compass_teams_nhs/deploy/DEPLOYMENT.md

Deployment — Compass / NHS (school.lab.audasmedia.com.au)

Own image, own container, own port 8792, host .13 (nixos-desktop). Caddy on .35 (sam-ubuntu1) terminates TLS and proxies to 192.168.20.13:8792.

Ports

Port	Service
8792	Compass / NHS (this project)

Host (.13)

1. Project folder: /home/sam/paseo/projects/compass_teams_nhs.

2. Data: the named volume compass-teams-nhs_compass-teams-nhs-data at /data (SQLite school.db).

3. Create the environment file from the example:

   cd /home/sam/paseo/projects/compass_teams_nhs
   cp environment.d/school-service.env.example environment.d/school-service.env
   chmod 600 environment.d/school-service.env
   # fill SCHOOL_SESSION_SECRET, SCHOOL_ADMIN_PASSWORD_HASH
   

4. Build and start:

   docker compose up -d --build
   docker compose ps          # compass-teams-nhs  Up (healthy)  0.0.0.0:8792->8792/tcp
   

5. Verify:

   make verify-phase1
   

Caddy (.35)

1. SSH: ssh sam@192.168.20.35.

2. Append deploy/caddy/Caddyfile.snippet to /Docker/Containers/caddy/Caddyfile.

3. Validate and reload (never restart):

   docker exec caddy caddy validate --config /etc/caddy/Caddyfile
   docker exec caddy caddy reload   --config /etc/caddy/Caddyfile
   

4. Test: curl -sS -o /dev/null -w '%{http_code}\n' https://school.lab.audasmedia.com.au/health

Notes

• .13 has every default Docker address pool subnetted out. This single-container service therefore uses network_mode: bridge and publishes 8792; it does not create a project network.
• The env file is gitignored. School credentials and harness session state are secrets (AGENTS.md §10 rule 3); they never enter git.

Phase 7 — notifications (Apprise)

The morning briefs are delivered through the house Apprise API on .35:8210 (container apprise, host port 8210 → container 8000). Caddy exposes it at https://apprise.lab.audasmedia.com.au behind basic auth; the service talks to the API directly on the internal address.

1. Create (or reuse) the Apprise stored configuration that holds every destination, using these tags:

   Tag	Destination
   harry_email, finn_email, joanna_email, sam_email	email
   harry_whatsapp, finn_whatsapp, joanna_whatsapp, sam_whatsapp	WhatsApp (CallMeBot)

2. Copy its key into environment.d/school-service.env as SCHOOL_APPRISE_KEY, and generate the n8n token:

   docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.5.0-phase7 gen-secret
   # -> SCHOOL_NOTIFY_TOKEN=<the value>
   

3. Restart the service, then prove the whole path without messaging anyone:

   make preview                      # prints both boys + the combined brief
   curl -s -X POST -H "Authorization: Bearer $SCHOOL_NOTIFY_TOKEN" \
        'http://127.0.0.1:8792/notify/morning?dry_run=1' | jq .
   

4. Send for real (this messages the family):

   make notify                       # from the latest scan
   make morning-brief                # scan both children, then send
   docker exec compass-teams-nhs /app/school notify status
   

5. Schedule the 06:00 daily run in n8n (Phase 7a, AUD-115):

   deploy/setup-n8n-scan-key.sh --apply      # restricted SSH key for the trigger
   deploy/import-n8n-morning-brief.sh --apply # credential + workflow + publish + restart n8n
   

   The workflow is Schedule Trigger -> SSH node -> a Code check that makes a non-zero exit red. The SSH node authenticates with the restricted key and runs scripts/morning-brief.sh on the host. (n8n 2.x disables the Execute Command node by default, so a command node cannot activate.) It needs no SCHOOL_NOTIFY_TOKEN in n8n — the host script reads the project env file. See docs/phase-7a-n8n-schedule.md for the design and the failure drill.

Notes:

• The destination URLs (addresses, phone numbers, SMTP passwords) live only in the Apprise configuration. GET /json/urls/{key} prints callmebot:// for a WhatsApp entry because Apprise masks credentials in privacy mode; the entry is real, and the container log shows CallMeBot SUCCESS.
• The scan stays a host step: patchright and its browser are on .13, not in the service image. scripts/morning-brief.sh runs the scan and the send in order.
• A run that cannot deliver exits non-zero, and the endpoint answers 207, so a broken morning is visible in n8n instead of silent (FR-12).
• The 06:00 schedule is the n8n workflow Compass / NHS — 6:00am morning brief (deploy/n8n-morning-brief.json), triggered over a restricted SSH key. It runs on the shared n8n service on .13, so its import, publish, and the one-off n8n restart need approval first. n8n 2.x disables the Execute Command node by default, so the workflow uses the SSH node plus a Code check that fails the run on a non-zero exit.