peter/siftlode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(deploy): hardened prod compose, rollout script, and CI for asgard

Browse source 
docker-compose.prod.yml targets the public VPS: Postgres is never published, the
app binds to 127.0.0.1 (Caddy proxies it), and every service has a memory/CPU cap
plus no-new-privileges / cap_drop / read-only rootfs. deploy/deploy.sh rolls out
main with a host-side build (migrations run via the entrypoint). CI type-checks
and builds the frontend and byte-compiles the backend on every push to main.
This commit is contained in:
npeter83 2026-06-14 01:39:43 +02:00
parent b040381d02
commit 575bdefd0e
4 changed files with 180 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
deploy/deploy.sh Executable file
View file

@ -0,0 +1,20 @@
#!/usr/bin/env bash
# Roll out the latest main branch to the public asgard instance.
#
# Layout on asgard:
# /srv/subfeed/src git clone of this repo (build context + compose file)
# /srv/subfeed/.env secrets, mode 0600 (never in git)
#
# Build runs on the host Docker daemon, so it isn't constrained by the CI runner's memory.
set -euo pipefail
ROOT=/srv/subfeed
cd "$ROOT/src"
git fetch --quiet origin
git checkout --quiet main
git pull --ff-only --quiet
docker compose -f docker-compose.prod.yml --env-file "$ROOT/.env" up -d --build
docker image prune -f >/dev/null || true
docker compose -f docker-compose.prod.yml --env-file "$ROOT/.env" ps