Ops/dev2 fleet kit - #110

Merged

ralyodio merged 105 commits into

masterfrom

ops/dev2-fleet-kit

Sep 26, 2026

Commits on Sep 25, 2026

dev2: fleet kit to move Railway sites onto dev2 and deploy them on merge

ralyodio
and
claude
committed
1081b26
dev2: README for the fleet kit

ralyodio
and
claude
committed
971cbc7
dev2-site: clone private repos over ssh with a read-only deploy key; show deploy stderr

ralyodio
and
claude
committed
840334c
dev2-site: write remote files via temp + mv

ralyodio
and
claude
committed
e194cad
dev2-site: per-site self-hosted Supabase (stack, pull, load, storage, cutover) + proxied gateway hosts

ralyodio
and
claude
committed
56ee9c5
dev2: README for the Supabase second pass and private repos

ralyodio
and
claude
committed
599e60d
dev2-site: public verify waits out resolver caches

ralyodio
and
claude
committed
177fc38
dev2-site firewall: allow every Docker address pool on the data ports

ralyodio
and
claude
committed
b918330
dev2-site: https clone for public repos; deploy key only when private

ralyodio
and
claude
committed
15bb4fd
dev2-site: quote BUILD_SERVICES; sslmode=no-verify for node-postgres apps

ralyodio
and
claude
committed
f095e20
dev2-site verify: fail on connection failures in recent logs

ralyodio
and
claude
committed
888ac34
dev2-site vhost: large_client_header_buffers at server level

ralyodio
and
claude
committed
5175bd8
dev2-site supabase-cutover: tolerate projects without pg_cron; no-verify db url

ralyodio
and
claude
committed
3362aab
dev2-site: reload PostgREST schema cache after load; world-readable checkouts

ralyodio
and
claude
committed
bada534
dev2-site: sslmode=require&uselibpqcompat=true, the form both Bun.SQL and node-postgres accept

ralyodio
and
claude
committed
433bc66
dev2-site: explicit 10.200.<n>.0/24 subnet per site (Docker pools exhausted)

ralyodio
and
claude
committed
21e9b59
dev2-site: sslmode per driver (no-verify for node-postgres repos, require otherwise)

ralyodio
and
claude
committed
c0a8867
dev2-site: public build-time variables reach the build; nixpacks on Node 22

ralyodio
and
claude
committed
f3db2a3
deploy-app.sh: export public build vars by parsing app.env, not sourcing it

ralyodio
and
claude
committed
a6123d5
deploy-app.sh: recreate the stack when the network subnet changes (stale embedded DNS)

ralyodio
and
claude
committed
f5fd1f9
dev2-site verify: require the vhost to exist

ralyodio
and
claude
committed
945c1e7
sites.d: media2markdown.com repo override

ralyodio
and
claude
committed
492849d
deploy-app.sh: recreate the stack when a sibling service name fails to resolve

ralyodio
and
claude
committed
3bd9688
dev2-site: db copy from plain postgres images; DNS self-check parses services only; opensocial.chat override

ralyodio
and
claude
committed
9b5cbbf
dev2-site scaffold: pass NIXPACKS_NODE_VERSION through --env, rewrite nodejs_18, --regen

ralyodio
and
claude
committed
2b84381
dev2-site scaffold: honour RAILWAY_DOCKERFILE_PATH and RAILPACK_*/NIXPACKS_* command variables

ralyodio
and
claude
committed
2086bee
dev2-site scaffold: pin corepack 0.36 in nixpacks Dockerfiles

ralyodio
and
claude
committed
0ce1b24
dev2-site cert: remove Railway's _acme-challenge CNAMEs before DNS-01

ralyodio
and
claude
committed
6b21850
sites.d: meshhook.com on Node 24

ralyodio
and
claude
committed
7182d5b
dev2-site: image-only sites (stock image + Railway start command, no clone/build); openaccess + openmcp overrides

ralyodio
and
claude
committed
3d0e644
sites.d: mynaposter.com with its API companion on api.mynaposter.com

ralyodio
and
claude
committed
5aab1f6
dev2-site scaffold: per-site start_command feeds nixpacks; mynaposter commands

ralyodio
and
claude
committed
287d968
deploy-app.sh: REPO optional for image-only sites

ralyodio
and
claude
committed
4b6f543
dev2-site: a wildcard covers its one-label subdomains in the certificate order

ralyodio
and
claude
committed
b1a1537
dev2-site cert: reuse a certificate issued in the last day

