walletpress/DEPLOYMENT.md

DEPLOYMENT.md — WalletPress

How to deploy. Build, push, restart, rollback.

Architecture

• Container: Docker
• Image registry: local (Talos)
• Orchestration: docker-compose on Talos
• Reverse proxy: nginx on Talos
• Auto-deploy: forgejo webhook → Talos deploy script

Deploy

Automatic (CI/CD)

On merge to main:

1. forgejo webhook fires
2. Talos deploy script pulls latest commit
3. Rebuilds Docker image
4. Stops old container, starts new
5. Runs health check
6. Rolls back on failure

Manual

ssh netcup
cd /srv/walletpress
git pull origin main
docker build -t walletpress:latest .
docker stop walletpress
docker rm walletpress
docker run -d --name walletpress --restart unless-stopped --network host -p 8010:8010 walletpress:latest

Health Check

curl -fsS http://localhost:8010/health

Rollback

ssh netcup
cd /srv/walletpress
git log --oneline -5   # find last good commit
git checkout <commit-hash>
docker build -t walletpress:latest .
docker restart walletpress

Logs

docker logs walletpress --tail 100 -f

Monitoring

• Prometheus: /metrics endpoint
• Grafana: dashboards in fleet-infra
• Loki: log aggregation

Secrets

All secrets in gopass:

• rmi/walletpress/admin_key
• rmi/walletpress/db_password
• see AGENTS.md for full list

Loaded via docker --env-file or systemd EnvironmentFile.

Firewall

• Public: 80, 443 (nginx)
• Internal: 8010 (localhost only, behind nginx)
• Tailscale: 8010 for admin access

Backup

• Code: forgejo (source of truth) + Hydra bare mirror (daily 04:00)
• Data: DB snapshot to R2 (daily)
• Config: gopass