770f8ec · Zion Pm

docs: CT215-mediated deploy (CT120 lacks GitHub egress)

770f8ec zionboggan committed on Jun 21, 2026 (1 month ago)

OPS_RUNBOOK.md +7 -3

		@@ -13,13 +13,17 @@ ss -tlnp \| grep 4100 # confirm listening

		## Deploy a change

	-	Edit on CT215 (canonical repo `/shared/projects/zion-pm`), commit + push, then on CT120:
	+	Edit on CT215 (canonical repo `/shared/projects/zion-pm`), commit + push to GitHub. CT120 has no GitHub egress, so CT215 syncs the source over SSH (CT215-mediated deploy):

		```bash
	-	cd /opt/zion-pm && git pull && pnpm install && pnpm build && systemctl restart zion-pm
	+	# on CT215
	+	cd /shared/projects/zion-pm && git add -A && git commit -m "..." && git push
	+	tar czf - app lib public package.json pnpm-lock.yaml tsconfig.json next.config.ts postcss.config.mjs \
	+	\| ssh root@REDACTED-IP 'tar xzf - -C /opt/zion-pm'
	+	ssh root@REDACTED-IP 'cd /opt/zion-pm && pnpm install && pnpm build && systemctl restart zion-pm'
		```

	-	Never edit/run from the share (`/shared/projects` is noexec CIFS). Canonical repo on share, app runs from `/opt`.
	+	Never edit/run from the share (`/shared/projects` is noexec CIFS). Canonical repo on share, app runs from `/opt`. (If CT120 GitHub egress is opened later, it can `git clone`/`pull` directly instead.)

		## Health checks

README.md +8 -7

		@@ -60,15 +60,16 @@ Secrets live only in `.env.local` on CT120 and `/shared/projects/.env.secrets`.

		## Run / deploy

	-	The canonical repo lives on the share at `/shared/projects/zion-pm` (committed from CT215). The app runs from CT120 local fs `/opt/zion-pm` (noexec CIFS rule - never execute from the share). Deploy = `git pull` on CT120.
	+	The canonical repo lives on the share at `/shared/projects/zion-pm` (committed + pushed from CT215; remote `github.com/zionboggan/zion-pm`, private). The app runs from CT120 local fs `/opt/zion-pm` (noexec CIFS rule - never execute from the share).
	+
	+	CT120 has no direct egress to github.com, so deploys are CT215-mediated (CT215 has GitHub access and syncs source to CT120 over SSH):

		```bash
	-	# on CT120
	-	cd /opt/zion-pm
	-	git pull
	-	pnpm install
	-	pnpm build
	-	sudo systemctl restart zion-pm # next start -p 4100
	+	# on CT215: pull latest canonical, sync source to CT120, build + restart there
	+	cd /shared/projects/zion-pm && git pull
	+	tar czf - app lib public package.json pnpm-lock.yaml tsconfig.json next.config.ts \
	+	postcss.config.mjs \| ssh root@REDACTED-IP 'tar xzf - -C /opt/zion-pm'
	+	ssh root@REDACTED-IP 'cd /opt/zion-pm && pnpm install && pnpm build && systemctl restart zion-pm'
		```

		Service: `zion-pm.service` (systemd, onboot). Logs: `journalctl -u zion-pm -f`.