build(deploy): the server's checkout is ~deploy/halkyon, the repository's name
The folder kept its name from before the monorepo (ADR 0015), though Train and Todo deploy from it too. redeploy.sh, the backup's units and the operator's steps name ~deploy/halkyon; the Compose project keeps the name halkyon-learn, as Docker names its volumes after it. The server moves after this is deployed: the running redeploy.sh is read whole before it runs, so the deploy of this commit still works in the old folder; then the folder is moved, the pinned commands in deploy's authorized_keys and the backup's units changed, and the containers recreated on the new paths. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
parent
384fc38919
commit
5469ce791f
GPG key ID:
07F6FCF405488B64
5 changed files with 36 additions and 33 deletions
|
|
@ -6,7 +6,7 @@
|
|||
# would protect little: it keeps to the basics.
|
||||
[Unit]
|
||||
Description=Off-site backup of learn.halkyon.eu's database
|
||||
Documentation=file:///home/deploy/halkyon-learn/deploy/backups.md
|
||||
Documentation=file:///home/deploy/halkyon/deploy/backups.md
|
||||
After=network-online.target docker.service
|
||||
Wants=network-online.target
|
||||
|
||||
|
|
@ -14,7 +14,7 @@ Wants=network-online.target
|
|||
Type=oneshot
|
||||
User=deploy
|
||||
Group=deploy
|
||||
ExecStart=/home/deploy/halkyon-learn/deploy/backup.sh
|
||||
ExecStart=/home/deploy/halkyon/deploy/backup.sh
|
||||
PrivateTmp=yes
|
||||
NoNewPrivileges=yes
|
||||
ProtectSystem=full
|
||||
|
|
|
|||
|
|
@ -112,20 +112,20 @@ echo 'sftp:storagebox:restic' >~/.config/restic/repository
|
|||
cat ~/.config/restic/password # into the password manager
|
||||
export RESTIC_REPOSITORY_FILE=~/.config/restic/repository RESTIC_PASSWORD_FILE=~/.config/restic/password
|
||||
restic init
|
||||
~/halkyon-learn/deploy/backup.sh # the first backup, by hand
|
||||
~/halkyon/deploy/backup.sh # the first backup, by hand
|
||||
```
|
||||
|
||||
### 4. The timer (an admin with sudo, on the server)
|
||||
|
||||
```sh
|
||||
sudo cp /home/deploy/halkyon-learn/deploy/backup/halkyon-backup.service \
|
||||
/home/deploy/halkyon-learn/deploy/backup/halkyon-backup.timer /etc/systemd/system/
|
||||
sudo cp /home/deploy/halkyon/deploy/backup/halkyon-backup.service \
|
||||
/home/deploy/halkyon/deploy/backup/halkyon-backup.timer /etc/systemd/system/
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable --now halkyon-backup.timer
|
||||
systemctl list-timers halkyon-backup.timer
|
||||
```
|
||||
|
||||
The units name `/home/deploy/halkyon-learn`; another checkout needs them changed.
|
||||
The units name `/home/deploy/halkyon`; another checkout needs them changed.
|
||||
|
||||
## Looking at the backups
|
||||
|
||||
|
|
@ -138,7 +138,7 @@ restic check --read-data-subset=5% # reads a twentieth of the data back
|
|||
|
||||
## Restoring
|
||||
|
||||
As `deploy`, in `~/halkyon-learn/deploy`, with the two variables from step 3 exported:
|
||||
As `deploy`, in `~/halkyon/deploy`, with the two variables from step 3 exported:
|
||||
|
||||
```sh
|
||||
export RESTIC_REPOSITORY_FILE=~/.config/restic/repository RESTIC_PASSWORD_FILE=~/.config/restic/password
