diff --git a/Caddyfile b/Caddyfile index fa3ad35..78fe833 100644 --- a/Caddyfile +++ b/Caddyfile @@ -1,4 +1,4 @@ -mina.teppelinlabs.com { +mina.teppelin.com { encode zstd gzip reverse_proxy app:3000 } diff --git a/compose.yaml b/compose.yaml index a8663c6..b9d8a28 100644 --- a/compose.yaml +++ b/compose.yaml @@ -45,7 +45,7 @@ services: image: ${APP_IMAGE:?Set APP_IMAGE to the tested release image} command: [bun, scripts/monitor.ts] environment: - MONITOR_URL: https://mina.teppelinlabs.com/api/health + MONITOR_URL: https://mina.teppelin.com/api/health restart: unless-stopped security_opt: - no-new-privileges:true diff --git a/deploy/deploy.sh b/deploy/deploy.sh index 584eced..9f84a05 100644 --- a/deploy/deploy.sh +++ b/deploy/deploy.sh @@ -101,7 +101,7 @@ cp "$release/Caddyfile" Caddyfile mv next.env .env compose up -d --wait --wait-timeout 120 app monitor compose up -d --wait --wait-timeout 120 caddy -curl --fail --silent --show-error --retry 5 --retry-all-errors --retry-delay 2 --max-time 15 https://mina.teppelinlabs.com/api/health > "$release/public-health.json" +curl --fail --silent --show-error --retry 5 --retry-all-errors --retry-delay 2 --max-time 15 https://mina.teppelin.com/api/health > "$release/public-health.json" printf '%s\n' "$target" > deployed-sha.tmp mv deployed-sha.tmp deployed-sha rm -f failed-sha diff --git a/docs/DEPLOYMENT-PLAN.md b/docs/DEPLOYMENT-PLAN.md index bed4e2b..629d103 100644 --- a/docs/DEPLOYMENT-PLAN.md +++ b/docs/DEPLOYMENT-PLAN.md @@ -1,6 +1,6 @@ # Minabot deployment plan -Target: `https://mina.teppelinlabs.com` on `syntaxbullet@46.62.156.93`. +Target: `https://mina.teppelin.com` on `syntaxbullet@46.62.156.93`. Prepared September 7, 2026. Executed the same day; see [production operations](PRODUCTION.md) for the deployed configuration and results. @@ -54,11 +54,11 @@ An unhealthy health check alone does not restart a container; monitor it separat then recheck SSH protection. Open TCP 80/443 in UFW and any Hetzner firewall. 5. Put runtime secrets in `/opt/minabot/.env.production` with mode 0600 and inject through Compose `env_file`. Set `NODE_ENV=production`, `HOST=0.0.0.0`, `PORT=3000`, - `APP_ORIGIN=https://mina.teppelinlabs.com`, and `DATABASE_PATH=/data/minabot.sqlite`. + `APP_ORIGIN=https://mina.teppelin.com`, and `DATABASE_PATH=/data/minabot.sqlite`. Supply `DISCORD_CLIENT_ID`, `DISCORD_CLIENT_SECRET`, a stable random `AUTH_COOKIE_SECRET`, and the bot/channel settings. Do not bake secrets into images or build arguments. Register this Discord OAuth redirect exactly: - `https://mina.teppelinlabs.com/api/auth/discord/callback`. + `https://mina.teppelin.com/api/auth/discord/callback`. 6. Default to a fresh production database. If existing local data should be moved, use a verified SQLite snapshot, not a live database-file copy. Avoid running two workers against copied live Discord message state. Resolve the data choice @@ -70,7 +70,7 @@ An unhealthy health check alone does not restart a container; monitor it separat Proposed Caddyfile: ```caddyfile -mina.teppelinlabs.com { +mina.teppelin.com { encode zstd gzip reverse_proxy app:3000 } diff --git a/docs/PRODUCTION.md b/docs/PRODUCTION.md index 70f66fb..40d7dec 100644 --- a/docs/PRODUCTION.md +++ b/docs/PRODUCTION.md @@ -1,6 +1,6 @@ # Minabot production -Live: https://mina.teppelinlabs.com +Live: https://mina.teppelin.com SSH: `ssh syntaxbullet@46.62.156.93` (key authentication; passwordless sudo). Deployment root: `/opt/minabot`. Compose manages `app`, `caddy`, and `monitor`. @@ -22,7 +22,7 @@ logs in `/opt/minabot`. Bun 1.3.14 and Caddy images are pinned by digest. `/opt/minabot/.env` selects release images. `/opt/minabot/.env.production` contains runtime secrets (0600). Discord client and bot credentials were copied from the effective development environment; production has a separate generated cookie -signing secret. Runtime uses `APP_ORIGIN=https://mina.teppelinlabs.com`, +signing secret. Runtime uses `APP_ORIGIN=https://mina.teppelin.com`, `TRUST_PROXY=true`, `HOST=0.0.0.0`, and `DATABASE_PATH=/data/minabot.sqlite`. `TRUST_PROXY` only accepts HTTPS from `X-Forwarded-Proto`, retains the actual @@ -32,7 +32,7 @@ is not published. Caddy exposes TCP 80/443 and persists certificate state in the iptables-compatible SSH action alongside Docker/UFW. The registered Discord callback is -`https://mina.teppelinlabs.com/api/auth/discord/callback`; localhost remains registered. +`https://mina.teppelin.com/api/auth/discord/callback`; localhost remains registered. ## Data and backups