4e97d8e5dc
All checks were successful
PR build (required check) / changes (pull_request) Successful in 6s
secrets-guard / encrypted (pull_request) Successful in 5s
PR build (required check) / build-backend (pull_request) Has been skipped
shell-lint / shellcheck (pull_request) Successful in 7s
PR build (required check) / build-frontend (pull_request) Has been skipped
PR build (required check) / validate-observability (pull_request) Successful in 18s
PR build (required check) / gate (pull_request) Successful in 2s
Environments stop being machines. Until now each box WAS an environment --
"beta" named both a deploy target and a host, "the desktop" named both the
operator's computer and the dev server -- so every path could assume one
environment per host and hardcode /opt/thermograph, /etc/thermograph.env and
ports 8137/8080. That assumption ends here:
vps1 75.119.132.91 Forgejo, Grafana/Loki, the portfolio site, and DEV
(own Postgres, mesh-only on 10.10.0.2:8137)
vps2 169.58.46.181 PROD and BETA as two Swarm stacks sharing one
TimescaleDB instance, plus Centralis, Postfix, backups
desktop AI model hosting + flex Swarm capacity, no environment
Nothing live has moved; the ordered cutover is in
infra/deploy/RUNBOOK-vps1-vps2-cutover.md.
deploy/env-topology.sh is the single source of truth: env -> host, checkout,
branch, deploy mode, stack name, env file, LB ports, DB role/database, service
prefix. THERMOGRAPH_ENV is the input, and on vps2 it is the only thing
distinguishing a beta deploy from a prod one -- deploy.sh refuses to run when it
disagrees with the checkout it was invoked from. The host-wide secrets-env and
deploy-mode markers survive only as a fallback for a single-environment box.
Beta gets its own stack file rather than an overlay (a merge cannot REMOVE the
db service, and beta having no database of its own is the point). Its services
are prefixed beta-*: Swarm registers a service's short name as a DNS alias on
every network it joins, so two stacks both calling a service `web` on the shared
data network would let prod's frontend resolve a beta task. Prod's stack, env
and LB config are untouched.
One Postgres, two databases with two roles: deploy/db/provision-env-db.sh
creates thermograph_beta (NOSUPERUSER, owns only its own database, CONNECT
revoked from PUBLIC) plus a <role>_ro for ad-hoc queries, and refuses to run for
the environment that owns the instance -- doing so would demote prod's bootstrap
superuser.
Fixes that co-residency would otherwise have broken silently:
- CI secrets are keyed by host (VPS1_SSH_*, VPS2_SSH_*). SSH_* meant "beta" and
also "the Forgejo box" because those shared a machine; that conflation is what
once had the prod backup dumping beta.
- The nightly backup dumps BOTH application databases to separate off-box
prefixes, and fails loudly on a missing one instead of skipping it.
- Alloy stopped deriving the `host` label from the node -- on vps2 that would
have filed every beta line as prod, feeding prod's alert rules with beta's
traffic. It is now derived per source, with a new `node` label for the machine,
and beta's log volume is mounted via a vps2-only overlay.
- ops/dbq.sh, ops/iceberg.sh and the secrets seed scripts derived their SSH
target and env-file path from the topology instead of hardcoding beta to
75.119.132.91 -- which is vps1's address now.
- Dev's overlay binds DEV_BIND_ADDR (loopback by default, the mesh address on
vps1) instead of 0.0.0.0: correct for a home LAN box, a public exposure of
unreviewed branches on a VPS.
Terraform's hosts variable is keyed by machine with a nested environments map,
and main.tf flattens (host, environment) pairs so two environments on one box
cannot share a checkout. Caddy's single reference config is split per host.
Docs, onboarding and the runbooks are updated throughout, including the security
rationales that co-residency makes false: separate SSH credentials no longer put
a host boundary between beta and prod, and the boundary that remains is the
database and the filesystem.
