siftlode/deploy/deploy.sh

#!/usr/bin/env bash
# Roll out the latest main branch to the public VPS instance.
#
# Layout on the host:
#   /srv/siftlode/src    git clone of this repo (build context + compose file)
#   /srv/siftlode/.env   secrets, mode 0600 (never in git)
#
# Build runs on the host Docker daemon, so it isn't constrained by the CI runner's memory.
set -euo pipefail

ROOT=/srv/siftlode
cd "$ROOT/src"

git fetch --quiet origin
git checkout --quiet main
git pull --ff-only --quiet

# Stamp the image with the version/commit being built (read by /api/version + the SPA).
export APP_VERSION="$(cat VERSION 2>/dev/null || echo dev)"
export GIT_SHA="$(git rev-parse --short HEAD)"
export BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"

docker compose -f docker-compose.prod.yml --env-file "$ROOT/.env" up -d --build
docker image prune -f >/dev/null || true
docker compose -f docker-compose.prod.yml --env-file "$ROOT/.env" ps
chore(deploy): hardened prod compose, rollout script, and CI for asgard docker-compose.prod.yml targets the public VPS: Postgres is never published, the app binds to 127.0.0.1 (Caddy proxies it), and every service has a memory/CPU cap plus no-new-privileges / cap_drop / read-only rootfs. deploy/deploy.sh rolls out main with a host-side build (migrations run via the entrypoint). CI type-checks and builds the frontend and byte-compiles the backend on every push to main. 2026-06-14 01:39:43 +02:00			`#!/usr/bin/env bash`
chore(repo): remove internal deployment plan, sanitize infra references Drop docs/deployment-plan.md (internal planning doc, kept out of the repo) and replace the personal lab DB IP and host names in the env/compose/deploy docs with generic placeholders, so the repo is safe to make public later. 2026-06-14 23:20:02 +02:00			`# Roll out the latest main branch to the public VPS instance.`
chore(deploy): hardened prod compose, rollout script, and CI for asgard docker-compose.prod.yml targets the public VPS: Postgres is never published, the app binds to 127.0.0.1 (Caddy proxies it), and every service has a memory/CPU cap plus no-new-privileges / cap_drop / read-only rootfs. deploy/deploy.sh rolls out main with a host-side build (migrations run via the entrypoint). CI type-checks and builds the frontend and byte-compiles the backend on every push to main. 2026-06-14 01:39:43 +02:00			`#`
chore(repo): remove internal deployment plan, sanitize infra references Drop docs/deployment-plan.md (internal planning doc, kept out of the repo) and replace the personal lab DB IP and host names in the env/compose/deploy docs with generic placeholders, so the repo is safe to make public later. 2026-06-14 23:20:02 +02:00			`# Layout on the host:`
chore: rebrand Subfeed -> Siftlode Rename all user-facing references (UI wordmark Sift+lode, titles, app name, legal pages, onboarding wizard, emails, README/docs) and infra paths (/srv/subfeed -> /srv/siftlode, image tag, deploy script, backup filenames). Internal identifiers kept on purpose: Postgres user/db "subfeed", logger namespace, localStorage keys, and the subfeed_pgdata volume (renaming would orphan the migrated production data). 2026-06-14 04:40:22 +02:00			`# /srv/siftlode/src git clone of this repo (build context + compose file)`
			`# /srv/siftlode/.env secrets, mode 0600 (never in git)`
chore(deploy): hardened prod compose, rollout script, and CI for asgard docker-compose.prod.yml targets the public VPS: Postgres is never published, the app binds to 127.0.0.1 (Caddy proxies it), and every service has a memory/CPU cap plus no-new-privileges / cap_drop / read-only rootfs. deploy/deploy.sh rolls out main with a host-side build (migrations run via the entrypoint). CI type-checks and builds the frontend and byte-compiles the backend on every push to main. 2026-06-14 01:39:43 +02:00			`#`
			`# Build runs on the host Docker daemon, so it isn't constrained by the CI runner's memory.`
			`set -euo pipefail`

chore: rebrand Subfeed -> Siftlode Rename all user-facing references (UI wordmark Sift+lode, titles, app name, legal pages, onboarding wizard, emails, README/docs) and infra paths (/srv/subfeed -> /srv/siftlode, image tag, deploy script, backup filenames). Internal identifiers kept on purpose: Postgres user/db "subfeed", logger namespace, localStorage keys, and the subfeed_pgdata volume (renaming would orphan the migrated production data). 2026-06-14 04:40:22 +02:00			`ROOT=/srv/siftlode`
chore(deploy): hardened prod compose, rollout script, and CI for asgard docker-compose.prod.yml targets the public VPS: Postgres is never published, the app binds to 127.0.0.1 (Caddy proxies it), and every service has a memory/CPU cap plus no-new-privileges / cap_drop / read-only rootfs. deploy/deploy.sh rolls out main with a host-side build (migrations run via the entrypoint). CI type-checks and builds the frontend and byte-compiles the backend on every push to main. 2026-06-14 01:39:43 +02:00			`cd "$ROOT/src"`

			`git fetch --quiet origin`
			`git checkout --quiet main`
			`git pull --ff-only --quiet`

feat(version): /api/version + build-time version/commit stamping Add a VERSION file (0.1.0) and inject APP_VERSION/GIT_SHA/BUILD_DATE as Docker build-args (both stages; Vite inlines them into the SPA). New public GET /api/version returns app_version, git_sha, build_date and the Alembic head as the database revision. deploy.sh and the localdev build pass the args. 2026-06-15 00:06:57 +02:00			`# Stamp the image with the version/commit being built (read by /api/version + the SPA).`
			`export APP_VERSION="$(cat VERSION 2>/dev/null \|\| echo dev)"`
			`export GIT_SHA="$(git rev-parse --short HEAD)"`
			`export BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"`

chore(deploy): hardened prod compose, rollout script, and CI for asgard docker-compose.prod.yml targets the public VPS: Postgres is never published, the app binds to 127.0.0.1 (Caddy proxies it), and every service has a memory/CPU cap plus no-new-privileges / cap_drop / read-only rootfs. deploy/deploy.sh rolls out main with a host-side build (migrations run via the entrypoint). CI type-checks and builds the frontend and byte-compiles the backend on every push to main. 2026-06-14 01:39:43 +02:00			`docker compose -f docker-compose.prod.yml --env-file "$ROOT/.env" up -d --build`
			`docker image prune -f >/dev/null \|\| true`
			`docker compose -f docker-compose.prod.yml --env-file "$ROOT/.env" ps`