see "Registry

4
deploy/forgejo/docker-stack.yml
View file

@ -4,7 +4,7 @@
# itself: this stack's only job is Forgejo and its container registry.
#
# The Actions RUNNER is deliberately NOT a service in this stack. Per
# docs/runbooks/implementation-handoff.md (Track B step 5), the canonical
# thermograph-docs/runbooks/implementation-handoff.md (Track B step 5), the canonical
# design registers the runner on the desktop node as a plain systemd service
# (deploy/forgejo/register-lan-runner.sh) — the same place the pre-Forgejo
# GitHub self-hosted runner already lived, not a Swarm-scheduled container.
@ -27,7 +27,7 @@
# Requires this Swarm secret to exist first (see deploy/forgejo/README.md):
# forgejo_db_password
#
# Registry exposure (hazard #15 in docs/runbooks/hop1-forgejo-registry-cutover.md):
# Registry exposure (hazard #15 in thermograph-docs/runbooks/hop1-forgejo-registry-cutover.md):
# resolved as the runbook's first listed option — serve Git/UI publicly but
# firewall the /v2/ registry API paths so only WireGuard-mesh clients can
# reach them. That's implemented in the Caddy site block (see

2
deploy/swarm/README.md
View file

@ -8,7 +8,7 @@ or interfere with the app's already-working, single-writer Postgres/TimescaleDB
deploys.
This is the canonical topology from
`docs/runbooks/implementation-handoff.md` (Track B steps 2-3) — three nodes,
`thermograph-docs/runbooks/implementation-handoff.md` (Track B steps 2-3) — three nodes,
not two. An earlier revision of this doc/scripts covered just prod+beta;
the desktop (this LAN dev machine) joins too.

6
docker-stack.yml
View file

@ -1,6 +1,6 @@
# Docker Swarm stack for the hop-1 interim cutover — see
# docs/runbooks/hop1-forgejo-registry-cutover.md (which this file implements) and
# docs/architecture/repo-topology-and-infrastructure.md §6/§9.
# thermograph-docs/runbooks/hop1-forgejo-registry-cutover.md (which this file implements) and
# thermograph-docs/architecture/repo-topology-and-infrastructure.md §6/§9.
#
# Distinct from docker-compose.yml (today's plain-compose deploy, unaffected by
# this file): Swarm pulls a pre-built image from the registry (IMAGE_TAG) rather
@ -21,7 +21,7 @@
# app/worker from the same secret file at container start. All `postgres_password`
# / `thermograph_*` secrets below must already exist in the Swarm (`docker secret
# create <name> -`) before the first deploy — Track B step 7 in
# docs/runbooks/implementation-handoff.md.
# thermograph-docs/runbooks/implementation-handoff.md.
#
# Migrations are NOT run inline by app/worker here (RUN_MIGRATIONS=0) — the
# runbook's Stage F brings the schema to head via a one-shot task BEFORE scaling