e84b1f7937
Some checks failed
shell-lint / shellcheck (push) Has been cancelled
secrets-guard / encrypted (push) Has been cancelled
Validate observability stack / validate (push) Successful in 33s
Build + push backend image (Forgejo registry) / build-push (push) Successful in 3m5s
Deploy frontend to LAN dev server / build (push) Successful in 3m21s
Build + push frontend image (Forgejo registry) / build-push (push) Successful in 3m27s
Deploy backend to LAN dev server / build (push) Successful in 4m16s
Deploy frontend to LAN dev server / deploy (push) Successful in 31s
Deploy backend to LAN dev server / deploy (push) Successful in 1m19s
34 lines
1.9 KiB
Markdown
34 lines
1.9 KiB
Markdown
# thermograph
|
|
|
|
The Thermograph monorepo — the split repos reunified (2026-07-22) with full
|
|
history via subtree merges, while keeping everything the split was actually
|
|
for: **per-domain images, per-domain deploys, and an async FE/BE contract**.
|
|
|
|
## Domains
|
|
|
|
| Dir | What | CI |
|
|
|---|---|---|
|
|
| `backend/` | FastAPI graded-climate API, accounts, notifications (Discord bot, push, mail), data pipeline | `backend-build-push` → image `emi/thermograph/backend`; `backend-deploy[-prod\|-dev]` |
|
|
| `frontend/` | Public client: static JS/CSS + SSR pages | `frontend-*` mirrors of the above; image `emi/thermograph/frontend` |
|
|
| `infra/` | Compose (beta, LAN dev) + the Swarm stack (prod), deploy scripts, terraform, SOPS secrets vault, ops cron | `infra-sync` (host checkout + secrets render), `secrets-guard`, `ops-cron` |
|
|
| `observability/` | Loki + Grafana + Alloy stack | `observability-validate` |
|
|
|
|
`thermograph-docs` deliberately **stays its own repo** (ADRs + runbooks, no
|
|
build artifacts, different change cadence).
|
|
|
|
## How CI stays decoupled
|
|
|
|
Every workflow in `.forgejo/workflows/` is **path-filtered to its domain**: a
|
|
push touching only `frontend/**` builds/deploys nothing else. Images stay
|
|
separate (`emi/thermograph/backend`, `emi/thermograph/frontend`, each tagged
|
|
`sha-<12hex>`), deploys stay per-service (`infra/deploy/deploy.sh
|
|
SERVICE=backend|frontend|all`), and the API version contract
|
|
(`GET /api/version`, `PAYLOAD_VER`) still lets FE and BE ship out of lockstep.
|
|
The one intentionally *coupled* piece is `pr-build.yml`: a single always-running
|
|
`gate` required check that builds only the domains a PR touches (a
|
|
path-filtered required check would deadlock auto-merge).
|
|
|
|
Branch model (unchanged from the split era): PRs → `dev`, `main` → beta,
|
|
`release` → prod; infra tracked via `main` on all hosts.
|
|
|
|
**Before pointing anything live at this repo, read `CUTOVER-NOTES.md`.**
|