Production deployment

The production shape is Docker Compose (PostgreSQL + FastAPI) behind the host Caddy instance. Caddy owns HTTPS and serves the Vue build from /srv/keychain/web; the API is only published on 127.0.0.1:8799.

The deployment secret file lives outside Git at /etc/keychain/keychain.env with mode 0600. It must contain a random URL-safe KEYCHAIN_DB_PASSWORD and may contain KEYCHAIN_EXTENSION_ID after the unpacked extension receives its stable ID.

install -d -m 0750 /etc/keychain
openssl rand -hex 32
install -m 0600 /dev/null /etc/keychain/keychain.env
# Put KEYCHAIN_DB_PASSWORD=<generated value> in the file.

npm ci
VITE_API_URL=/api VITE_DEMO_MODE=false npm run build --workspace=@keychain/web
install -d -m 0755 /srv/keychain/web
cp -a apps/web/dist/. /srv/keychain/web/

docker compose --env-file /etc/keychain/keychain.env -f deploy/docker-compose.prod.yml up -d --build

Append deploy/Caddyfile.keychain as a new block to /etc/caddy/Caddyfile, validate, then restart Caddy. Existing Caddy blocks must remain unchanged. Verify:

curl -fsS https://keychain.agent.snw.su/api/health
docker compose --env-file /etc/keychain/keychain.env -f deploy/docker-compose.prod.yml ps

For rollback, restore the previous /srv/keychain/web contents and redeploy the previous Git commit. Do not remove the named keychain-postgres volume.

1.4 KiB Raw Permalink Blame History

Production deployment

1.4 KiB

Raw Permalink Blame History