b0txec
dc04f66b9d
deploy/vps/compose.yml hardcoded LVGMC_USER/PASSWORD/URL to inert
placeholder strings directly in the file, unlike POSTGRES_* which
already read from .env.staging — so simply adding real values to
.env.staging would have had no effect. Switched to the same
${VAR} substitution pattern, and enabled ENABLE_LVGMC_FTP_JOBS now
that real credentials exist. HARMONIE stays on placeholders pending
real DMI credentials.
WeatherTool VPS deployment bundle
This directory contains the reviewed templates for the temporary UAT deployment. It is intentionally separate from the Rocky development Compose project.
Boundaries
- Compose project:
weathertool-uat - WeatherTool host binding:
127.0.0.1:8002 - Authelia host binding:
127.0.0.1:9091 - PostgreSQL: private Docker network only; no host port
- App-to-database traffic: internal backend network
- Nginx-to-app/auth traffic: explicit loopback ports through a separate edge network
- Scheduled provider jobs: disabled
- Existing VPS applications, networks, volumes, and Nginx sites: untouched
The committed configuration contains no live password, password hash, or
cryptographic secret. Runtime material belongs only under /srv/weathertool.
Runtime layout
Copy the committed bundle into /srv/weathertool, then create these untracked
paths before the first start:
/srv/weathertool/
.env.staging
compose.yml
config/authelia/configuration.yml
config/authelia/users_database.yml
data/authelia/
data/postgres/
secrets/jwt_secret
secrets/session_secret
secrets/storage_encryption_key
The Nginx files remain examples until the domain, Cloudflare origin certificate, trusted client-address configuration, and private upstream tests are complete. Do not enable the virtual host merely because the containers start successfully.
WeatherTool application scratch files are intentionally ephemeral in a
non-executable in-memory /app/data filesystem. PostgreSQL is the durable
application data store; Authelia and PostgreSQL state use dedicated bind paths.
Release image
Build the exact committed revision on Rocky:
git archive HEAD | docker build \
-f deploy/vps/Dockerfile \
-t "weathertool:$(git rev-parse HEAD)" -
Export the image, calculate its SHA-256 checksum, transfer both files, verify the
checksum on the VPS, and only then load it. The detailed operator sequence is in
docs/VPS_STAGING_PLAN.md.