Skip to content

Deployment CICD

Jump to bottom
benwu edited this page May 20, 2026 · 4 revisions

CI/CD and Durham Deployment Handover

This page describes the current deployment path without storing secrets. Keep real keys in GitHub Secrets or the Durham server .env only.

Current Architecture

  • Source of truth: GitHub repository lobx-platform/lobx.
  • CI/CD entrypoint: .github/workflows/docker-build-push.yml.
  • Backend runtime: Docker container on the Durham server, managed by docker-compose.server.yml.
  • Public backend URL: ngrok reserved domain, default https://dthinkr.ngrok.app.
  • Frontend runtime: Firebase Hosting, currently https://london-trader.web.app.
  • Participant path: browser loads Firebase frontend, then calls the backend through the ngrok HTTPS/WSS endpoint.

GitHub Actions Flow

  1. A push to main or manual workflow_dispatch starts the workflow.
  2. build-backend builds docker.io/venvoo/trading_platform:back from ./back and pushes both the mutable back tag and a SHA tag.
  3. deploy-backend SSHes into the Durham server using GitHub Secrets and runs /root/trading_platform/deploy.sh.
  4. deploy-frontend builds the Vue frontend with the public backend URLs and deploys to Firebase Hosting.

GitHub Secrets used by the current workflow:

  • DOCKERHUB_USERNAME
  • DOCKERHUB_TOKEN
  • SERVER_HOST
  • SERVER_USER
  • SERVER_SSH_KEY
  • SERVER_SSH_PASSPHRASE
  • FIREBASE_SERVICE_ACCOUNT
  • ADMIN_PASSWORD
  • TURNSTILE_SECRET_KEY
  • NGROK_AUTHTOKEN preferred for new deployments
  • NGROK_YML legacy fallback while migrating existing deployments

Durham Server Runtime Requirements

The server repo should live at /root/trading_platform unless APP_DIR is set differently.

Required local files on the server:

  • .env
  • back/config/auth/firebase-service-account.json
  • docker-compose.server.yml
  • deploy.sh

Use .env.example as the non-secret template for expected environment variables.

Expected .env entries on the server:

  • ADMIN_PASSWORD
  • FIREBASE_API_KEY
  • FIREBASE_AUTH_DOMAIN
  • FIREBASE_PROJECT_ID
  • FIREBASE_STORAGE_BUCKET
  • FIREBASE_MESSAGING_SENDER_ID
  • FIREBASE_APP_ID
  • FIREBASE_MEASUREMENT_ID
  • OPENROUTER_API_KEY
  • TURNSTILE_SECRET_KEY
  • NGROK_AUTHTOKEN
  • NGROK_DOMAIN optional, defaults to dthinkr.ngrok.app

deploy.sh fails early if ADMIN_PASSWORD or NGROK_AUTHTOKEN is missing. docker-compose.server.yml also passes ADMIN_PASSWORD into the backend container because the backend reads the admin password from the process environment.

Manual Server Deploy

cd /root/trading_platform
chmod +x deploy.sh
./deploy.sh

Optional overrides:

DEPLOY_BRANCH=main COMPOSE_FILE=docker-compose.server.yml ./deploy.sh

VPN and Firewall Notes

If Durham introduces VPN-only administrator access, the experiment can keep working as long as these paths remain available:

  • The Durham server can make outbound connections to Docker Hub to pull backend images.
  • The Durham server can make outbound connections to GitHub to pull repository changes.
  • The Durham server can make outbound connections to ngrok so the public backend URL remains reachable.
  • GitHub Actions can SSH to the Durham server, or Durham provides an alternative such as a self-hosted runner, bastion, or approved allowlist path.

The backend container should be bound to 127.0.0.1:8000 in the server compose file. Public participant traffic should go through ngrok, not directly to port 8000.

If Durham blocks GitHub-hosted runner SSH access, the likely fixes are:

  • Use a self-hosted GitHub Actions runner inside Durham's network.
  • Keep a manually triggered server deploy after VPN login.
  • Ask Durham to allow GitHub Actions SSH traffic to the deployment host.

Handover Checklist

  • Confirm who owns the GitHub repo and Docker Hub namespace.
  • Confirm at least two maintainers have access to GitHub Secrets.
  • Rotate any token that has ever appeared in committed files or meeting notes.
  • Confirm /root/trading_platform/deploy.sh is the repo version and executable.
  • Confirm server .env has ADMIN_PASSWORD and NGROK_AUTHTOKEN, and no real secrets are committed.
  • Confirm Firebase service account JSON exists only on the server and in GitHub Secrets.
  • Run a manual workflow_dispatch deploy before the next live lab session.
  • Verify https://dthinkr.ngrok.app health from outside Durham.
  • Verify Firebase frontend can connect to both HTTPS and WSS backend endpoints.
  • Document Durham's final VPN/firewall policy once they confirm it.

Clone this wiki locally