thermograph/infra

thermograph-infra

Infrastructure for Thermograph: Terraform host provisioning, the SOPS+age secrets vault, Docker Swarm/WireGuard networking, Forgejo, Caddy, and the deploy scripts that run the already-built app image on each host. Extracted from the app monorepo (emi/thermograph) — the app repo owns building and testing the app; this repo owns running it.

• terraform/ — provisions/configures hosts (SSH-driven by default; an optional GCP-creating module is scaffolded, no live resources yet) and triggers each deploy. See terraform/README.md.
• deploy/secrets/ — the git-native SOPS+age secrets vault (every app secret, encrypted at rest, rendered at deploy time). See deploy/secrets/README.md.
• deploy/swarm/, deploy/forgejo/ — the 3-node WireGuard/Swarm cluster that hosts Forgejo (git + CI + registry); does not run the app itself. See ACCESS.md and the READMEs under each directory.
• deploy/deploy.sh — pulls the pinned app image (IMAGE_TAG) and rolls the compose stack; invoked by Terraform and by the app repo's .forgejo/workflows/deploy.yml over SSH.
• docker-compose*.yml, docker-stack.yml — how the app image runs (compose in production today; docker-stack.yml is a design record for a possible future Swarm-based app deploy, not currently live).

The app's own source, Dockerfile, and build/test CI stay in the app repo — this repo never checks out app source; hosts only pull tagged images from the registry. See ACCESS.md for host access and the Swarm/Forgejo topology, and terraform/README.md for the day-to-day plan/apply workflow.

Branches & how changes reach each environment

• main — what prod and beta run: their /opt/thermograph checkouts git reset --hard origin/main at the start of every deploy (deploy/deploy.sh). A merge to main reaches those hosts on the next app deploy (or a by-hand deploy.sh run); there is no separate infra deploy trigger.
• dev — what LAN dev runs: ~/thermograph-dev resets to it via deploy/deploy-dev.sh. Keep it fast-forwarded to main (infra changes are not environment-staged today; the branches exist so LAN dev can trail or lead when needed).
• release — currently consumed by nothing (prod tracks main, not release). It exists to mirror the app repos' dev→main→release promotion shape if per-environment infra staging is ever wanted; until then, treat main as live-everywhere.

Note the asymmetry with the app repos: app code IS environment-staged (dev→main→release maps to LAN→beta→prod via image tags), infra is not.