jb/shd.build
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

Add containerized staging deployment
Validate and deploy staging / validate (push) Successful in 27s
Details
Validate and deploy staging / deploy (push) Successful in 52s
Details

Browse Source
This commit is contained in:
JB
2026-07-26 10:31:24 -04:00
parent 32e10c710b
commit 548d19d9ea
25 changed files with 1692 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+23 -6
View File
@@ -41,16 +41,19 @@ npm run dev
## Encrypted environment files
Development and production settings live in the committed, encrypted
`.env.development` and `.env.production` files. Private decryption keys live
only in the ignored `.env.keys` file; back it up in a password manager.
Development, staging, and production settings live in the committed, encrypted
`.env.development`, `.env.staging`, and `.env.production` files. Private
decryption keys live only in the ignored `.env.keys` file; back it up in a
password manager.
```sh
npm run env:decrypt # decrypt both files for editing
npm run env:encrypt # encrypt both files again
npm run env:stage # encrypt and git-add both files
npm run env:decrypt # decrypt all environment files for editing
npm run env:encrypt # encrypt all environment files again
npm run env:stage # encrypt and git-add all environment files
npm run env:decrypt:development # operate on one environment
npm run env:decrypt:staging
npm run env:decrypt:production
npm run env:sync:staging-credentials # copy shared Discord/SMTP values from development
```
The repository pre-commit hook runs `env:stage`, so a commit always replaces
@@ -62,6 +65,20 @@ Never commit or lose `.env.keys`. Production should receive
`DOTENV_PRIVATE_KEY_PRODUCTION` through its secret manager rather than copying
the keys file onto the server.
## Containers and staging deployment
The application uses the official SvelteKit Node adapter and includes a
multi-stage `Dockerfile`. Database files, database backups, user avatars, and
uploaded game-data icons live under `/app/data`, which must be a persistent
volume. Runtime secrets are injected when the container starts and are never
baked into the image.
The staging compose topology and Gitea Actions deployment are documented in
[docs/DEPLOYMENT.md](docs/DEPLOYMENT.md). Pushes to `main` validate the
application, build the candidate image while staging remains online, stop the
application and scheduler briefly, back up the embedded database, migrate it,
and start the new release.
## Passwordless authentication
Passkeys are the preferred sign-in method. `APP_ORIGIN` must exactly match the