85 lines
4.3 KiB
YAML
85 lines
4.3 KiB
YAML
# Dev overlay for the LAN dev server (deploy/deploy-dev.sh):
|
|
#
|
|
# docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d
|
|
#
|
|
# Split-repo adaptation: the monorepo's docker-compose.dev.yml (see
|
|
# thermograph/docker-compose.dev.yml) overlaid a base file where backend and
|
|
# frontend had `build: .` -- dev's whole point there was `--build` in place from
|
|
# the working checkout. This infra repo holds no Dockerfile at all (each service's
|
|
# lives in its own app repo, thermograph-backend / thermograph-frontend), so the
|
|
# base docker-compose.yml already has NO `build:` for either service, only
|
|
# `image: .../${BACKEND_IMAGE_PATH}:${BACKEND_IMAGE_TAG}` (and the frontend
|
|
# equivalent) -- same registry-pull model as prod/beta, just pointed at a dev tag
|
|
# by deploy-dev.sh. This overlay must NOT reintroduce `build:`; it only relaxes
|
|
# resource caps and LAN-exposes a port, same as the monorepo overlay did.
|
|
#
|
|
# Differences from the prod stack:
|
|
# 1. backend is published on ${DEV_BIND_ADDR}, defaulting to LOOPBACK.
|
|
#
|
|
# This used to be a flat 0.0.0.0:8137, from when dev ran on the operator's
|
|
# LAN box and the point was for phones on the Wi-Fi to reach it. Dev now
|
|
# runs on vps1, a public VPS, where 0.0.0.0 would publish whatever
|
|
# unreviewed branch is in flight to the entire internet — with no Caddy, no
|
|
# TLS and no auth in front of it.
|
|
#
|
|
# So the default is 127.0.0.1 (safe anywhere, including a laptop running
|
|
# `make dev-up`), and deploy.sh sets DEV_BIND_ADDR to the environment's mesh
|
|
# address from deploy/env-topology.sh — 10.10.0.2 on vps1. Dev is then
|
|
# reachable at http://10.10.0.2:8137 from anything on the WireGuard mesh and
|
|
# from nowhere else. There is deliberately no dev DNS record and no Caddy
|
|
# site block for it.
|
|
# 2. frontend's port publish is dropped entirely -- dev has no Caddy to reach it
|
|
# directly, so it stays compose-internal-only, reached solely through
|
|
# backend's own reverse-proxy fallback (THERMOGRAPH_FRONTEND_BASE_INTERNAL,
|
|
# see backend/web/app.py's _proxy_to_frontend in the backend repo). This
|
|
# keeps the dev stack serving the one URL it always has, at :8137.
|
|
# 3. The CPU caps are removed -- dev runs UNCAPPED (no thread/CPU limits), unlike
|
|
# prod's backend=4 / frontend=2 / db=2 allocation. `!reset` drops the base
|
|
# value (both the top-level `cpus:` and the Swarm-style `deploy.resources`
|
|
# block the base file carries for parity).
|
|
# 4. backend/daemon/lake get a second env_file entry pointing at an OPTIONAL
|
|
# copy of the render under $APP_DIR (`required: false`, so it is a no-op
|
|
# when absent). It exists for snap-packaged Docker, which is confined to
|
|
# $HOME and cannot see /etc/thermograph.env at all — not a permissions
|
|
# error; the file simply does not exist as far as snap-confined Docker is
|
|
# concerned, so the base file's env_file entry silently loads nothing.
|
|
# deploy-dev.sh now produces the mirror ONLY when it detects snap Docker,
|
|
# which vps1 (ordinary apt Docker) is not — there, dev reads
|
|
# /etc/thermograph.env like beta and prod do, and no plaintext copy of the
|
|
# render is written into the checkout. compose appends env_file lists across
|
|
# overlays (last-wins on duplicate keys), so this stays additive.
|
|
services:
|
|
backend:
|
|
ports: !override
|
|
- "${DEV_BIND_ADDR:-127.0.0.1}:8137:8137"
|
|
cpus: !reset null
|
|
deploy: !reset null
|
|
env_file:
|
|
- path: ./deploy/dev-secrets.env
|
|
required: false
|
|
frontend:
|
|
ports: !reset null
|
|
cpus: !reset null
|
|
deploy: !reset null
|
|
# Same uncapped-on-dev treatment for the daemon; it has no ports to touch
|
|
# (outbound-only in every environment).
|
|
daemon:
|
|
cpus: !reset null
|
|
deploy: !reset null
|
|
env_file:
|
|
- path: ./deploy/dev-secrets.env
|
|
required: false
|
|
db:
|
|
cpus: !reset null
|
|
deploy: !reset null
|
|
lake:
|
|
cpus: !reset null
|
|
deploy: !reset null
|
|
# Uncapped memory on dev too (prod ceilings it at 8g). The Postgres/DuckDB
|
|
# memory *budget* is still the ~8 GB derived by deploy/db/init/20-tuning.sh from
|
|
# the default DB_MEMORY (raise DB_MEMORY to give dev more); shm_size stays (it's
|
|
# required shared memory for parallel query, not a limit).
|
|
mem_limit: !reset null
|
|
env_file:
|
|
- path: ./deploy/dev-secrets.env
|
|
required: false
|