From 0564e343725e145ec93457a0053d7413e86c614d Mon Sep 17 00:00:00 2001 From: Gabriel Brown Date: Thu, 13 Aug 2026 09:23:22 -0400 Subject: [PATCH] Sync compose with VPS deployment and trigger Watchtower on image push The deployed compose (SELinux :Z, TZ, healthcheck, watchtower label) now lives in the repo as the source of truth, and CI asks the VPS Watchtower API to deploy immediately after pushing instead of waiting for the nightly sweep. --- .gitea/workflows/build.yml | 8 ++++++++ README.md | 12 ++---------- docker/compose.yml | 18 ++++++++++-------- 3 files changed, 20 insertions(+), 18 deletions(-) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index d15b4d7..4e7e01e 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -33,3 +33,11 @@ jobs: docker tag agentchat:latest git.gbrown.org/gib/agentchat:latest docker push git.gbrown.org/gib/agentchat:${{ gitea.sha }} docker push git.gbrown.org/gib/agentchat:latest + + # Watchtower on the VPS updates labelled containers nightly at 04:30; this + # asks it to do so immediately. Non-fatal: the sweep still catches it. + - name: Trigger immediate deploy via Watchtower API + run: | + curl -fsS -X POST -H "Authorization: Bearer ${{ secrets.WATCHTOWER_TOKEN }}" \ + http://192.168.2.2:8080/v1/update \ + || echo "::warning::watchtower trigger failed; nightly sweep will deploy instead" diff --git a/README.md b/README.md index 9e4af7a..d6ba438 100644 --- a/README.md +++ b/README.md @@ -43,17 +43,9 @@ Or containerized: `podman compose -f docker/compose.local.yml up --build` ## Deployment -Gitea CI (`.gitea/workflows/build.yml`) typechecks, tests, then builds and pushes `git.gbrown.org/gib/agentchat:{latest,}` on pushes to `main`. Requires `REGISTRY_USER` / `REGISTRY_PASSWORD` repo secrets. +Gitea CI (`.gitea/workflows/build.yml`) typechecks, tests, builds and pushes `git.gbrown.org/gib/agentchat:{latest,}` on pushes to `main`, then hits the VPS Watchtower HTTP API so the new image deploys immediately (the nightly 04:30 sweep is the fallback). Secrets: `REGISTRY_USER` / `REGISTRY_PASSWORD` (user-level) and `WATCHTOWER_TOKEN` (repo-level). -On the VPS: - -```sh -mkdir agentchat && cd agentchat -curl -fsSLO https://git.gbrown.org/gib/agentchat/raw/branch/main/docker/compose.yml -podman compose up -d -``` - -The compose file joins the external `nginx-bridge` network with no published ports — point the reverse proxy for `agentchat.gbrown.org` at `agentchat:8080`. SQLite persists in `./data`. +The live deployment is on the VPS (`junior.gib`) at `~/Server/Agentchat/` — `docker/compose.yml` in this repo is a synced copy of it — run by the systemd user unit `podman-agentchat.service` (rootless podman, see the VPS `~/Server/AGENTS.md`). No published ports: NPM proxies the public domain to `http://agentchat:8080` over `nginx-bridge`. SQLite persists in `./data`. ## Notes diff --git a/docker/compose.yml b/docker/compose.yml index 51385b1..4d71dca 100644 --- a/docker/compose.yml +++ b/docker/compose.yml @@ -1,18 +1,20 @@ +# Deployed copy lives at junior.gib:~/Server/Agentchat/compose.yml — keep in sync. networks: nginx-bridge: - external: true + external: true # ALWAYS external; see the VPS ~/Server/AGENTS.md §5 services: agentchat: - image: git.gbrown.org/gib/agentchat:${TAG:-latest} - container_name: ${CONTAINER_NAME:-agentchat} - hostname: ${CONTAINER_NAME:-agentchat} - domainname: ${DOMAIN:-agentchat.gbrown.org} - networks: ['${NETWORK:-nginx-bridge}'] - #ports: ['${PORT:-8080}:8080'] + image: git.gbrown.org/gib/agentchat:latest + container_name: agentchat + hostname: agentchat + domainname: agentchat.gbrown.org + networks: ['nginx-bridge'] environment: + - TZ=America/New_York - AGENTCHAT_DB=/data/agentchat.db - volumes: ['./data:/data'] + volumes: + - ./data:/data:Z # :Z mandatory under SELinux Enforcing; see AGENTS.md §6 labels: ['com.centurylinklabs.watchtower.enable=true'] restart: unless-stopped healthcheck: