Jinemi/thermograph
4
0
Fork 0
Code Issues 2 Pull requests 9 Projects Releases Packages Wiki Activity Actions
thermograph/infra/CLAUDE.md
Emi Griffith ae1d9bb534 Subtree-merge thermograph-infra (origin/main) into infra/ 
git-subtree-dir: infra
git-subtree-mainline: d6df04eab2
git-subtree-split: 99b4b3f78d
2026-07-22 22:01:11 -07:00

2.2 KiB
Raw Blame History

thermograph-infra — agent instructions

How and where the already-built Thermograph app images run. This repo owns Terraform, the SOPS+age secrets vault, compose files, deploy scripts, host provisioning, and the ops cron (DB backup + IndexNow). The app repos (thermograph-backend, thermograph-frontend) own building and testing the images; this repo never checks out app source. The old monorepo (emi/thermograph) is archived — do not point anything at it.

The four machines

Same as ACCESS.md: dev machine (operator's box, LAN dev server, CI runner), prod (169.58.46.181, thermograph.org, agent user, passwordless sudo), beta (75.119.132.91, beta.thermograph.org + Forgejo, agent user). Hosts' /opt/thermograph (and LAN's ~/thermograph-dev) are checkouts of THIS repo.

Deploys

  • deploy/deploy.sh — the one deploy path (prod/beta): resets this repo's checkout, renders secrets from the SOPS vault, pulls the per-service image tags (BACKEND_IMAGE_TAG/FRONTEND_IMAGE_TAG, persisted in untracked deploy/.image-tags.env), rolls the target service, health-checks via container healthchecks. Invoked over SSH by the app repos' deploy workflows.
  • deploy/deploy-dev.sh — thin LAN-dev wrapper around deploy.sh (dev compose overlay, ~/thermograph-dev, branch dev).
  • Branch model: see README — infra main is live on prod+beta, dev on LAN; release is currently unused. App code is env-staged via image tags; infra is not.

Rules

  • Never run terraform apply casually — no tfstate exists anywhere (never persisted), so an apply would attempt full re-provisioning of live hosts. Terraform here is executable documentation until state is bootstrapped.
  • Secrets: only via the SOPS vault (deploy/secrets/*.yaml, sops edit + commit + deploy). Never hand-edit /etc/thermograph.env on a SOPS-enabled host — it's a rendered artifact. secrets-guard CI rejects plaintext.
  • The ops cron (.forgejo/workflows/ops-cron.yml) is THE prod backup — it uses this repo's PROD_SSH_* Actions secrets. If you touch it, verify a dump actually lands in agent@prod:~/thermograph-backups/.
  • Commits/PRs: concise and technical; never mention AI/assistants/automated authorship.