36 lines
1.2 KiB
Markdown
36 lines
1.2 KiB
Markdown
# FlashOps production deployment
|
|
|
|
- Domain: `flashops.imagebrewing.com`
|
|
- App root: `/data/wangzhan/app/storage-labos`
|
|
- Backend bind: `127.0.0.1:18080`
|
|
- Process manager: `systemd` unit `flashops.service`
|
|
- Reverse proxy: Baota Nginx vhost `flashops.imagebrewing.com.conf`
|
|
- Persistent data: `/data/wangzhan/app/storage-labos/flashops/var`
|
|
- Private environment file: `/etc/flashops/flashops.env`
|
|
|
|
The service deliberately uses one worker because the current production store is
|
|
SQLite. The current preview console is anonymously readable and writable through
|
|
Nginx; do not connect real hardware or production data until application RBAC and
|
|
approval gates are implemented. The ACME challenge path remains available so
|
|
certificate renewal can complete.
|
|
|
|
Before enabling Agent enrollment, create the environment file without putting
|
|
the secret in the repository or unit:
|
|
|
|
```bash
|
|
sudo install -d -o root -g root -m 0755 /etc/flashops
|
|
sudo install -o root -g root -m 0600 /dev/null /etc/flashops/flashops.env
|
|
sudoedit /etc/flashops/flashops.env
|
|
```
|
|
|
|
Add `FLASHOPS_AGENT_ENROLLMENT_TOKEN=<random secret>`, then restart the service.
|
|
|
|
Useful checks:
|
|
|
|
```bash
|
|
sudo systemctl status flashops
|
|
curl http://127.0.0.1:18080/api/v1/health
|
|
sudo nginx -t
|
|
sudo certbot renew --dry-run
|
|
```
|