Skip to content

deployment.md

Latest commit

 

History

History
102 lines (74 loc) · 3.81 KB

deployment.md

File metadata and controls

102 lines (74 loc) · 3.81 KB
Raw

Deployment

myprod-control is the hosted dashboard for this repo.

Production URL:

https://control.sankalpjha.dev

Vercel fallback URL: https://myprod-control.vercel.app.

GitHub repo:

https://github.com/blackdragoon26/Myprod

Agent provisioning documentation:

https://github.com/blackdragoon26/Myprod/blob/main/docs/agent-runbook.md

Project owner:

https://sankalpjha.dev/

Vercel CI/CD

The desired production flow is:

git push origin main -> GitHub -> Vercel production deploy

Use Vercel Git Integration as the production deployment path. The old GitHub Actions fallback was removed because a missing VERCEL_TOKEN secret made every push show a failed deployment even when Vercel had already deployed from Git.

Vercel Git Integration

Use this when the Vercel dashboard can access the GitHub account:

  1. Open the Vercel project myprod-control.
  2. Go to Settings -> Git.
  3. Connect blackdragoon26/Myprod.
  4. Set production branch to main.
  5. Keep framework preset as Other.
  6. Leave build command empty.
  7. Leave output directory empty.
  8. Confirm that pushes to main create production deployments.

The dashboard is a static public/index.html, static assets under public/assets/, the public Clerk bootstrap endpoint at api/auth-config.js, and the serverless smoke endpoint at api/smoke.js. Busy buttons use public/assets/waiting-cat.png; include that asset when checking a deployment rather than validating only the HTML response.

The Clerk Marketplace integration supplies NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY and CLERK_SECRET_KEY to Vercel Production. Only the publishable key is exposed by /api/auth-config; the static dashboard and Oracle agent never receive the secret key. See operator-authentication.md for the split rollout and recovery procedure.

Oracle Agent Deployment

The static dashboard and Oracle agent are deployed separately. A Git push updates Vercel, but it does not replace /usr/local/bin/poolctl on Oracle.

The dashboard must remain compatible during that split rollout. New agent-only controls are gated by capabilities returned from the authenticated status response. When an older agent omits managedAppLifecycleV2, the dashboard keeps the original registration and deploy flow, omits new request fields, and hides edit, delete, generic image-update, and environment controls. This makes either deployment order safe and does not resubmit or restart existing Nomad jobs. The CI tokens control is independently gated by appDeployTokensV1; it is hidden until the agent can mint, hash-store, list, and revoke scoped credentials. Neither capability causes a Nomad job submission during rollout. Clerk sessions are independently advertised by clerkOperatorAuthV1. The dashboard retains recovery-token access whether that capability is absent or present, so either deployment order remains safe.

For an agent change:

  1. Run go test ./....
  2. Build a static Linux ARM64 binary for Oracle.
  3. Copy it to /tmp over SSH.
  4. Back up the current binary, atomically install the new binary, and restart only poolctl-agent.
  5. Verify the agent health route, authenticated status, Nomad state, and public smoke checks.

Never place POOLCTL_AGENT_TOKEN in a build command, repository file, shell history, or deployment log.

Managed DNS additionally reads NETLIFY_AUTH_TOKEN, MYPROD_DNS_ZONE, and MYPROD_INGRESS_IPV4 from Oracle's root-readable agent environment. These are runtime configuration and must never be supplied to Vercel or committed. Follow netlify-dns.md for the one-time installation and verification.

Manual Deploy

Manual deploys are useful for quick iteration, but they are not the long-term source of truth. Production should be Git-driven so the deployed dashboard always matches main.