syntaxbullet/minabot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: move production app to mina.teppelin.com

Browse Source
This commit is contained in:
syntaxbullet
2026-09-08 11:48:37 +02:00
parent 838567e9b8
commit 4d719afd07
5 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Caddyfile
View File

@@ -1,4 +1,4 @@
mina.teppelinlabs.com {
mina.teppelin.com {
encode zstd gzip
reverse_proxy app:3000
}

2
compose.yaml
View File

@@ -45,7 +45,7 @@ services:
image: ${APP_IMAGE:?Set APP_IMAGE to the tested release image}
command: [bun, scripts/monitor.ts]
environment:
MONITOR_URL: https://mina.teppelinlabs.com/api/health
MONITOR_URL: https://mina.teppelin.com/api/health
restart: unless-stopped
security_opt:
- no-new-privileges:true

2
deploy/deploy.sh
View File

@@ -101,7 +101,7 @@ cp "$release/Caddyfile" Caddyfile
mv next.env .env
compose up -d --wait --wait-timeout 120 app monitor
compose up -d --wait --wait-timeout 120 caddy
curl --fail --silent --show-error --retry 5 --retry-all-errors --retry-delay 2 --max-time 15 https://mina.teppelinlabs.com/api/health > "$release/public-health.json"
curl --fail --silent --show-error --retry 5 --retry-all-errors --retry-delay 2 --max-time 15 https://mina.teppelin.com/api/health > "$release/public-health.json"
printf '%s\n' "$target" > deployed-sha.tmp
mv deployed-sha.tmp deployed-sha
rm -f failed-sha

8
docs/DEPLOYMENT-PLAN.md
View File

@@ -1,6 +1,6 @@
# Minabot deployment plan
Target: `https://mina.teppelinlabs.com` on `syntaxbullet@46.62.156.93`.
Target: `https://mina.teppelin.com` on `syntaxbullet@46.62.156.93`.
Prepared September 7, 2026. Executed the same day; see
[production operations](PRODUCTION.md) for the deployed configuration and results.
@@ -54,11 +54,11 @@ An unhealthy health check alone does not restart a container; monitor it separat
then recheck SSH protection. Open TCP 80/443 in UFW and any Hetzner firewall.
5. Put runtime secrets in `/opt/minabot/.env.production` with mode 0600 and inject
through Compose `env_file`. Set `NODE_ENV=production`, `HOST=0.0.0.0`, `PORT=3000`,
`APP_ORIGIN=https://mina.teppelinlabs.com`, and `DATABASE_PATH=/data/minabot.sqlite`.
`APP_ORIGIN=https://mina.teppelin.com`, and `DATABASE_PATH=/data/minabot.sqlite`.
Supply `DISCORD_CLIENT_ID`, `DISCORD_CLIENT_SECRET`, a stable random
`AUTH_COOKIE_SECRET`, and the bot/channel settings. Do not bake secrets into
images or build arguments. Register this Discord OAuth redirect exactly:
`https://mina.teppelinlabs.com/api/auth/discord/callback`.
`https://mina.teppelin.com/api/auth/discord/callback`.
6. Default to a fresh production database. If existing local data should be moved,
use a verified SQLite snapshot, not a live database-file copy. Avoid running
two workers against copied live Discord message state. Resolve the data choice
@@ -70,7 +70,7 @@ An unhealthy health check alone does not restart a container; monitor it separat
Proposed Caddyfile:
```caddyfile
mina.teppelinlabs.com {
mina.teppelin.com {
encode zstd gzip
reverse_proxy app:3000
}

6
docs/PRODUCTION.md
View File

@@ -1,6 +1,6 @@
# Minabot production
Live: https://mina.teppelinlabs.com
Live: https://mina.teppelin.com
SSH: `ssh syntaxbullet@46.62.156.93` (key authentication; passwordless sudo).
Deployment root: `/opt/minabot`. Compose manages `app`, `caddy`, and `monitor`.
@@ -22,7 +22,7 @@ logs in `/opt/minabot`. Bun 1.3.14 and Caddy images are pinned by digest.
`/opt/minabot/.env` selects release images. `/opt/minabot/.env.production` contains
runtime secrets (0600). Discord client and bot credentials were copied from the
effective development environment; production has a separate generated cookie
signing secret. Runtime uses `APP_ORIGIN=https://mina.teppelinlabs.com`,
signing secret. Runtime uses `APP_ORIGIN=https://mina.teppelin.com`,
`TRUST_PROXY=true`, `HOST=0.0.0.0`, and `DATABASE_PATH=/data/minabot.sqlite`.
`TRUST_PROXY` only accepts HTTPS from `X-Forwarded-Proto`, retains the actual
@@ -32,7 +32,7 @@ is not published. Caddy exposes TCP 80/443 and persists certificate state in
the iptables-compatible SSH action alongside Docker/UFW.
The registered Discord callback is
`https://mina.teppelinlabs.com/api/auth/discord/callback`; localhost remains registered.
`https://mina.teppelin.com/api/auth/discord/callback`; localhost remains registered.
## Data and backups