fix(deploy): split host-specific config, sync templates from CI (#33)

* fix(deploy): sync compose.prod.yml to server before restart

Server had stale compose.prod.yml with STATIC_DIR=/app/frontend/dist,
but the current image serves static assets from /app/web/dist
(renamed in #30). Prod served 404 on /.

Deploy now checks out the repo and scps compose.prod.yml to the
server so env config stays in lockstep with the image.

* docs(deploy): sync graphhopper config too, document minimal server layout

Extend the scp step to ship backend/graphhopper_config.yml alongside
compose.prod.yml so every file compose.prod.yml references comes from
CI. Add DEPLOY.md describing the authoritative server layout and the
rule that anything not referenced by compose.prod.yml should be
deleted from the server.

* refactor(deploy): split host-specific config into server-side .env

Previously compose.prod.yml entangled app config (STATIC_DIR, LISTEN_ADDR,
PHOTON_URL — all image-bakable), orchestration (service wiring) and host
identity (DB password, memory limits, host ports) in one file that CI
overwrote on every deploy. This let image/compose drift break prod (the
STATIC_DIR /app/frontend/dist vs /app/web/dist mismatch that served 404
on /) and kept secrets in git.

New split:
- Image defaults own app config (already the case in backend/src/config.rs
  and backend/Dockerfile; compose just stops overriding them).
- compose.prod.yml is a pure orchestration template with ${VAR} refs,
  synced by CI.
- Host-specific values live in ~/beebeebike/.env on the prod host:
  POSTGRES_PASSWORD, memory limits (DB_MEM_LIMIT, GRAPHHOPPER_MEM_LIMIT,
  TILES_MEM_LIMIT, BACKEND_MEM_LIMIT), Postgres tuning, GRAPHHOPPER_JAVA_OPTS,
  reverse-proxy-facing host ports. Never committed, never touched by CI.
  .env.example documents the schema.

Deploy now pulls all images and recreates the whole stack (needed once
because graphhopper's config mount moved to backend/graphhopper_config.yml
and the tiles/db services pick up their memory limits from .env).

Author: cafca

.env.example

@@ -0,0 +1,26 @@
+# Host-specific config for compose.prod.yml.
+# Copy to ~/beebeebike/.env on the prod host and edit. Never commit .env.
+# Docker Compose auto-loads .env from the same dir as the compose file.
+
+# --- Database ---
+POSTGRES_DB=beebeebike
+POSTGRES_USER=beebeebike
+POSTGRES_PASSWORD=CHANGE_ME
+
+# Postgres memory tuning (keep within DB_MEM_LIMIT)
+DB_SHARED_BUFFERS=64MB
+DB_WORK_MEM=4MB
+DB_EFFECTIVE_CACHE_SIZE=256MB
+
+# --- Container memory limits ---
+DB_MEM_LIMIT=256m
+GRAPHHOPPER_MEM_LIMIT=512m
+TILES_MEM_LIMIT=128m
+BACKEND_MEM_LIMIT=128m
+
+# --- Graphhopper JVM (must fit within GRAPHHOPPER_MEM_LIMIT) ---
+GRAPHHOPPER_JAVA_OPTS=-Xmx384m -Xms256m
+
+# --- Reverse-proxy-facing host ports (bound to 127.0.0.1) ---
+BACKEND_HOST_PORT=3848
+TILES_HOST_PORT=3847

.github/workflows/ci.yml

@@ -119,6 +119,19 @@ jobs:
     runs-on: ubuntu-latest
     if: vars.DEPLOY_HOST != ''
     steps:
+      - uses: actions/checkout@v4
+
+      - name: Sync runtime config to server
+        uses: appleboy/scp-action@v1
+        with:
+          host: ${{ vars.DEPLOY_HOST }}
+          username: ${{ vars.DEPLOY_USER }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          source: |
+            compose.prod.yml
+            backend/graphhopper_config.yml
+          target: beebeebike/
+
       - name: Deploy via SSH
         uses: appleboy/ssh-action@v1
         with:
@@ -127,5 +140,5 @@ jobs:
           key: ${{ secrets.DEPLOY_SSH_KEY }}
           script: |
             cd ~/beebeebike
-            docker compose -f compose.prod.yml pull backend
-            docker compose -f compose.prod.yml up -d backend
+            docker compose -f compose.prod.yml pull
+            docker compose -f compose.prod.yml up -d --remove-orphans

compose.prod.yml

@@ -1,15 +1,26 @@
+# Orchestration template for the prod host.
+# Host-specific values (secrets, memory limits, ports, tuning) come from
+# ~/beebeebike/.env on the server. See .env.example.
+
 services:
   db:
     image: postgis/postgis:16-3.4
     container_name: beebeebike-db
     environment:
-      POSTGRES_DB: beebeebike
-      POSTGRES_USER: beebeebike
-      POSTGRES_PASSWORD: beebeebike
-    command: postgres -c shared_buffers=64MB -c work_mem=4MB -c effective_cache_size=256MB
+      POSTGRES_DB: ${POSTGRES_DB}
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    command:
+      - postgres
+      - -c
+      - shared_buffers=${DB_SHARED_BUFFERS}
+      - -c
+      - work_mem=${DB_WORK_MEM}
+      - -c
+      - effective_cache_size=${DB_EFFECTIVE_CACHE_SIZE}
     volumes:
       - pgdata:/var/lib/postgresql/data
-    mem_limit: 256m
+    mem_limit: ${DB_MEM_LIMIT}
     restart: unless-stopped
 
   graphhopper:
@@ -26,36 +37,33 @@ services:
       - ./data/osm/berlin/berlin.osm.pbf:/data/berlin.osm.pbf:ro
       - ./data/osm/berlin/graphhopper:/data/graphhopper-cache
     environment:
-      JAVA_OPTS: "-Xmx384m -Xms256m"
-    mem_limit: 512m
+      JAVA_OPTS: ${GRAPHHOPPER_JAVA_OPTS}
+    mem_limit: ${GRAPHHOPPER_MEM_LIMIT}
     restart: unless-stopped
 
   tiles:
     image: versatiles/versatiles-frontend:latest-alpine
     container_name: beebeebike-tiles
     ports:
-      - "127.0.0.1:3847:8080"
+      - "127.0.0.1:${TILES_HOST_PORT}:8080"
     volumes:
       - ./data/tiles/berlin.versatiles:/tiles/berlin.versatiles:ro
     command: ["/app/versatiles", "server", "-s", "/app/frontend-dev.br.tar", "[osm]/tiles/berlin.versatiles"]
-    mem_limit: 128m
+    mem_limit: ${TILES_MEM_LIMIT}
     restart: unless-stopped
 
   backend:
     image: ghcr.io/cafca/beebeebike:latest
     container_name: beebeebike-backend
     ports:
-      - "127.0.0.1:3848:3000"
+      - "127.0.0.1:${BACKEND_HOST_PORT}:3000"
     environment:
-      DATABASE_URL: postgres://beebeebike:beebeebike@db:5432/beebeebike
+      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
       GRAPHHOPPER_URL: http://graphhopper:8989
-      PHOTON_URL: https://photon.komoot.io
-      LISTEN_ADDR: 0.0.0.0:3000
-      STATIC_DIR: /app/web/dist
     depends_on:
       - db
       - graphhopper
-    mem_limit: 128m
+    mem_limit: ${BACKEND_MEM_LIMIT}
     restart: unless-stopped
 
 volumes: