From 61d6d21d885b33a3d97d732a78d5e7f64e745f41 Mon Sep 17 00:00:00 2001 From: Per Magnus Petersen Date: Tue, 15 Sep 2026 18:42:09 +0200 Subject: [PATCH] Document live GitOps production deployment --- CLAUDE.md | 17 +++++++++++------ README.md | 23 +++++++++++++++++++++-- btc-price-deploy.md | 5 +++++ 3 files changed, 37 insertions(+), 8 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 92abc73..20502b9 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -29,12 +29,17 @@ Docker runs alongside local dev on different ports: The image does not set `BTCDATA_URL`; deployments must provide it. `BUILD_SHA` is embedded as `APP_VERSION` and exposed at `/api/version`. The port in `CMD` is hardcoded to 4040. -## CI/CD +## CI/CD and production -`.gitea/workflows/build.yml` tests pushes to `main` and `v*` tags, then publishes immutable -linux/amd64 images to `harbor.pmagnus.cloud/btcprice/btcprice`. It embeds the short Git SHA as -`APP_VERSION`. CI has no Kubernetes credentials; the planned Flux deployment belongs in -`magnus/deploy` once the shared GitOps gate is complete. +`.gitea/workflows/build.yml` tests pushes to `main` and `v*` tags on the `anvil` Gitea Actions +runner, then publishes immutable linux/amd64 images to +`harbor.pmagnus.cloud/btcprice/btcprice`. It embeds the short Git SHA as `APP_VERSION`. + +Flux image automation updates the manifests in the separate `magnus/deploy` repository and Flux +reconciles k3s. CI has no Kubernetes credentials. Production runs two replicas—one on hostinger and +one on citadel—and is served at https://btcprice.k8s.pmagnus.cloud through ingress-nginx and +hostinger Traefik TLS. Deployment changes belong in `../deploy/apps/btcprice`; do not deploy with +Compose or manual `kubectl apply`. ## Legacy deployment @@ -46,7 +51,7 @@ Mirrors `../elprice/deploy-citadel.sh`; no registry. - btcdata also runs on citadel, so both attach to the external `btc-network` there and `BTCDATA_URL` is `http://btcdata:4102` (service name, not a LAN address). The deploy script creates the network on the remote if it is missing. -- Live at http://192.168.50.195:4041. +- Temporary migration fallback at http://192.168.50.195:4041; it is not the production endpoint. ## Architecture diff --git a/README.md b/README.md index 974acf3..d87c24b 100644 --- a/README.md +++ b/README.md @@ -52,6 +52,24 @@ SHA, available from `/api/version`. The workflow requires the repository secrets `HARBOR_ROBOT_USER` and `HARBOR_ROBOT_TOKEN`. It only pushes images and intentionally has no Kubernetes credentials. +## Production deployment + +Production is GitOps-managed at **https://btcprice.k8s.pmagnus.cloud**: + +```text +git push → Gitea Actions on anvil → Harbor → Flux → k3s → ingress-nginx → Traefik TLS +``` + +Flux image automation commits the newest approved `main-` image to the separate +`magnus/deploy` repository. The manifests are in `../deploy/apps/btcprice`, and two replicas run with +one pod on each k3s node. CI never receives cluster credentials. Do not deploy production with +Docker Compose or manual `kubectl apply`; rollback by reverting the immutable image change in the +GitOps repository. + +btcdata remains an external dependency running on citadel. Kubernetes represents it with a +selectorless Service and EndpointSlice, so pods use `http://btcdata:4102` without embedding its IP in +the Deployment. + ## Legacy deployment (citadel) ```bash @@ -64,8 +82,9 @@ architecture (citadel is x86_64 → `linux/amd64`), copies `docker-compose.citad pipes the image over SSH with `docker save | docker load`, and runs `docker compose up -d --no-build`. No registry involved. -Deployed btcprice listens on **http://192.168.50.195:4041** and proxies to the btcdata running -on citadel as well. Both attach to the external `btc-network` there, so `BTCDATA_URL` is +The temporary migration fallback listens on **http://192.168.50.195:4041** and proxies to the +btcdata running on citadel as well. It is retained only for the validation/rollback window; the +Kubernetes hostname is the production endpoint. Both attach to the external `btc-network` there, so `BTCDATA_URL` is `http://btcdata:4102` (set in `.env.citadel`) — the service name inside the network, not a LAN address. The deploy script creates `btc-network` on the host if it does not exist yet. diff --git a/btc-price-deploy.md b/btc-price-deploy.md index f3c2ca5..7a8ca49 100644 --- a/btc-price-deploy.md +++ b/btc-price-deploy.md @@ -1,5 +1,10 @@ # btcprice GitOps migration plan +**Status (2026-09-15):** Phases 1–6 implemented and verified. The GitOps deployment is live with +one Ready replica on each k3s node, trusted TLS, working HTTP/WebSockets, and a successful unattended +source-to-production update. Compose remains online for the required 24-hour validation/rollback +window; Phase 7 is intentionally pending. + **Target path** ```text