|
||||
|
|
|
|||
|
|
@ -18,6 +18,9 @@
|
|||
# switched on in .env (COMPOSE_FILE=compose.yaml:compose.jellyfin.yaml): each adds its
|
||||
# service and mounts its site into Caddy's sidecars/ folder (sidecars/README.md).
|
||||
|
||||
# Never renamed, though the checkout's folder is ~deploy/halkyon since 2 Nov 2026: Docker
|
||||
# names the volumes (the database, people's files, the releases' repositories) and the
|
||||
# edge network after the project, and under a new name would start them empty.
|
||||
name: halkyon-learn
|
||||
|
||||
# Logs go to the host's journal, whose size and age limits apply (journald.conf).
|
||||
|
|
|
|||
|
|
@ -2,8 +2,8 @@
|
|||
# Deploys learn.halkyon.eu from main. The only command deploy's keys may run: deploy's
|
||||
# ~/.ssh/authorized_keys on the server pins both to this script, CI's from the server itself:
|
||||
#
|
||||
# restrict,from="127.0.0.1,::1",command="/home/deploy/halkyon-learn/deploy/redeploy.sh" ssh-ed25519 … (CI deploy trigger)
|
||||
# restrict,command="/home/deploy/halkyon-learn/deploy/redeploy.sh" ssh-ed25519 … (manual deploys)
|
||||
# restrict,from="127.0.0.1,::1",command="/home/deploy/halkyon/deploy/redeploy.sh" ssh-ed25519 … (CI deploy trigger)
|
||||
# restrict,command="/home/deploy/halkyon/deploy/redeploy.sh" ssh-ed25519 … (manual deploys)
|
||||
#
|
||||
# CI passes the commit it has checked. This deploys it only
|
||||
# - while it is still the tip of main (otherwise the CI run of the newer tip deploys),
|
||||
|
|
@ -26,7 +26,7 @@ main() {
|
|||
esac
|
||||
[ ${#commit} -eq 40 ] || fail 'expects the full commit to deploy (40 hex digits)'
|
||||
|
||||
cd "$HOME/halkyon-learn"
|
||||
cd "$HOME/halkyon"
|
||||
# One deploy at a time.
|
||||
exec 9>"$HOME/.redeploy.lock"
|
||||
flock 9
|
||||
|
|
@ -176,7 +176,7 @@ wait_until_answering() {
|
|||
# fit the database the migrations have changed. Before the switch, the running
|
||||
# containers were never touched.
|
||||
back_out() {
|
||||
cd "$HOME/halkyon-learn"
|
||||
cd "$HOME/halkyon"
|
||||
git reset -q --hard "$deployed"
|
||||
echo "The checkout is back at $deployed." >&2
|
||||
if [ "${switched:-}" = yes ]; then
|
||||
|
|
|
|||
|
|
@ -48,11 +48,11 @@ Steps, in order; ✱ marks a step as root.
|
|||
```sh
|
||||
sudo groupadd --system --gid 61096 jellyfin
|
||||
sudo useradd --system --uid 61096 --gid 61096 --no-create-home --shell /usr/sbin/nologin jellyfin
|
||||
sudo mkdir -p ~deploy/halkyon-learn/deploy/jellyfin/config \
|
||||
~deploy/halkyon-learn/deploy/jellyfin/cache ~deploy/halkyon-learn/deploy/jellyfin/media
|
||||
sudo chown -R jellyfin:jellyfin ~deploy/halkyon-learn/deploy/jellyfin/config \
|
||||
~deploy/halkyon-learn/deploy/jellyfin/cache
|
||||
sudo chown -R deploy:deploy ~deploy/halkyon-learn/deploy/jellyfin/media
|
||||
sudo mkdir -p ~deploy/halkyon/deploy/jellyfin/config \
|
||||
~deploy/halkyon/deploy/jellyfin/cache ~deploy/halkyon/deploy/jellyfin/media
|
||||
sudo chown -R jellyfin:jellyfin ~deploy/halkyon/deploy/jellyfin/config \
|
||||
~deploy/halkyon/deploy/jellyfin/cache
|
||||
sudo chown -R deploy:deploy ~deploy/halkyon/deploy/jellyfin/media
|
||||
```
|
||||
|
||||
2. **DNS** (the operator, at the domain's DNS): the Jellyfin domain, such as
|
||||
|
|
@ -74,11 +74,11 @@ Steps, in order; ✱ marks a step as root.