ralyodio
and
claude
committed
fc6f772
dev2: README for firewall, box-tune, image-only sites, companion ports

ralyodio
and
claude
committed
0c29994
dev2-site: db-create for Turso/Supabase second passes; Turso variables re-pointed once a database exists

ralyodio
and
claude
committed
fdee8ed
dev2-site: DEV2_JUMP / DEV2_PROBE for when the provider blocks this box

ralyodio
and
claude
committed
32b6319
dev2-site volumes: per-file, resumable, chunked copy (Railway's ssh drops long streams)

ralyodio
and
claude
committed
00aed0c
dev2: keep credentials out of sites.d, which is committed and public
ralyodio
committed
96b223e
dev2-site provision: inside port from the Dockerfile HEALTHCHECK/EXPOSE when Railway set none

ralyodio
and
claude
committed
7e0ecc7
dev2-site deploy: default to the default branch once the scaffold PR is merged

ralyodio
and
claude
committed
69d8bb3
dev2-site verify: probe wildcards through a sample label

ralyodio
and
claude
committed
dae6486
dev2-site: HTTP-01 certificates and manual DNS for zones not at Porkbun

ralyodio
and
claude
committed
e0bc53d
dev2-site: nixpacks images get the start command as one bash -c string

ralyodio
and
claude
committed
49fec2d
sites.d: app.moshcode.sh runs the pwa server, not the CLI

ralyodio
and
claude
committed
f1a6b11
dev2-site: env_remove for settings a ported app refuses; README for the Turso second pass

ralyodio
and
claude
committed
2c657e6
dev2-site db: copy the database the app's URL names, not the instance default

ralyodio
and
claude
committed
20bdde8
dev2-site db: companions' variables may name the database

ralyodio
and
claude
committed
e75d446
dev2-site: a published companion listens on its own inside port

ralyodio
and
claude
committed
148ffdf
dev2: tronbrowser.dev on Postgres, retire the Turso settings

ralyodio
and
claude
committed
0a64699
sites.d: app.moshcode.sh uses its own Dockerfile

ralyodio
and
claude
committed
585c13a
dev2-site cert: drop stale _acme-challenge TXT records before issuing

ralyodio
and
claude
committed
0b635b5
dev2: feedback.profullstack.com off Turso onto the shared Postgres cluster

ralyodio
and
claude
committed
61c8113
dev2: reeleel.com registry on Postgres, retire the Turso replica settings

ralyodio
and
claude
committed
b7ae547
dev2: opensourcelegends.com off Turso onto the shared Postgres cluster

ralyodio
and
claude
committed
5e02e64
dev2-site: detect the Postgres driver on origin's default branch; libsql-pg apps take sslmode=require

ralyodio
and
claude
committed
3133d8e
dev2-site: fall back to the live app.env on dev2 when Railway has no variables; box-tune raises inotify limits

ralyodio
and
claude
committed
42fa4b3
dev2-site supabase-load --reset: replace an earlier load with a fresh dump

ralyodio
and
claude
committed
f000a2b
dev2-site: sites.d skip flag; community gardens stays on Railway

ralyodio
and
claude
committed
9d32dc7
dev2-site cert: reuse a fresh certificate only when it covers every name

ralyodio
and
claude
committed
e086133
dev2: ugig.net onto its own self-hosted Supabase stack

ralyodio
and
claude
committed
a55a52d
dev2: sh1pt.com off Supabase cloud onto its own self-hosted stack

ralyodio
and
claude
committed
5506d7e
dev2: smshub.dev off Supabase cloud onto its own self-hosted stack

ralyodio
and
claude
committed
ba3d64e
dev2: b1dz.com onto its own self-hosted Supabase stack

ralyodio
and
claude
committed
25ae321
sites.d: keep api.smshub.dev as an alias of the smshub Supabase gateway

ralyodio
and
claude
committed
0c2a644
dev2: marksyncr.com off Supabase cloud onto its own self-hosted stack

ralyodio
and
claude
committed
bb8d1c2
dev2: qaaas.dev onto its own self-hosted Supabase stack

ralyodio
and
claude
committed
38e43a9
dev2: qrypt.chat onto its own self-hosted Supabase stack

ralyodio
and
claude
committed
52c77ca
dev2: icemap.app off Supabase cloud onto its own self-hosted stack

ralyodio
and
claude
committed
d94e6a2
dev2: d0rz.com off Supabase cloud onto its own self-hosted stack

ralyodio
and
claude
committed
2acf153
dev2: saasrow.com self-hosted Supabase gateway (stack up, app NOT cut over)

