Complete the deployment runbook #74

Merged

approver_agent merged 4 commits from task/deploy-runbook_876134bc-9f1c-46b3-bc3c-0d889c2fd5f6 into feature/ec45cc08-b16d-4b8f-b617-7e79308a4f49-deployment 2026-10-05 20:25:04 -04:00

Conversation 3 Commits 4 Files Changed 1

+538 -15

4 Commits

Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	c90d13d01a	Run the app-key pre-check and rotation with the stack stopped ... A raw copy of mealquest.db and its WAL taken while the stack runs is not a consistent snapshot: a checkpoint between the two copies can drop committed rows, so the _ct pre-check could report a false zero. Stop the app and Litestream before the pre-check and keep them stopped until the new key is in place. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 20:17:55 -04:00
dev_agentandClaude Opus 5.5	0f679439cc	State the exact Cloudflare record in the runbook DNS section ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 20:09:59 -04:00
dev_agentandClaude Opus 5.5	d55fe5a060	Address runbook review findings ... Media restore now stops both mealquest-media-backup.timer and the service, checks that neither is active and no rsync runs, and records the NAS file count before media/ is touched; a post-condition compares local and NAS counts before the timer starts again, so an rsync --delete never sees an empty or partial media directory. The shortcut restore snippet in "Media — nightly rsync" now points at that procedure. First deploy sets MEALQUEST_BIND_ADDRESS to 10.60.1.14 explicitly (the template ships 127.0.0.1) and shows the resulting 10.60.1.14:8090 publish. Record the Authentik client ID and the actual DNS records. App-key rotation no longer sends the operator to re-entry flows that do not exist: it pre-checks that no _ct column holds a value, refuses to rotate otherwise, and marks the LLM, recipe-search (Feature 10), Calendar (Feature 16) and Chat (Feature 19) re-entry flows as planned. Task: 876134bc-9f1c-46b3-bc3c-0d889c2fd5f6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 20:03:06 -04:00
dev_agentandClaude Opus 5.5	25c1701ddc	Complete the deployment runbook ... Add prerequisites, the first deploy on 10.60.1.14 (clone path, env file, secrets layout and permissions, port 8090 check), Authentik provider, application and group settings, DNS records with the AAAA caveat, the DOCKER-USER firewall unit, routine deploy and rollback to a previous SHA, photo restore, and secret rotation for the app key, OIDC secret, LLM key, VAPID keys and the NAS key. Record the host checkout state left by the pre-release first deploy. Task: 876134bc-9f1c-46b3-bc3c-0d889c2fd5f6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 19:51:34 -04:00