thermograph/infra/README.md

infra/

Infrastructure for Thermograph: Terraform host provisioning, the SOPS+age secrets vault, WireGuard/Swarm networking, Forgejo, Caddy, mail, and the deploy scripts that run the already-built app images on each host. This is a domain of the emi/thermograph monorepo — hosts' /opt/thermograph is a checkout of the whole monorepo, and infra/ never builds app source; it only runs published images.

• terraform/ — provisions/configures hosts (SSH-driven by default; an optional GCP-creating module is scaffolded, no live resources yet). See terraform/README.md. No tfstate is persisted anywhere — treat apply as executable documentation, not a routine operation.
• deploy/secrets/ — the git-native SOPS+age secrets vault (every app secret, encrypted at rest, rendered at deploy time). See deploy/secrets/README.md.
• deploy/swarm/, deploy/forgejo/ — the WireGuard/Swarm cluster hosting Forgejo (git + CI + registry). See ACCESS.md.
• deploy/deploy.sh — the single deploy entry point for beta and prod. Takes SERVICE=backend|frontend|all plus BACKEND_IMAGE_TAG/FRONTEND_IMAGE_TAG, resets the host checkout, renders secrets, and routes to the right orchestrator.
• deploy/stack/ — the Swarm path, live on prod: thermograph-stack.yml (db, web, worker, lake, daemon, frontend, autoscaler, autoscaler-lake), deploy-stack.sh, autoscale.sh, and the LB. Rolling updates are start-first, health-gated, with auto-rollback. STACK_TEST=1 rehearses the whole stack on throwaway volumes and ports.
• docker-compose*.yml — the compose path, live on beta and LAN dev (db, backend, lake, daemon, frontend). docker-compose.dev.yml is the LAN overlay; docker-compose.openmeteo.yml is the self-hosted Open-Meteo overlay.

Which path a host takes is decided by /etc/thermograph/deploy-mode: the string stack makes deploy.sh exec deploy/stack/deploy-stack.sh; anything else is compose. The workflows never need to know which mode a host runs.

Branches & how changes reach each environment

• main — what prod and beta run. infra-sync.yml fires on a push to main touching infra/**, fast-forwards each host's /opt/thermograph checkout and re-renders /etc/thermograph.env from the vault. It deliberately does not roll any service: image tags are the app domains' axis, not infra's. A compose or stack change that must recreate containers takes effect on the next app deploy, or a by-hand SERVICE=all … deploy/deploy.sh.
• dev — what LAN dev would run via deploy/deploy-dev.sh. The CI trigger for this is currently inert (the LAN box still holds a split-era checkout); use make dev-up locally.
• release — consumed by app deploys only. Both hosts track infra via main; prod's app images are staged by release, but its checkout follows main.

Note the asymmetry with the app domains: app code IS environment-staged (dev→main→release maps to LAN→beta→prod via image tags); infra is not.