|
|||
|
||||
```sh
|
||||
tar -C "<the folder's parent>" -cf - "<folder>" |
|
||||
ssh <deploy's ssh alias> 'tar -C halkyon-learn/deploy/jellyfin/media/movies -xf -'
|
||||
ssh <deploy's ssh alias> 'tar -C halkyon/deploy/jellyfin/media/movies -xf -'
|
||||
```
|
||||
|
||||
5. **Start it** (the operator, on the instance's server, as `deploy`):
|
||||
`cd ~/halkyon-learn/deploy && docker compose up -d`. Caddy and the server are
|
||||
`cd ~/halkyon/deploy && docker compose up -d`. Caddy and the server are
|
||||
recreated with it (the site, and the instance's suggestion); the instance is away
|
||||
for seconds.
|
||||
|
||||
|
|
@ -149,7 +149,7 @@ home machine.
|
|||
```sh
|
||||
sudo apt-get install wireguard-tools
|
||||
(umask 077 && wg genkey | sudo tee /etc/wireguard/wg-jellyfin.key | wg pubkey)
|
||||
from=~deploy/halkyon-learn/deploy/home-jellyfin/server
|
||||
from=~deploy/halkyon/deploy/home-jellyfin/server
|
||||
sudo install -m 0600 "$from/wg-jellyfin.conf" /etc/wireguard/wg-jellyfin.conf
|
||||
sudo install -m 0700 "$from/wg-jellyfin-rules.sh" /etc/wireguard/wg-jellyfin-rules.sh
|
||||
sudo install -D -m 0644 "$from/wg-quick-after-docker.conf" \
|
||||
|
|
@ -165,7 +165,7 @@ home machine.
|
|||
can't reach the tunnel; then the tunnel.
|
||||
|
||||
```sh
|
||||
sudo install -m 0644 ~deploy/halkyon-learn/deploy/runner/forgejo-runner.service \
|
||||
sudo install -m 0644 ~deploy/halkyon/deploy/runner/forgejo-runner.service \
|
||||
/etc/systemd/system/forgejo-runner.service
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl restart forgejo-runner
|
||||
|
|
@ -225,7 +225,7 @@ home machine.
|
|||
JELLYFIN_DOMAIN=jellyfin.halkyon.eu
|
||||
```
|
||||
|
||||
then `cd ~/halkyon-learn/deploy && docker compose up -d`. Caddy and the server are
|
||||
then `cd ~/halkyon/deploy && docker compose up -d`. Caddy and the server are
|
||||
recreated with it; the instance is away for seconds.
|
||||
|
||||
7. **Check from outside** (anyone, anywhere): the sidecar's step 7; and on the instance's
|
||||
|
|
@ -278,15 +278,15 @@ Steps, in order; ✱ marks a step as root.
|
|||
```sh
|
||||
sudo groupadd --system --gid 61081 languagetool
|
||||
sudo useradd --system --uid 61081 --gid 61081 --no-create-home --shell /usr/sbin/nologin languagetool
|
||||
sudo mkdir -p ~deploy/halkyon-learn/deploy/languagetool/fasttext
|
||||
sudo chown -R languagetool:languagetool ~deploy/halkyon-learn/deploy/languagetool
|
||||
sudo mkdir -p ~deploy/halkyon/deploy/languagetool/fasttext
|
||||
sudo chown -R languagetool:languagetool ~deploy/halkyon/deploy/languagetool
|
||||
```
|
||||
|
||||
2. **Switch it on** (the operator, on the instance's server, as `deploy`): in
|
||||
`deploy/.env`, `COMPOSE_FILE=compose.yaml:compose.languagetool.yaml`.
|
||||
|
||||
3. **Start it** (the operator, on the instance's server, as `deploy`):
|
||||
`cd ~/halkyon-learn/deploy && docker compose up -d`. The server is recreated with it
|
||||
`cd ~/halkyon/deploy && docker compose up -d`. The server is recreated with it
|
||||
(its `LANGUAGETOOL_URL`); the instance is away for seconds. At its first start
|
||||
LanguageTool fetches fastText's model of languages (`lid.176.bin`, 126 MB, from
|
||||
Facebook's `dl.fbaipublicfiles.com`) into `deploy/languagetool/fasttext/`, which it
|
||||
|
|
@ -323,7 +323,7 @@ Steps, in order; ✱ marks a step as root.
