mirror of
https://relay.ngit.dev/npub15qydau2hjma6ngxkl2cyar74wzyjshvl65za5k5rl69264ar2exs5cyejr/ngit-grasp.git
synced 2026-09-14 04:45:07 +00:00
DanConwayDev
37d81f3713
Production deployment previously depended on an illustrative Docker snippet and did not define which state or identity must survive replacement. Add a non-root runtime image, loopback-only Compose service, optional Caddy TLS overlay, shared /data layout, bounded public verifier, and an identity-persistence container test. Document backup, proxy, single-writer, upgrade, and rollback requirements as the contract for every environment. This assumes one ngit-grasp writer per state directory and a reverse proxy or platform edge for public TLS. Image publication and provider-specific control-plane setup are deliberately left to separate changes. Validated with sh -n, ShellCheck 0.11.0, locked Cargo metadata, YAML parsing, Docker Hub tag lookups, local input-failure checks, and git diff --check. Docker/Podman is unavailable in this VM, so the included end-to-end container test was not run here.
22 lines
748 B
Bash
22 lines
748 B
Bash
# Required: the public hostname, without a URL scheme or path.
|
|
NGIT_DOMAIN=ngit.example.com
|
|
|
|
# Public mount path. The bundled Caddy stack expects a domain-root service.
|
|
NGIT_BASE_PATH=/
|
|
|
|
# Loopback port used by compose.yaml when an existing host proxy is used.
|
|
NGIT_HOST_PORT=7334
|
|
|
|
# Application logging filter.
|
|
NGIT_LOG_LEVEL=info
|
|
|
|
# Optional initial relay. Sync discovers additional relays automatically.
|
|
# NGIT_SYNC_BOOTSTRAP_RELAY_URL=wss://relay.ngit.dev
|
|
|
|
# Compose network settings. Change both only if the default subnet conflicts.
|
|
NGIT_COMPOSE_SUBNET=172.30.73.0/24
|
|
NGIT_CADDY_IP=172.30.73.2
|
|
|
|
# Do not put NGIT_RELAY_OWNER_NSEC here. By default the service generates
|
|
# /data/.relay-owner.nsec in the persistent volume. Back up that volume.
|