ralyodio
and
claude
committed
4fddf03
dev2: postammo.com off Supabase cloud onto its own self-hosted stack

ralyodio
and
claude
committed
262c374
dev2: logicsrc.com onto its own self-hosted Supabase stack

ralyodio
and
claude
committed
cc5c698
dev2: weedforcrypto.com off Supabase cloud onto its own self-hosted stack

ralyodio
and
claude
committed
28b576d
dev2: infernetprotocol.com onto its own self-hosted Supabase stack

ralyodio
and
claude
committed
3c15d0b
dev2: phonenumbers.bot self-hosted Supabase stack staged (cutover after PR #10)

ralyodio
and
claude
committed
4186565
dev2: pairux.com onto its own self-hosted Supabase stack

ralyodio
and
claude
committed
cbd788a
dev2: installer.pairux.com onto pairux.com's self-hosted Supabase stack

ralyodio
and
claude
committed
d02f59c
dev2: bl0ggers.com off Supabase cloud onto its own self-hosted stack

ralyodio
and
claude
committed
a5d9536
dev2: brisk.news onto its own self-hosted Supabase stack

ralyodio
and
claude
committed
3f408e8
supabase-load/pull: count psql-prefixed errors, stop docker exec eating loop input, grant functions by signature

ralyodio
and
claude
committed
03cb3d6
dev2: coinpayportal.com self-hosted Supabase gateway (stack up, app NOT cut over)

ralyodio
and
claude
committed
0cea1ee
dev2-site supabase: new-style keys, Edge Functions step, NOT VALID constraints, vault, S3 host, bucket limits

ralyodio
and
claude
committed
0148c32
supabase-functions: re-point cloud URL/keys inside the copied function secrets

ralyodio
and
claude
committed
76c4e92
supabase-functions: the API only lists secret names; take values from the site variables

ralyodio
and
claude
committed
6588e86
supabase-functions: fix name collision in the probe; sites.d function_secrets overlay

ralyodio
and
claude
committed
a101dc3
dev2-site: sites.d crons -> /etc/cron.d (coinpayportal's minute payment monitor was a Vercel cron)

ralyodio
and
claude
committed
48e57be
sites.d: coinpayportal cut over to its dev2 Supabase; saasrow function secrets as vault refs

ralyodio
and
claude
committed
79e99ac
sites.d: tsbb.dev off Turso (TSBB_DATABASE_AUTH_TOKEN retired)
ralyodio
committed
3293f47
sites.d: app.logicsrc.com runs apps/pwa (start_command, /healthz) and leaves Turso
ralyodio
committed
32e74ab
sites.d: p0dcasters.com off Turso
ralyodio
committed
43a42e3
sites.d: app.moshcode.sh off Turso (DATABASE_AUTH_TOKEN retired)
ralyodio
committed
5f8b964
sites.d: outreachgraph.com off Turso (TURSO_AUTH_TOKEN retired)
ralyodio
committed
ed71870
sites.d: advis0r.com off Turso (DATABASE_URL was the libsql:// URL; drop DATABASE_AUTH_TOKEN)
ralyodio
committed
cbec887
dev2-site: a sites.d health_path overrides the one recorded in the state file

ralyodio
and
claude
committed
a02dc46
sites.d: c0upons.com and bufferoverride.com off Turso (retired settings dropped; c0upons also loses the dead SQLITECLOUD_URL)
ralyodio
committed
6798bd3
sites.d: hqtui.com and moshcoding.com off Turso
ralyodio
committed
d4020d4
sites.d: aiornot.vote off Turso
ralyodio
committed
a357409
dev2-site backup-install: version dev2-pg-backup.sh; dump every per-site Supabase stack and mirror storage files

ralyodio
and
claude
committed
1f390c9
sites.d: communitygardensasappleseeds.info off skip, moving to dev2

ralyodio
and
claude
committed
6064da5
dev2-site: a failing nginx -t no longer reloads; HTTP-01 challenge files world-readable (umask 022)

ralyodio
and
claude
committed
d93ae5e
sites.d: bittorrented.com (not a Railway site; Supabase stack only, app stays on the DO droplet)

ralyodio
and
claude
committed
4393b03
supabase-load: extensions into the extensions schema (cloud DDL says extensions.gin_trgm_ops); skip generated columns in the URL rewrite

ralyodio
and
claude
committed
9995d4b

Commits on Sep 26, 2026

Merge remote-tracking branch 'origin/master' into ops/dev2-fleet-kit-fix
ralyodio
committed
3734c42