4 Commits

Include renames

Author	SHA1	Message	Date
Sluijsens	2cd8c4aa88	Renames the backup script to match the instance, not the software ... backup-slpmodularcms-db.sh named the CMS; this backs up slpsoftware specifically, same as every other instance-scoped path already does. Hardcoded in deploy-scp.yaml itself, so this is the actual pipeline code, not just docs describing it.	2026-07-29 14:17:41 +02:00
Sluijsens	50c1a5106d	Fixes deployment docs to reverse-proxy on a separate Pi, not pi-main ... nginx and certbot were designed assuming they lived on the same host as the app. They don't - a dedicated proxy Pi terminates TLS and forwards plain HTTP over the LAN. Kestrel now binds 0.0.0.0 instead of localhost, the whole certbot procedure moved to the proxy Pi's side, and pi-main gets a firewall rule restricting the backend ports to just the proxy Pi's address - otherwise binding all interfaces would let anything on the LAN skip the proxy's TLS entirely.	2026-07-29 13:29:12 +02:00
Sluijsens	bd2a963498	U6 — the deploy workflow itself ... deploy-scp.yaml: download, back up the production database before touching anything, upload into a timestamped release, symlink the persistent website in, switch current and restart, verify /health with retries, prune old releases only once that check passes. No sudo, no container actions, one shared interface U5 will call next.	2026-07-28 15:33:03 +02:00
Sluijsens	9a77eec0f1	Designs where the deploy workflow puts things on the Pi ... Infrastructure design for U6: single Pi split by directory not port, systemd --user services instead of sudo, a releases/current/shared layout that keeps the customer website outside every atomic switch, and a health check through the existing reverse proxy before pruning anything. Flags that user-level systemd needs enable-linger or the service dies the moment the deploy SSH session closes.	2026-07-28 15:32:51 +02:00