.env.netcup.example

@@ -1,5 +1,10 @@
 # Server-side .env for netcup deploy. Copy to /srv/librenotes/.env on the host.
-# Used by: docker compose -f docker-compose.yml -f compose.netcup.yaml up -d --build
+# Used by: docker compose -f compose.yaml -f compose.netcup.yaml up -d
+
+# Image to pull. Main pushes update :main; tag pushes pin to immutable
+# tags such as :v0.1.0. The deploy workflow rewrites this line on tag
+# pushes; rollback is `perl -i -pe 's|...|=...:vX.Y.Z|' .env && up -d`.
+LIBRENOTES_IMAGE=git.librete.ch/public/librenotes:main
 
 # Public origin (caddy reverse-proxies to librenotes:8080)
 LIBRENOTES_BASE_URL=https://ln.cloud.librete.ch

compose.netcup.yaml

@@ -1,15 +1,19 @@
 # compose.netcup.yaml — overlay for the netcup VPS.
 #
 # Use:
-#   docker compose -f docker-compose.yml -f compose.netcup.yaml up -d --build
+#   docker compose -f compose.yaml -f compose.netcup.yaml pull
+#   docker compose -f compose.yaml -f compose.netcup.yaml up -d
 #
-# Differences from base docker-compose.yml:
+# Differences from base compose.yaml:
+#   - Pulls a published image (no build context on the host)
 #   - No host port binding (caddy edge handles ingress)
 #   - Joins external `edge` network so caddy reaches it as `librenotes:8080`
-#   - Pulls config from .env (LIBRENOTES_BASE_URL, JWT_SECRET, SMTP_*)
+#   - Pulls config from .env (LIBRENOTES_BASE_URL, JWT_SECRET, SMTP_*, IMAGE)
 #   - Uses bind-mounted /data + /var/lib/librenotes so backups can rsync host paths
 #
 # Inputs (env or .env file on netcup):
+#   LIBRENOTES_IMAGE        e.g. git.librete.ch/public/librenotes:main
+#                           or pinned tag git.librete.ch/public/librenotes:v0.1.0
 #   LIBRENOTES_BASE_URL     https://ln.cloud.librete.ch
 #   LIBRENOTES_JWT_SECRET   `openssl rand -base64 48`
 #   LIBRENOTES_SMTP_HOST    SMTP relay host
@@ -17,14 +21,15 @@
 #   LIBRENOTES_SMTP_USER    SMTP user
 #   LIBRENOTES_SMTP_PASS    SMTP password
 #   LIBRENOTES_SMTP_FROM    no-reply@librete.ch (envelope sender)
+#
+# Rollback: edit LIBRENOTES_IMAGE in /srv/librenotes/.env to a prior
+# tag, then `docker compose ... pull && docker compose ... up -d`.
 
 services:
   librenotes:
-    build:
-      context: .
-      args:
-        VERSION: netcup
-    image: librenotes:netcup
+    build: !reset null
+    image: ${LIBRENOTES_IMAGE}
+    pull_policy: always
     restart: always
     ports: !reset []
     environment: