# thermograph-infra — agent instructions

How and where the already-built Thermograph app images run. This repo owns
Terraform, the SOPS+age secrets vault, compose files, deploy scripts, host
provisioning, and the ops cron (DB backup + IndexNow). The app repos
(`thermograph-backend`, `thermograph-frontend`) own building and testing the
images; this repo never checks out app source. The old monorepo
(`emi/thermograph`) is archived — do not point anything at it.

## The four machines

Same as ACCESS.md: **dev machine** (operator's box, LAN dev server, CI runner),
**prod** (`169.58.46.181`, thermograph.org, `agent` user, passwordless sudo),
**beta** (`75.119.132.91`, beta.thermograph.org + Forgejo, `agent` user). Hosts'
`/opt/thermograph` (and LAN's `~/thermograph-dev`) are checkouts of THIS repo.

## Deploys

- `deploy/deploy.sh` — the one deploy path (prod/beta): resets this repo's
  checkout, renders secrets from the SOPS vault, pulls the per-service image
  tags (`BACKEND_IMAGE_TAG`/`FRONTEND_IMAGE_TAG`, persisted in untracked
  `deploy/.image-tags.env`), rolls the target service, health-checks via
  container healthchecks. Invoked over SSH by the app repos' deploy workflows.
- `deploy/deploy-dev.sh` — thin LAN-dev wrapper around deploy.sh (dev compose
  overlay, `~/thermograph-dev`, branch `dev`).
- Branch model: see README — infra `main` is live on prod+beta, `dev` on LAN;
  `release` is currently unused. App code is env-staged via image tags; infra
  is not.

## Rules

- **Never run `terraform apply` casually** — no tfstate exists anywhere (never
  persisted), so an apply would attempt full re-provisioning of live hosts.
  Terraform here is executable documentation until state is bootstrapped.
- Secrets: only via the SOPS vault (`deploy/secrets/*.yaml`, `sops edit` +
  commit + deploy). Never hand-edit `/etc/thermograph.env` on a SOPS-enabled
  host — it's a rendered artifact. `secrets-guard` CI rejects plaintext.
- The ops cron (`.forgejo/workflows/ops-cron.yml`) is THE prod backup — it uses
  this repo's `PROD_SSH_*` Actions secrets. If you touch it, verify a dump
  actually lands in `agent@prod:~/thermograph-backups/`.
- Commits/PRs: concise and technical; never mention AI/assistants/automated
  authorship.