|
|||
BRouter's segments take about 3.3 GB for Europe, and a refresh writes each one beside
|
||||
the old before replacing it; Train's dumps go to `~/backups` with Learn's.
|
||||
2. **Its database** (the operator, on the instance's server, as `deploy`, in
|
||||
`~/halkyon-learn/deploy`): a role of Train's own, with the password that goes into
|
||||
`~/halkyon/deploy`): a role of Train's own, with the password that goes into
|
||||
`.env` as `TRAIN_POSTGRES_PASSWORD` (`openssl rand -hex 32`), and its database:
|
||||
|
||||
```sh
|
||||
|
|
@ -351,8 +351,8 @@ Steps, in order; ✱ marks a step as root.
|
|||
```sh
|
||||
sudo groupadd --system --gid 61177 brouter
|
||||
sudo useradd --system --uid 61177 --gid 61177 --no-create-home --shell /usr/sbin/nologin brouter
|
||||
sudo mkdir -p ~deploy/halkyon-learn/deploy/brouter/segments
|
||||
sudo chown -R brouter:brouter ~deploy/halkyon-learn/deploy/brouter/segments
|
||||
sudo mkdir -p ~deploy/halkyon/deploy/brouter/segments
|
||||
sudo chown -R brouter:brouter ~deploy/halkyon/deploy/brouter/segments
|
||||
```
|
||||
|
||||
4. **DNS** (the operator, at the domain's DNS): Train's domain, `train.halkyon.eu`,
|
||||
|
|
@ -406,8 +406,8 @@ Steps, in order; ✱ marks a step as root.
|
|||
```sh
|
||||
sudo groupadd --system --gid 61178 maptiles
|
||||
sudo useradd --system --uid 61178 --gid 61178 --no-create-home --shell /usr/sbin/nologin maptiles
|
||||
sudo mkdir -p ~deploy/halkyon-learn/deploy/maps/tiles
|
||||
sudo chown -R maptiles:maptiles ~deploy/halkyon-learn/deploy/maps/tiles
|
||||
sudo mkdir -p ~deploy/halkyon/deploy/maps/tiles
|
||||
sudo chown -R maptiles:maptiles ~deploy/halkyon/deploy/maps/tiles
|
||||
```
|
||||
|
||||
3. **Switch it on** (the operator, as `deploy`): in `deploy/.env`, `compose.maps.yaml`
|
||||
|
|
@ -452,8 +452,8 @@ Steps, in order; ✱ marks a step as root.
|
|||
```sh
|
||||
sudo groupadd --system --gid 61179 photon
|
||||
sudo useradd --system --uid 61179 --gid 61179 --no-create-home --shell /usr/sbin/nologin photon
|
||||
sudo mkdir -p ~deploy/halkyon-learn/deploy/photon/data
|
||||
sudo chown -R photon:photon ~deploy/halkyon-learn/deploy/photon/data
|
||||
sudo mkdir -p ~deploy/halkyon/deploy/photon/data
|
||||
sudo chown -R photon:photon ~deploy/halkyon/deploy/photon/data
|
||||
```
|
||||
|
||||
3. **Switch it on** (the operator, as `deploy`): in `deploy/.env`, `compose.search.yaml`
|
||||
|
|
@ -484,7 +484,7 @@ compose file, and `backup.sh` backs its database up beside Learn's.
|
|||
Steps, in order:
|
||||
|
||||
1. **Its database** (the operator, on the instance's server, as `deploy`, in
|
||||
`~/halkyon-learn/deploy`): a role of Todo's own, with the password that goes into
|
||||
`~/halkyon/deploy`): a role of Todo's own, with the password that goes into
|
||||
`.env` as `TODO_POSTGRES_PASSWORD` (`openssl rand -hex 32`), and its database, as
|
||||
Train's (*Train*, step 2, says what each line does):
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue