# thermograph-infra

Infrastructure for [Thermograph](https://thermograph.org): Terraform host
provisioning, the SOPS+age secrets vault, Docker Swarm/WireGuard networking,
Forgejo, Caddy, and the deploy scripts that run the already-built app image on
each host. Extracted from the app monorepo (`emi/thermograph`) — the app repo
owns building and testing the app; this repo owns running it.

- **`terraform/`** — provisions/configures hosts (SSH-driven by default; an
  optional GCP-creating module is scaffolded, no live resources yet) and
  triggers each deploy. See `terraform/README.md`.
- **`deploy/secrets/`** — the git-native SOPS+age secrets vault (every app
  secret, encrypted at rest, rendered at deploy time). See
  `deploy/secrets/README.md`.
- **`deploy/swarm/`, `deploy/forgejo/`** — the 3-node WireGuard/Swarm cluster
  that hosts Forgejo (git + CI + registry); does not run the app itself. See
  `ACCESS.md` and the READMEs under each directory.
- **`deploy/deploy.sh`** — pulls the pinned app image (`IMAGE_TAG`) and rolls
  the compose stack; invoked by Terraform and by the app repo's
  `.forgejo/workflows/deploy.yml` over SSH.
- **`docker-compose*.yml`, `docker-stack.yml`** — how the app image runs
  (compose in production today; `docker-stack.yml` is a design record for a
  possible future Swarm-based app deploy, not currently live).

The app's own source, `Dockerfile`, and build/test CI stay in the app repo —
this repo never checks out app source; hosts only pull tagged images from the
registry. See `ACCESS.md` for host access and the Swarm/Forgejo topology, and
`terraform/README.md` for the day-to-day `plan`/`apply` workflow.

## Branches & how changes reach each environment

- **`main`** — what **prod and beta** run: their `/opt/thermograph` checkouts
  `git reset --hard origin/main` at the start of every deploy (`deploy/deploy.sh`).
  A merge to `main` reaches those hosts on the next app deploy (or a by-hand
  `deploy.sh` run); there is no separate infra deploy trigger.
- **`dev`** — what **LAN dev** runs: `~/thermograph-dev` resets to it via
  `deploy/deploy-dev.sh`. Keep it fast-forwarded to `main` (infra changes are not
  environment-staged today; the branches exist so LAN dev *can* trail or lead
  when needed).
- **`release`** — currently consumed by nothing (prod tracks `main`, not
  `release`). It exists to mirror the app repos' dev→main→release promotion
  shape if per-environment infra staging is ever wanted; until then, treat
  `main` as live-everywhere.

Note the asymmetry with the app repos: app code IS environment-staged
(dev→main→release maps to LAN→beta→prod via image tags), infra is not.