b0txec
3eddf95008
Real LVGMC FTP credentials arrived today; real DMI HARMONIE credentials haven't. The combined flag would have enabled both the moment FTP's were ready, crash-looping the app on HARMONIE's still- placeholder values via parMapN — caught this before it happened (the Grib job was ~15 min from its first scheduled run). Split into ENABLE_LVGMC_FTP_JOBS and ENABLE_HARMONIE_JOBS so each provider can be enabled independently as its own credentials become real.
WeatherTool VPS deployment bundle
This directory contains the reviewed templates for the temporary UAT deployment. It is intentionally separate from the Rocky development Compose project.
Boundaries
- Compose project:
weathertool-uat - WeatherTool host binding:
127.0.0.1:8002 - Authelia host binding:
127.0.0.1:9091 - PostgreSQL: private Docker network only; no host port
- App-to-database traffic: internal backend network
- Nginx-to-app/auth traffic: explicit loopback ports through a separate edge network
- Scheduled provider jobs: disabled
- Existing VPS applications, networks, volumes, and Nginx sites: untouched
The committed configuration contains no live password, password hash, or
cryptographic secret. Runtime material belongs only under /srv/weathertool.
Runtime layout
Copy the committed bundle into /srv/weathertool, then create these untracked
paths before the first start:
/srv/weathertool/
.env.staging
compose.yml
config/authelia/configuration.yml
config/authelia/users_database.yml
data/authelia/
data/postgres/
secrets/jwt_secret
secrets/session_secret
secrets/storage_encryption_key
The Nginx files remain examples until the domain, Cloudflare origin certificate, trusted client-address configuration, and private upstream tests are complete. Do not enable the virtual host merely because the containers start successfully.
WeatherTool application scratch files are intentionally ephemeral in a
non-executable in-memory /app/data filesystem. PostgreSQL is the durable
application data store; Authelia and PostgreSQL state use dedicated bind paths.
Release image
Build the exact committed revision on Rocky:
git archive HEAD | docker build \
-f deploy/vps/Dockerfile \
-t "weathertool:$(git rev-parse HEAD)" -
Export the image, calculate its SHA-256 checksum, transfer both files, verify the
checksum on the VPS, and only then load it. The detailed operator sequence is in
docs/VPS_STAGING_PLAN.md.