# Deployment — Compass / NHS (school.lab.audasmedia.com.au)

Own image, own container, own port **8792**, host `.13` (nixos-desktop). Caddy
on `.35` (sam-ubuntu1) terminates TLS and proxies to `192.168.20.13:8792`.

## Ports

| Port | Service |
|---|---|
| 8792 | Compass / NHS (this project) |

## Host (.13)

1. Project folder: `/home/sam/paseo/projects/compass_teams_nhs`.
2. Data: the named volume `compass-teams-nhs_compass-teams-nhs-data` at `/data`
   (SQLite `school.db`).
3. Create the environment file from the example:

   ```bash
   cd /home/sam/paseo/projects/compass_teams_nhs
   cp environment.d/school-service.env.example environment.d/school-service.env
   chmod 600 environment.d/school-service.env
   # fill SCHOOL_SESSION_SECRET, SCHOOL_ADMIN_PASSWORD_HASH
   ```

4. Build and start:

   ```bash
   docker compose up -d --build
   docker compose ps          # compass-teams-nhs  Up (healthy)  0.0.0.0:8792->8792/tcp
   ```

5. Verify:

   ```bash
   make verify-phase1
   ```

## Caddy (.35)

1. SSH: `ssh sam@192.168.20.35`.
2. Append `deploy/caddy/Caddyfile.snippet` to `/Docker/Containers/caddy/Caddyfile`.
3. Validate and reload (never restart):

   ```bash
   docker exec caddy caddy validate --config /etc/caddy/Caddyfile
   docker exec caddy caddy reload   --config /etc/caddy/Caddyfile
   ```

4. Test: `curl -sS -o /dev/null -w '%{http_code}\n' https://school.lab.audasmedia.com.au/health`

## Notes

- `.13` has every default Docker address pool subnetted out. This single-container
  service therefore uses `network_mode: bridge` and publishes 8792; it does not
  create a project network.
- The env file is gitignored. School credentials and harness session state are
  secrets (AGENTS.md §10 rule 3); they never enter git.

## Phase 7 — notifications (Apprise)

The morning briefs are delivered through the house **Apprise** API on `.35:8210`
(container `apprise`, host port 8210 → container 8000). Caddy exposes it at
`https://apprise.lab.audasmedia.com.au` behind basic auth; the service talks to
the API directly on the internal address.

1. Create (or reuse) the Apprise **stored configuration** that holds every
   destination, using these tags:

   | Tag | Destination |
   |---|---|
   | `harry_email`, `finn_email`, `joanna_email`, `sam_email` | email |
   | `harry_whatsapp`, `finn_whatsapp`, `joanna_whatsapp`, `sam_whatsapp` | WhatsApp (CallMeBot) |

2. Copy its **key** into `environment.d/school-service.env` as
   `SCHOOL_APPRISE_KEY`, and generate the n8n token:

   ```bash
   docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.6.2-phase6b7b gen-secret
   # -> SCHOOL_NOTIFY_TOKEN=<the value>
   ```

3. Restart the service, then prove the whole path without messaging anyone:

   ```bash
   make preview                      # prints both boys + the combined brief
   curl -s -X POST -H "Authorization: Bearer $SCHOOL_NOTIFY_TOKEN" \
        'http://127.0.0.1:8792/notify/morning?dry_run=1' | jq .
   ```

4. Send for real (this messages the family):

   ```bash
   make notify                       # from the latest scan
   make morning-brief                # scan both children, then send
   docker exec compass-teams-nhs /app/school notify status
   ```

5. Schedule the 06:00 daily run in n8n (Phase 7a, AUD-115):

   ```bash
   deploy/setup-n8n-scan-key.sh --apply      # restricted SSH key for the trigger
   deploy/import-n8n-morning-brief.sh --apply # credential + workflow + publish + restart n8n
   ```

   The workflow is Schedule Trigger -> SSH node -> a Code check that makes a
   non-zero exit red. The SSH node authenticates with the restricted key and runs
   `scripts/morning-brief.sh` on the host. (n8n 2.x disables the Execute Command
   node by default, so a command node cannot activate.) It needs no
   `SCHOOL_NOTIFY_TOKEN` in n8n — the host script reads the project env file. See
   `docs/phase-7a-n8n-schedule.md` for the design and the failure drill.
   After the first 06:00, verify the scheduled run itself with the read-only
   `make verify-n8n` (`deploy/verify-n8n-scheduled-run.sh`); it exits 1 until a
   scheduled (`mode=trigger`) run exists and is green.

Notes:

- The destination URLs (addresses, phone numbers, SMTP passwords) live only in
  the Apprise configuration. `GET /json/urls/{key}` prints `callmebot://` for a
  WhatsApp entry because Apprise masks credentials in privacy mode; the entry is
  real, and the container log shows `CallMeBot SUCCESS`.
- The scan stays a host step: patchright and its browser are on `.13`, not in the
  service image. `scripts/morning-brief.sh` runs the scan and the send in order.
- A run that cannot deliver exits non-zero, and the endpoint answers `207`, so a
  broken morning is visible in n8n instead of silent (FR-12).
- The 06:00 schedule is the n8n workflow `Compass / NHS — 6:00am morning brief`
  (`deploy/n8n-morning-brief.json`), triggered over a restricted SSH key. It runs
  on the shared n8n service on `.13`. Sam approved plan revision 2 and the workflow
  was imported, published, and activated on 2026-10-16; the first automatic run is
  06:00 on 2026-10-17. n8n 2.x disables the Execute Command node by default, so the
  workflow uses the SSH node plus a Code check that fails the run on a non-zero exit.