Skip to content

last1.app production deploy (git-based)

Git is the source of truth. Prod runs an image built from a commit. Ryan and Robert run the same script on the same SHA.

Do not rsync a laptop tree to /opt/last1app/src. Do not git pull in that directory. That tree is an archive.

Host

  • VM: last1app-app (192.168.1.104)
  • Script: /opt/last1app/scripts/deploy-from-git.sh (same file as scripts/deploy-from-git.sh in this repo)
  • Runtime secrets: /opt/last1app/.env only. Not in git. Not in the image tag.
  • Git mirror: /opt/last1app/repo.git (read-only deploy key last1app-app-prod)
  • Release trees: /opt/last1app/releases/<sha>/
  • Live container: last1app-app on 192.168.1.104:5000
  • Staging: last1app-staging on :5001. Leave it alone.
  • Candidate probes: :5002

Deploy

ssh ryan@192.168.1.104
# SHA is origin/main, a tag, or a full commit.
bash /opt/last1app/scripts/deploy-from-git.sh origin/main
# or
bash /opt/last1app/scripts/deploy-from-git.sh 35e9f367108681769256a587fabdcffc5916bccb

What it does:

  1. git fetch the mirror. Archive that SHA into a new directory. Never touches /opt/last1app/src.
  2. Builds last1app-app:<sha> from that tree.
  3. Tags the currently running image last1app-app:prod-prev. The live container stays up.
  4. Starts last1app-app-candidate on :5002. Probes /, /api/auth/user, /api/public/templates.
  5. If probes fail: removes the candidate. :5000 is unchanged.
  6. If probes pass: stops the old container (does not remove it, renames it last1app-app-prev), starts the new image on :5000, probes again. Auto-rollback if that probe fails.

Rollback

bash /opt/last1app/scripts/deploy-from-git.sh --rollback

Stops last1app-app and starts last1app-app-prev (last1app-app:prod-prev). The new container stays stopped.

bash /opt/last1app/scripts/deploy-from-git.sh --forward

Puts the new container back on :5000 after a rollback test.

Team

  1. Commit and push to origin/main.
  2. Anyone with SSH to last1app-app runs the script with that SHA.
  3. Do not deploy from a dirty laptop checkout.

Retired path

/opt/last1app/src and deploy-last1app-app.sh are the old rsync-from-tree workaround. Do not use them.