575bdefd0e
docker-compose.prod.yml targets the public VPS: Postgres is never published, the app binds to 127.0.0.1 (Caddy proxies it), and every service has a memory/CPU cap plus no-new-privileges / cap_drop / read-only rootfs. deploy/deploy.sh rolls out main with a host-side build (migrations run via the entrypoint). CI type-checks and builds the frontend and byte-compiles the backend on every push to main.
20 lines
658 B
Bash
Executable file
20 lines
658 B
Bash
Executable file
#!/usr/bin/env bash
|
|
# Roll out the latest main branch to the public asgard instance.
|
|
#
|
|
# Layout on asgard:
|
|
# /srv/subfeed/src git clone of this repo (build context + compose file)
|
|
# /srv/subfeed/.env secrets, mode 0600 (never in git)
|
|
#
|
|
# Build runs on the host Docker daemon, so it isn't constrained by the CI runner's memory.
|
|
set -euo pipefail
|
|
|
|
ROOT=/srv/subfeed
|
|
cd "$ROOT/src"
|
|
|
|
git fetch --quiet origin
|
|
git checkout --quiet main
|
|
git pull --ff-only --quiet
|
|
|
|
docker compose -f docker-compose.prod.yml --env-file "$ROOT/.env" up -d --build
|
|
docker image prune -f >/dev/null || true
|
|
docker compose -f docker-compose.prod.yml --env-file "$ROOT/.env" ps
|