b0txec
1086c8b548
The ltv account fails to authenticate from the VPS specifically (works fine from Rocky with the same credentials, network path to ftp.meteo.lv:21 confirmed fine from the VPS too) — narrowed to either a password transcription error in .env.staging or LVGMC IP-allowlisting the account, neither confirmable without inspecting the password. Caught via the overnight watch this was set up for rather than assumed safe; reverted ENABLE_LVGMC_FTP_JOBS to false on the VPS immediately once the failure was confirmed real, restoring stable operation. FTP stays enabled on Rocky, where it works.
WeatherTool VPS deployment bundle
This directory contains the reviewed templates for the temporary UAT deployment. It is intentionally separate from the Rocky development Compose project.
Boundaries
- Compose project:
weathertool-uat - WeatherTool host binding:
127.0.0.1:8002 - Authelia host binding:
127.0.0.1:9091 - PostgreSQL: private Docker network only; no host port
- App-to-database traffic: internal backend network
- Nginx-to-app/auth traffic: explicit loopback ports through a separate edge network
- Scheduled provider jobs: disabled
- Existing VPS applications, networks, volumes, and Nginx sites: untouched
The committed configuration contains no live password, password hash, or
cryptographic secret. Runtime material belongs only under /srv/weathertool.
Runtime layout
Copy the committed bundle into /srv/weathertool, then create these untracked
paths before the first start:
/srv/weathertool/
.env.staging
compose.yml
config/authelia/configuration.yml
config/authelia/users_database.yml
data/authelia/
data/postgres/
secrets/jwt_secret
secrets/session_secret
secrets/storage_encryption_key
The Nginx files remain examples until the domain, Cloudflare origin certificate, trusted client-address configuration, and private upstream tests are complete. Do not enable the virtual host merely because the containers start successfully.
WeatherTool application scratch files are intentionally ephemeral in a
non-executable in-memory /app/data filesystem. PostgreSQL is the durable
application data store; Authelia and PostgreSQL state use dedicated bind paths.
Release image
Build the exact committed revision on Rocky:
git archive HEAD | docker build \
-f deploy/vps/Dockerfile \
-t "weathertool:$(git rev-parse HEAD)" -
Export the image, calculate its SHA-256 checksum, transfer both files, verify the
checksum on the VPS, and only then load it. The detailed operator sequence is in
docs/VPS_STAGING_PLAN.md.