82e68e89f0
All checks were successful
PR build (required check) / changes (pull_request) Successful in 9s
secrets-guard / encrypted (pull_request) Successful in 8s
PR build (required check) / build-frontend (pull_request) Has been skipped
PR build (required check) / build-backend (pull_request) Has been skipped
PR build (required check) / validate-observability (pull_request) Has been skipped
PR build (required check) / gate (pull_request) Successful in 2s
The lake was prod-stack-only; beta and LAN fell straight to NASA. Now the compose stack gets the same service (backend image, THERMOGRAPH_ROLE=lake, never host-published) and the backend points at it via THERMOGRAPH_LAKE_URL: - deploy.sh rolls lake with every backend deploy (same image, different role); deploy-stack.sh's backend leg updates it too, tolerating stacks that predate the service. - Creds: beta via the vault (added to beta.yaml); LAN via the Actions S3 secrets injected by backend-deploy-dev.yml (dev renders no vault). Without creds the service stays healthy and answers 503 — reads fall through to NASA, so a credential gap can never take a page down. - Dev overlay lifts the CPU caps like every other service. |
||
|---|---|---|
| .. | ||
| db | ||
| forgejo | ||
| migrations | ||
| openmeteo | ||
| secrets | ||
| stack | ||
| swarm | ||
| twa | ||
| Caddyfile | ||
| deploy-dev.sh | ||
| deploy.sh | ||
| migrate-db.py | ||
| POSTGRES-MIGRATION.md | ||
| provision-agent-access.sh | ||
| provision-dev-lan.sh | ||
| provision-mail.sh | ||
| provision-secrets.sh | ||
| render-secrets.sh | ||
| thermograph-dev.service | ||
| thermograph.env.example | ||
| thermograph.service | ||