peter
441d000d33
Addresses a review of deploy/cloud_agent_deploy.md against Cloud-VM-1 (a shared Hetzner VPS already running ~10 other services, including the Forgejo instance this repo is hosted on): - Blocking: git.cygnus.systems' git-SSH listens on port 2222, not 22 - fixed the SSH config example and clone fallback, with a note not to assume 22 if it changes again. - High: container port now binds via configurable DAYBOOK_BIND_ADDR (defaults to all interfaces, set to 127.0.0.1 when a reverse proxy fronts it) instead of always publishing to 0.0.0.0; reverse-proxy+TLS is now the only path presented for internet-facing hosts, not a coequal option with direct exposure. - High: replaced the Caddy-only hardening example with an Apache vhost + certbot path (matching how this specific host already terminates TLS for everything else on it), plus a check-before-assuming-80/443-are-free step. - High: added mem_limit/mem_reservation to docker-compose.yml so this doesn't risk OOM-killing other services on a memory-tight box. - Medium: added configurable DAYBOOK_HOST_DATA_DIR so persistent data can land on a separate/larger volume instead of a space-constrained main disk. - Medium/Low: checklist now prompts checking the target's own service-inventory/monitoring/changelog conventions, and .env guidance notes it should stay low-stakes since a deploy agent reads/writes it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| cloud_agent_deploy.md | ||
| docker-compose.yml | ||
| Dockerfile | ||
| entrypoint.sh | ||
| env.example | ||