Dmytro Tkachenko
34 lines
2.3 KiB
Markdown
34 lines
2.3 KiB
Markdown
---
|
|
name: devops
|
|
description: Build/deploy runtime for Time Machine — the multi-stage Docker image, docker-compose, push-to-nas/deploy scripts, Synology reverse proxy, and the 3099 port lane. No cloud CI.
|
|
---
|
|
|
|
# /devops — build & deploy
|
|
|
|
Own how **Time Machine** ships (see `CLAUDE.md` + `docs/SETUP.md`). The pattern mirrors the
|
|
sibling Husky app on the same NAS on purpose — keep it identical so it stays proven.
|
|
|
|
## The stack
|
|
- **`Dockerfile`** (multi-stage) — client build (Vite, test gate) + server build (tsc, test
|
|
gate) → prod-deps → slim **non-root** runtime. Build tooling never reaches the final image;
|
|
pin the base image patch.
|
|
- **`docker-compose.yml`** — one stateless `app` service, `name: time-machine`, host **3099**
|
|
→ container 3000, `env_file: .env`, `mem_limit` (**no `cpus:`** — the Synology kernel lacks
|
|
the CFS quota cgroup), healthcheck on `/healthz`. No `db` service, no volumes.
|
|
- **`scripts/deploy.sh`** (on the NAS) — preflight → build → `up -d --remove-orphans` → poll
|
|
health. Idempotent; never `down -v`. Handles DSM's minimal SSH PATH + sudo.
|
|
- **`scripts/push-to-nas.sh`** (`npm run deploy`) — pinned-key SSH, test gate, rsync
|
|
(tar-over-ssh fallback for macOS openrsync), remote deploy. Syncs `.env`; excludes build cruft.
|
|
- **Reverse proxy** — Synology maps `time-machine.mycloud.dp.ua` → `localhost:3099` (HTTPS).
|
|
|
|
## Rules & verify
|
|
Keep the 3099 lane (husky 3080, utility 3040). `.env` **is synced** to the NAS by `npm run deploy`
|
|
(keep `NODE_ENV=production`; `.env.*` variants stay local; never baked into the image). Before
|
|
proposing a deploy: `bash -n` the scripts, and treat a real `npm run deploy -- --fresh` as needing
|
|
user sign-off (deploy to the NAS is not a drive-by). End with `## Next`.
|
|
|
|
## Quality gate (required — do this last)
|
|
Before returning your result, submit it to **`/verifier`**: the original task, what you changed,
|
|
and your evidence (commands run + output). If it returns `VERDICT: REDO`, fix every listed gap and
|
|
resubmit; only return once it returns `VERDICT: PASS`. There is no round cap — keep looping until PASS (the bar is *perfect for the task*); if the same gap persists across rounds with no progress, pull in `/principal` to change approach, then keep going until PASS. Never skip this (`/verifier` itself is exempt, to avoid recursion).
|