joshbairstow/jb-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: rsync prod compose to VPS; clarify package vs repo visibility

Browse source 
Repo-public does not imply package-public in Forgejo (packages are
owner-scoped, created on first push). Add verify-then-fix guidance.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Josh Bairstow 2026-06-02 23:33:20 +10:00
parent ef24f96b14
commit 5bb124acfd
1 changed files with 16 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

23
README.md
View file

@ -184,15 +184,24 @@ In the `jb-website` repo settings on Forgejo (`Settings → Actions`):
cat ~/.ssh/jb-deploy # <- paste this into DEPLOY_SSH_KEY cat ~/.ssh/jb-deploy # <- paste this into DEPLOY_SSH_KEY
``` ```
On the **VPS**, prepare the deploy target: On the **VPS**, put the production compose file in place — rsync it from your
desktop (creates the dir + copies; only the prod `compose.yml`, not the dev one):
```sh ```sh
mkdir -p /opt/jb-website rsync -av --rsync-path="mkdir -p /opt/jb-website && rsync" \
# copy jb-website/compose.yml here (the production one — pulls, no build) ~/git/jb-website/compose.yml root@45.32.242.27:/opt/jb-website/
docker login git.joshbairstow.com # one-time, so `compose pull` can read the package
# (or mark the jb-website package public in Forgejo to skip VPS login)
``` ```
Create a restricted deploy user whose `authorized_keys` holds the public half For `docker compose pull` to read the image, the **package** must be pullable.
of `DEPLOY_SSH_KEY`. Note: **package visibility ≠ repository visibility** — packages are owned by the
user/org, so making the *repo* public does NOT necessarily make the *image*
anonymously pullable, and the package only exists after the first push. After
the first pipeline run, verify from the VPS:
```sh
docker pull git.joshbairstow.com/<owner>/jb-website:latest
# unauthorized? -> set the PACKAGE public (profile → Packages → jb-website →
# settings), or run `docker login git.joshbairstow.com` once as DEPLOY_USER.
```
If `DEPLOY_USER` is not root, it must be in the `docker` group; for least
privilege, restrict its `authorized_keys` entry with a forced `command=`.
### 7. First deploy ### 7. First deploy
```sh ```sh