docs: production on its own Linux VM, natively (Gitea issue 37)

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-27 15:15:18 -06:00
parent b2f3213e16
commit d9aab10987
4 changed files with 9 additions and 5 deletions
@@ -120,7 +120,7 @@ Each phase ends with passing tests, docs updated (README, CHANGELOG, SECURITY.md
 ### Phase 10: Regression bench, hardening, go-live (medium)
 - Rewrite the 38 scenarios against the new UI with synthetic fixtures; run in Gitea Actions against compose.ci.yml. Policy matrix, merge rules and packet-rule tests already run from phase 2 and 3.
 - CSP final pass, dependency scan, build-version banner and reload, DEPLOY.md with the NPM proxy host settings, SECURITY.md rewritten with the ID table, GO-LIVE.md (date, boundary, groups, tablets, URL, M: retirement as read-only archive), PAPER-FALLBACK.md, incident notes.
- Production compose with explicit VISUAL_SERVER and VISUAL_DATABASE; first start is Spencer's approval.
+- Production on its own Linux VM, natively, with no Docker (Spencer, 2026-10-27, Gitea issue 37; see "Host layout"). The app and the worker run as systemd services from a venv built from the same `server/requirements.txt` and `server/requirements-pesco.txt` pins as the image, with PostgreSQL 16, ODBC Driver 18 and the PESCO CA installed on the VM. Settings from an env file, secrets as root-owned files read through the same `*_PASSWORD_FILE` settings, VISUAL_SERVER and VISUAL_DATABASE set explicitly; first start is Spencer's approval. NPM on docker-1 proxies `packetstation.pescoinc.biz` to the VM over the LAN. Backups, the doctor and the restore are rewritten for the VM (no `docker exec`). DEPLOY.md gets a production section for the VM; the compose files stay for test and CI.
 - Archive location (Gitea issue 7, Spencer 2026-10-27). Spencer creates an NFS share on the QNAP and mounts it on docker-1 (root, steps in DEPLOY.md), with write access for uid 10001. Compose bind-mounts it into the app and the worker at a fixed root, `ARCHIVE_ROOT` (unset turns the feature off). The Admin page gets a File locations section with one setting for now, the archive folder, as a path under `ARCHIVE_ROOT`. The server refuses a path that leaves the root (`..`, absolute paths elsewhere, symlinks out). "Check" writes a probe file, reads it back, removes it and shows the result, and saving runs the same check first. The setting change and every check are audited. `doctor` runs the check too. What is written to the archive and when (for example the sealed data book, its documents and a manifest at filing) is decided on issue 7 before it is built; until then the setting and the check exist and nothing is copied.
 - Closes: O3, O4; S4 is IT's pentest, deferred.

@@ -303,3 +303,5 @@ From phase 9 (2026-10-21), for Seth or Spencer to veto:
 ## Host layout on docker-1

 OPS2 (Gitea issue 38): the test stack's files stay under `/home/spencerm/packetstation/test`, like the other compose stacks on docker-1 (gitea, npm, pesco-ncr and the rest live under `/home/spencerm`). Decided by Spencer (IT) on 2026-10-18. The move to `/etc/packetstation/test` is dropped. Whether the production stack follows the same layout is asked on issue 38. Until it is answered, DEPLOY.md keeps `/etc/packetstation/prod`.
+
+Production host (Gitea issue 37): decided by Spencer on 2026-10-27. Production runs on its own Linux VM as native services, not in Docker and not on docker-1. The test stack and CI stay on docker-1 as they are. This replaces the production half of OPS2: the production folder question on issue 38 no longer applies, and the VM's file layout is set in phase 10. The docker-1 address pool (OPS1) now only has to fit the test stack, the Gitea runner and the CI e2e stack. Still open on issue 37: the VM's name and address, its OS (Debian 12 matches the image), who builds it, and how NPM reaches it (HTTP on the LAN or TLS to the VM).