Prepare isolated VPS UAT deployment bundle

2026-08-20 19:22:03 +03:00
parent bd053b073c
commit 52922b8e7f
14 changed files with 379 additions and 17 deletions
@@ -0,0 +1,53 @@
+# WeatherTool VPS deployment bundle
+
+This directory contains the reviewed templates for the temporary UAT deployment.
+It is intentionally separate from the Rocky development Compose project.
+
+## Boundaries
+
+- Compose project: `weathertool-uat`
+- WeatherTool host binding: `127.0.0.1:8002`
+- Authelia host binding: `127.0.0.1:9091`
+- PostgreSQL: private Docker network only; no host port
+- Scheduled provider jobs: disabled
+- Existing VPS applications, networks, volumes, and Nginx sites: untouched
+
+The committed configuration contains no live password, password hash, or
+cryptographic secret. Runtime material belongs only under `/srv/weathertool`.
+
+## Runtime layout
+
+Copy the committed bundle into `/srv/weathertool`, then create these untracked
+paths before the first start:
+
+```text
+/srv/weathertool/
+  .env.staging
+  compose.yml
+  config/authelia/configuration.yml
+  config/authelia/users_database.yml
+  data/app/
+  data/authelia/
+  data/postgres/
+  secrets/jwt_secret
+  secrets/session_secret
+  secrets/storage_encryption_key
+```
+
+The Nginx files remain examples until the domain, Cloudflare origin certificate,
+trusted client-address configuration, and private upstream tests are complete.
+Do not enable the virtual host merely because the containers start successfully.
+
+## Release image
+
+Build the exact committed revision on Rocky:
+
+```bash
+git archive HEAD | docker build \
+  -f deploy/vps/Dockerfile \
+  -t "weathertool:$(git rev-parse HEAD)" -
+```
+
+Export the image, calculate its SHA-256 checksum, transfer both files, verify the
+checksum on the VPS, and only then load it. The detailed operator sequence is in
+`docs/VPS_STAGING_PLAN.md`.