7 Commits

Include renames

Author	SHA1	Message	Date
libretech	fc51d6a6a4	docs(security): remove SSH username/host specifics from public docs	2026-05-02 14:43:28 +02:00
libretech	3e482ba798	ci(runner-image): switch to public/ namespace (#55) ... Co-authored-by: Michael Czechowski <mail@dailysh.it> Co-committed-by: Michael Czechowski <mail@dailysh.it>	2026-05-02 14:10:56 +02:00
libretech	4ba7572565	ci(deploy): switch to libretech/runner-image:v1 and consolidate ... The deploy workflow is now a single job that builds, pushes, and deploys in one runner. Tag computation moved to docker/metadata-action, the per-deploy .env perl rewrite is gone (host pins LIBRENOTES_IMAGE once; main pushes update :main rolling, releases pin to :vX.Y.Z by manual edit), and both jobs run in our bespoke runner image whose runner user already has socket access via group membership. ci.yml moves to the same image so go/make/node are all available without per-step apt installs. Drops compose.prod.yaml (unused, redundant with compose.netcup.yaml).	2026-04-29 12:44:39 +02:00
libretech	6075aa22e1	fix(ci): drop docker.sock workflow mount (runner auto-mounts it) ... The Gitea act_runner already bind-mounts /var/run/docker.sock into job containers when its own runner container has the socket mounted. The workflow-level mount duplicated it and act_runner aborted the job with 'Duplicate mount point: /var/run/docker.sock'.	2026-04-29 12:17:25 +02:00
libretech	3d3fc41f73	ci(deploy): always pin LIBRENOTES_IMAGE and git pull on remote ... First deploy now works without manual .env priming: the remote step unconditionally rewrites LIBRENOTES_IMAGE, then runs git pull --ff-only so the host picks up the renamed compose.* files before pull/up.	2026-04-29 11:46:21 +02:00
libretech	37842b6294	ci(deploy): fix registry path, compose refs, Gitea Actions compat ... - Image base is now ${REGISTRY}/public/librenotes (matches Gitea owner/repo). - Remote step writes LIBRENOTES_IMAGE on tag pushes via perl, then pulls and restarts using the new compose.yaml + compose.netcup.yaml stack files. - Both jobs run inside catthehacker/ubuntu:runner-latest; the default node:20-bookworm runner image lacks make + docker. The build job bind-mounts /var/run/docker.sock for build-push-action; the runner config must whitelist that path under valid_volumes.	2026-04-29 02:00:23 +02:00
libretechandClaude Opus 4.7	bcccba92f7	Add deploy workflow and backup tooling ... CI deployment (.gitea/workflows/deploy.yml): - Two jobs (build, deploy) gated on the repo variable DEPLOY_ENABLED=true so the workflow exists but does nothing until secrets and host are configured. - Build pushes two image tags per run: rolling :main + the short SHA on main, or vX.Y.Z + :latest on tag pushes. Immutable per commit/tag tags make rollback trivial. - Deploy SSHes to DEPLOY_HOST, runs docker compose pull && up -d in DEPLOY_PATH, then polls HEALTH_URL for up to a minute. A failed health check fails the workflow, which is the alert. - Required secrets and the rollback procedure are documented in docs/operations.md. Backup tooling (scripts/): - backup.sh: SQLite online .backup snapshot + tarball of the per-tenant data dir + info.txt header, all wrapped into a single librenotes-YYYYMMDD-HHMMSS.tar.gz. Optional BACKUP_REMOTE triggers an rclone copy for off-site storage. - backup-prune.sh: enforces retention "30 daily + 12 monthly". Sorts archives by filename (date is in the name so lex order matches chronological) and keeps the newest 30 plus the newest archive for each of the most recent 12 months. - backup-restore-test.sh: extracts the most recent archive into a tmpdir, runs sqlite3 .schema (proves DB readability), and asserts the notes tar has at least one entry. Failure is the alert. Wired into a separate weekly timer. - librenotes-backup.{service,timer}: systemd units for the daily 03:17 UTC run with 5min jitter; ProtectSystem=strict, only /var/backups/librenotes is writable. - librenotes-backup-verify.{service,timer}: weekly Monday 04:00 UTC restore test. Closes #26 and #27. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-28 22:49:40 +02:00