bot/WeatherTool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prepare isolated VPS UAT deployment bundle

Browse Source
This commit is contained in:
b0txec
2026-08-20 19:22:03 +03:00
parent bd053b073c
commit 52922b8e7f
14 changed files with 379 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/DEVELOPMENT_AND_STAGING.md
+6 -1
View File
@@ -6,7 +6,7 @@
|---|---|---|
| Windows | Source editing and Git workflow only | Not applicable |
| Rocky Linux | Docker development and production-like staging | `http://192.168.1.101:9190` |
| Temporary VPS | Proposed month-long user-acceptance staging behind Cloudflare, Nginx, and Authelia | Not provisioned; hostname pending |
| Temporary VPS | Month-long user-acceptance staging behind Cloudflare, Nginx, and Authelia | `laikapstak.li` pending domain delivery and activation; services not started |
| Workplace production | Out of scope until reviewed and approved | Not documented here |
Rocky checkout:
@@ -124,3 +124,8 @@ Windows source and Git -> Rocky build and verification -> immutable image + chec
```
Releases are manual during user acceptance and are identified by the source commit SHA. The VPS keeps WeatherTool in its own `/srv/weathertool` tree, publishes the application only to a loopback port, and relies on Nginx plus Authelia at the public boundary. See `VPS_STAGING_PLAN.md` before provisioning or changing the VPS.
The committed templates live under `deploy/vps/`. They are not a second local
development environment. Validate them on Rocky, build the exact Git revision,
and transfer a checksummed image plus the minimal deployment files. Operational
environment files, password hashes, and Authelia secrets must remain VPS-only.
docs/README.md
+2 -2
View File
@@ -13,7 +13,7 @@ This directory contains the working documentation for the WeatherTool modernizat
- Faktiskā symbol placement is automatic after manual image selection and is anchored to each rendered temperature badge.
- The first **Ūdens temperatūra** workspace is implemented with manual Latvian-named fields and required 1920×1080 and 3840×1440 exports; visual calibration remains in progress.
- Confirmed local Monda Regular/Bold files provide interface and generated-graphic typography; weather symbols use normalized transparent image assets.
- The next proposed environment is a temporary, isolated VPS user-acceptance deployment built on Rocky, protected by Cloudflare, Nginx, and removable Authelia authentication. It has not yet been provisioned.
- A version-controlled bundle is being prepared for a temporary, isolated VPS user-acceptance deployment built on Rocky and protected by Cloudflare, Nginx, and removable Authelia authentication. VPS directories exist, but no WeatherTool service has been started.
- This is not yet approved or hardened for workplace production.
## Documents
@@ -23,7 +23,7 @@ This directory contains the working documentation for the WeatherTool modernizat
- [Product workflows](PRODUCT_WORKFLOWS.md) — the intended purpose and current status of each visible workspace.
- [Update roadmap](UPDATE_ROADMAP.md) — phased technical, security, dependency, testing, and UI work.
- [Third-party notices](THIRD_PARTY_NOTICES.md) — licenses and attribution for adapted interface components.
- [Temporary VPS staging plan](VPS_STAGING_PLAN.md) — proposed isolation, authentication, release, backup, verification, and rollback model for external user testing.
- [Temporary VPS staging plan](VPS_STAGING_PLAN.md) — isolation, authentication, prepared deployment bundle, release, backup, verification, and rollback model for external user testing.
## Documentation rules
docs/VPS_STAGING_PLAN.md
+33 -14
View File
@@ -1,6 +1,6 @@
# Temporary VPS staging plan
Status: **Proposed; WeatherTool has not been provisioned on the VPS**
Status: **Deployment bundle prepared; runtime directories created; services not started**
This document defines the next deployment stage for approximately one month of
newsroom-user testing. It records the intended boundary before any VPS changes
@@ -57,6 +57,10 @@ Temporary VPS
Cloudflare -> Nginx -> Authelia authorization -> WeatherTool
```
The host root plus `releases/` and `backups/` now exist with owner
`ubuntu:ubuntu` and mode `0750`. No Compose file, secret, image, database, or
running WeatherTool service has been placed there yet.
The VPS receives a built release artifact, not a development checkout. It gets
no credential or route for the Rocky Git repository, the private Forgejo
instance, or the home LAN.
@@ -91,9 +95,10 @@ WeatherTool will use:
- no shared Docker volumes, database, or application network with HOP or any
other service.
Only Nginx may expose WeatherTool publicly. PostgreSQL and Authelia's internal
service port must not be published to the internet. Docker port bindings must
not be allowed to bypass the intended firewall boundary.
Only Nginx may expose WeatherTool publicly. The committed bundle binds the app
to `127.0.0.1:8002`, binds the Authelia portal to `127.0.0.1:9091`, and gives
PostgreSQL no host port. Docker port bindings must not be allowed to bypass the
intended firewall boundary.
## Authentication boundary
@@ -123,7 +128,9 @@ include and Authelia service. The application remains unchanged.
## Domain, TLS, and Nginx
The WeatherTool hostname is not yet selected. Before DNS publication:
The selected application hostname is `laikapstak.li`; the authentication portal
will use `auth.laikapstak.li`. The OVH order and Cloudflare zone activation are
still pending. Before DNS publication:
1. Add an isolated Nginx virtual host without changing existing hosts.
2. Install a certificate valid for the exact WeatherTool/Authelia hostname or
@@ -138,9 +145,24 @@ The WeatherTool hostname is not yet selected. Before DNS publication:
9. Confirm TLS, static assets, login, logout, API calls, PNG downloads, real
client addresses, and direct-origin rejection.
Whether Authelia uses a dedicated `auth.<domain>` hostname or a subpath remains
an explicit deployment decision. A dedicated hostname is conventional; a
same-host subpath reduces DNS and certificate entries for this single app.
The dedicated authentication hostname is an explicit decision. Both hostnames
must be covered by the origin certificate and proxied through Cloudflare.
## Version-controlled deployment bundle
`deploy/vps/` now contains:
- a multi-stage production Dockerfile that builds both the Vite frontend and
Scala assembly, then runs as a non-root user;
- an isolated `weathertool-uat` Compose definition;
- an environment example with no operational secret;
- pinned Authelia `4.39.20` configuration and an example file-user database;
- official-style Nginx AuthRequest integration snippets; and
- a disabled Nginx virtual-host example for the app and auth portal.
The bundle is a template until it passes Compose rendering, Authelia validation,
image build, container health, and private loopback smoke tests. Nginx activation
and public DNS remain later checkpoints.
## Manual release procedure
@@ -202,13 +224,10 @@ Proposed temporary-staging minimum:
## Decisions and prerequisites still open
- Final public hostname and Cloudflare zone.
- Dedicated Authelia hostname versus same-host subpath.
- Confirmed VPS capacity and unused loopback port.
- Completion of the OVH order, nameserver delegation, and Cloudflare activation.
- Cloudflare origin certificate covering both selected hostnames.
- Deployment account and whether normal releases use public SSH or Tailscale.
- Final session and backup-retention values.
- Secure operator-side generation and delivery of the shared credential.
- A production Dockerfile/Compose definition validated independently from the
Rocky development Compose file.
- Validation of the prepared production Dockerfile/Compose bundle on Rocky.
- Health/readiness behavior suitable for automated release verification.