sam/ai-resume
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

deploy: health gate and shape assertion follow the LAN publish address

Browse Source 
Once the port is published on 192.168.20.13 the host no longer listens on
127.0.0.1:8096, so wait_healthy(), do_status() and the rollback path would all
get connection-refused and every deploy would roll back. They now probe
$PUBLISH_IP (RESUME_PUBLISH_IP, default 192.168.20.13). assert_shape() asserts
the published host IP is that address instead of loopback; the mem_limit ==
memswap_limit checks are unchanged. check_port stays address-agnostic on
`sport = :8096`.

Records the amendment in reference/stack.md (ports table + the bind rule) and
docs/phase-3-deploy.md (§3.2 bullet, flow diagram, DoD line), citing Sam's
decision of 2026-10-26, interaction 54aeb1a2. AGENTS.md is Sam's to change and
is untouched.
This commit is contained in:
Sam Rolfe
2026-10-26 22:40:22 +11:00
parent 5c0622c1b1
commit df864cc29e
3 changed files with 28 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
docs/phase-3-deploy.md
View File

@@ -30,7 +30,7 @@ deploy.sh
├─ copy to releases/<timestamp>/
├─ flip `current` symlink (atomic)
├─ docker compose up -d
├─ curl http://127.0.0.1:8096/healthz → must be ready
├─ curl http://192.168.20.13:8096/healthz → must be ready
└─ on failure: flip back to `previous`, exit non-zero
```
@@ -40,7 +40,12 @@ deploy.sh
### 3.2 Container
- `mem_limit` = `memswap_limit` = `120m`.
- `ports: ["127.0.0.1:8096:8096"]` — never `0.0.0.0`.
- `ports: ["192.168.20.13:8096:8096"]` — **never** `0.0.0.0`.
Caddy runs on `.35`, so the port has to be reachable from the LAN; a
`127.0.0.1` publish answers only on `.13` and the public URL returns 502.
LAN-only publish, Caddy on `.35` still the sole public listener. Decision:
Sam, 2026-10-26, interaction `54aeb1a2`. The health gate and `assert_shape()`
in `deploy.sh` follow the same address (`RESUME_PUBLISH_IP`).
- `logging` capped (`max-size: 10m`, `max-file: 3`).
- `restart: unless-stopped`.
@@ -75,7 +80,7 @@ Repo stays private through this phase. Sam decides on public visibility after th
- [ ] `deploy.sh` and `deploy.sh --rollback` both work; a deliberate bad build proves rollback.
- [ ] `https://resume.lab.audasmedia.com.au` serves the site.
- [ ] Container bound to `127.0.0.1` only; confirmed with `ss -ltn`.
- [ ] Container published on `192.168.20.13:8096` only, reachable from `.35`; confirmed with `ss -ltn`.
- [ ] `memswap_limit == mem_limit`; confirmed with `docker inspect`.
- [ ] Security headers present; CSP does not break the page.
- [ ] A1 still passes over the public URL with the AI layer stopped.