The lake was prod-stack-only; beta and LAN fell straight to NASA. Now the
compose stack gets the same service (backend image, THERMOGRAPH_ROLE=lake,
never host-published) and the backend points at it via THERMOGRAPH_LAKE_URL:
- deploy.sh rolls lake with every backend deploy (same image, different
role); deploy-stack.sh's backend leg updates it too, tolerating stacks
that predate the service.
- Creds: beta via the vault (added to beta.yaml); LAN via the Actions S3
secrets injected by backend-deploy-dev.yml (dev renders no vault). Without
creds the service stays healthy and answers 503 — reads fall through to
NASA, so a credential gap can never take a page down.
- Dev overlay lifts the CPU caps like every other service.
Backend runs its full hermetic suite, frontend its unit tier, inside the
just-built image -- the dev-only feature both app repos carried in their own
build.yml (deleted here in favor of the root workflow).
One root workflow set replaces the four repos' copies (deleted -- root-only
is where Forgejo reads them, and dead copies are a trap): per-domain
build-push with explicit image paths (emi/thermograph/backend|frontend; the
old github.repository-derived path collides in a monorepo), path-filtered
per-domain beta/prod/dev deploys, a domain-input reusable build check, a
single always-reporting PR gate (path-filtered required checks deadlock
auto-merge), a new infra-sync pipeline (host checkout + secrets render on
infra/** pushes), and ports of secrets-guard / ops-cron /
observability-validate to monorepo paths.
