diff options
Diffstat (limited to 'DESIGN_SPEC.md')
| -rw-r--r-- | DESIGN_SPEC.md | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/DESIGN_SPEC.md b/DESIGN_SPEC.md index e8bb197..51342d4 100644 --- a/DESIGN_SPEC.md +++ b/DESIGN_SPEC.md | |||
| @@ -20,7 +20,7 @@ deploy init --host user@your-vps-ip | |||
| 20 | # - Detect OS (Ubuntu/Debian supported) | 20 | # - Detect OS (Ubuntu/Debian supported) |
| 21 | # - Install Caddy from official repository | 21 | # - Install Caddy from official repository |
| 22 | # - Configure Caddy to import `/etc/caddy/sites-enabled/*` | 22 | # - Configure Caddy to import `/etc/caddy/sites-enabled/*` |
| 23 | # - Create `/etc/deploy/env/` directory for env files | 23 | # - Create `/etc/ship/env/` directory for env files |
| 24 | # - Create `/etc/caddy/sites-enabled/` directory | 24 | # - Create `/etc/caddy/sites-enabled/` directory |
| 25 | # - Enable and start Caddy service | 25 | # - Enable and start Caddy service |
| 26 | # - Verify installation | 26 | # - Verify installation |
| @@ -40,7 +40,7 @@ deploy init --host user@your-vps-ip | |||
| 40 | # This will SSH to the VPS and: | 40 | # This will SSH to the VPS and: |
| 41 | # - Install Caddy | 41 | # - Install Caddy |
| 42 | # - Configure Caddy to use sites-enabled pattern | 42 | # - Configure Caddy to use sites-enabled pattern |
| 43 | # - Create /etc/deploy/env/ directory for env files | 43 | # - Create /etc/ship/env/ directory for env files |
| 44 | # - Enable and start Caddy | 44 | # - Enable and start Caddy |
| 45 | # | 45 | # |
| 46 | # State is stored locally at ~/.config/deploy/state.json | 46 | # State is stored locally at ~/.config/deploy/state.json |
| @@ -273,9 +273,9 @@ All deployment state stored locally at `~/.config/deploy/state.json`: | |||
| 273 | ``` | 273 | ``` |
| 274 | 274 | ||
| 275 | ### Environment Files (VPS) | 275 | ### Environment Files (VPS) |
| 276 | Environment variables written to `/etc/deploy/env/{appname}.env` on VPS for systemd to read: | 276 | Environment variables written to `/etc/ship/env/{appname}.env` on VPS for systemd to read: |
| 277 | ```bash | 277 | ```bash |
| 278 | # /etc/deploy/env/myapi.env (generated from state.json) | 278 | # /etc/ship/env/myapi.env (generated from state.json) |
| 279 | PORT=8001 | 279 | PORT=8001 |
| 280 | DB_HOST=localhost | 280 | DB_HOST=localhost |
| 281 | DB_PORT=5432 | 281 | DB_PORT=5432 |
| @@ -297,7 +297,7 @@ ENVIRONMENT=production | |||
| 297 | - Checks if Caddy is already installed (skip if present) | 297 | - Checks if Caddy is already installed (skip if present) |
| 298 | - Installs Caddy via official APT repository | 298 | - Installs Caddy via official APT repository |
| 299 | - Creates `/etc/caddy/Caddyfile` with `import /etc/caddy/sites-enabled/*` | 299 | - Creates `/etc/caddy/Caddyfile` with `import /etc/caddy/sites-enabled/*` |
| 300 | - Creates directory structure: `/etc/deploy/env/`, `/etc/caddy/sites-enabled/` | 300 | - Creates directory structure: `/etc/ship/env/`, `/etc/caddy/sites-enabled/` |
| 301 | - Enables and starts Caddy | 301 | - Enables and starts Caddy |
| 302 | - Runs health check (verify Caddy is running) | 302 | - Runs health check (verify Caddy is running) |
| 303 | - Initializes local state file at `~/.config/deploy/state.json` if not present | 303 | - Initializes local state file at `~/.config/deploy/state.json` if not present |
| @@ -343,7 +343,7 @@ All steps executed remotely on VPS via SSH: | |||
| 343 | 4. Create system user (e.g., `myapp`) | 343 | 4. Create system user (e.g., `myapp`) |
| 344 | 5. Create working directory (`/var/lib/myapp`) | 344 | 5. Create working directory (`/var/lib/myapp`) |
| 345 | 6. Copy binary to `/usr/local/bin/myapp` | 345 | 6. Copy binary to `/usr/local/bin/myapp` |
| 346 | 7. Create env file at `/etc/deploy/env/myapp.env` with PORT and any user-provided vars | 346 | 7. Create env file at `/etc/ship/env/myapp.env` with PORT and any user-provided vars |
| 347 | 8. Set env file permissions (0600, owned by app user) | 347 | 8. Set env file permissions (0600, owned by app user) |
| 348 | 9. Generate systemd unit at `/etc/systemd/system/myapp.service` with EnvironmentFile | 348 | 9. Generate systemd unit at `/etc/systemd/system/myapp.service` with EnvironmentFile |
| 349 | 10. Generate Caddy config at `/etc/caddy/sites-enabled/myapp.caddy` pointing to localhost:port | 349 | 10. Generate Caddy config at `/etc/caddy/sites-enabled/myapp.caddy` pointing to localhost:port |
| @@ -376,7 +376,7 @@ All steps executed remotely on VPS via SSH: | |||
| 376 | /var/lib/myapp/ # Working directory | 376 | /var/lib/myapp/ # Working directory |
| 377 | /etc/systemd/system/myapp.service # Systemd unit | 377 | /etc/systemd/system/myapp.service # Systemd unit |
| 378 | /etc/caddy/sites-enabled/myapp.caddy # Caddy config | 378 | /etc/caddy/sites-enabled/myapp.caddy # Caddy config |
| 379 | /etc/deploy/env/myapp.env # Environment variables (0600 permissions) | 379 | /etc/ship/env/myapp.env # Environment variables (0600 permissions) |
| 380 | 380 | ||
| 381 | /var/www/mysite/ # Static site files | 381 | /var/www/mysite/ # Static site files |
| 382 | /etc/caddy/sites-enabled/mysite.caddy # Caddy config | 382 | /etc/caddy/sites-enabled/mysite.caddy # Caddy config |
| @@ -550,7 +550,7 @@ deploy list | |||
| 550 | - Use systemd security hardening (NoNewPrivileges, PrivateTmp, ProtectSystem) | 550 | - Use systemd security hardening (NoNewPrivileges, PrivateTmp, ProtectSystem) |
| 551 | - Static sites served as www-data | 551 | - Static sites served as www-data |
| 552 | - Caddy automatically handles TLS cert management | 552 | - Caddy automatically handles TLS cert management |
| 553 | - Environment files stored at `/etc/deploy/env/{app}.env` with 0600 permissions | 553 | - Environment files stored at `/etc/ship/env/{app}.env` with 0600 permissions |
| 554 | - Env files owned by the app's system user | 554 | - Env files owned by the app's system user |
| 555 | - `deploy env` command masks sensitive values when displaying (shows `API_KEY=***`) | 555 | - `deploy env` command masks sensitive values when displaying (shows `API_KEY=***`) |
| 556 | - Consider using external secret management for production (out of scope for v1) | 556 | - Consider using external secret management for production (out of scope for v1) |
