Robotail/Corp
Robotail/Corp
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Corp/ops/deploy
History

README.md

CORP production deployment

Production is deployed from the current master commit in the Gitea repository Robotail/Corp. The Gitea Actions runner only opens a restricted SSH connection; all validation, backup, build, migration, restart, health checks, and rollback are performed on the CORP server.

Bootstrap

  1. Generate a dedicated Ed25519 key pair for the runner. Never commit the private key.

  2. Copy the public key to the CORP server and install the restricted command:

    sudo /srv/eusrr/ops/deploy/install-corp-runner-access /tmp/eusrr-gitea-runner.pub

  3. Add the private key as the CORP_DEPLOY_SSH_KEY repository Actions secret in Gitea.

  4. Run Deploy production manually from the master branch and verify the result before enabling automatic runs on pushes to master.

The installer grants the deploy account no general root shell. The runner key is forced through /usr/local/sbin/eusrr-deploy-ssh, and the deployment command rejects every revision except the current origin/master SHA.

PostgreSQL snapshots are stored in /var/backups/eusrr/deploy for 14 days. The last successful revision is recorded in /var/lib/eusrr-deploy/last-successful-sha, and deployment output is appended to /var/log/eusrr-deploy.log.