mi/werkator
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Step 23 sessions B+C: tools/remote wraps, verified live on mih34

Browse Source 
The wrapper's config writing is gone: --env-file FILE selects the
target instance (default .env; named like docker's flag — --env means a
single variable there), the init fragment named by WERKATOR_INIT_CONFIG
is uploaded and installed remotely via 'werkator init --apply', and
instance-start places the .htaccess that init now generates. The
heredoc/sed machine-config writing is deleted; control-token delegates
to the werkator CLI; check-prerequisites uploads werkdock and runs its
doctor — tools/werkator-build-prerequisites.sh retires. The idle-check
and port-forward port lookups read the effective config via
config:print, so a port living in the applied fragment is found too.

Verified live against mih34 with the .env.mih34 + .env.mih34.yml pair
(gitignored via the new /.env.* rule): update, doctor PASS 6/6,
repo-init applying the fragment as the new layer, instance-start
placing the generated proxy and restarting the unit, control-token.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
mhoennig
2026-09-01 19:00:38 +02:00
co-authored by Claude Fable 5
parent 5f1a669771
commit 1d1bd19e10
7 changed files with 114 additions and 283 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/deployment.md
+9 -7
View File
@@ -268,14 +268,16 @@ The third deployment variant (plan step 21, verified live on a real webspace): n
Werkator runs as a systemd *user* service on the assigned localhost port ("eigener Serverdienst"), the platform's managed Apache terminates TLS and proxies via `.htaccess`, and builds run in the bubblewrap sandbox executed by the [werkdock](../werkdock/README.md) CLI (ADR 0008, step 21 session C).
Werkator is never built on the webspace: the runtime bundle and the werkdock binary are built locally and uploaded (ADR 0006).
All steps are driven by `tools/remote`, configured through the `.env` file in the repository root; commands name their role — `instance-*` manages the installed Werkator, `repo-*` the repository it watches.
All steps are driven by `tools/remote`; commands name their role — `instance-*` manages the installed Werkator, `repo-*` the repository it watches.
Each instance is a pair of files (step 23): a transport env file selected with `--env-file` (default `.env`), and a YAML fragment in the configuration schema, named by its `WERKATOR_INIT_CONFIG` key and installed remotely via `werkator init --apply` — e.g. `.env.mih34` + `.env.mih34.yml`, both gitignored.
The fragment carries the Werkator configuration (`server.port`, `publicBaseUrl`, systemd limits, `builds.default.bwrap.*`); the env file only says where and how to reach the host.
```bash
tools/remote werkator check-prerequisites # bwrap capability, disk and quota headroom
tools/remote werkator instance-install # upload + unpack the runtime bundle and werkdock
tools/remote werkator repo-init # clone the watched repo, init, rootfs archive, bwrap config
tools/remote werkator instance-start # server config, Apache proxy, systemd user unit
tools/remote port-forward start # browser tunnel while no public domain is set up
tools/remote --env-file .env.mih34 werkator check-prerequisites # uploads werkdock, runs its doctor
tools/remote --env-file .env.mih34 werkator instance-install # upload + unpack the runtime bundle and werkdock
tools/remote --env-file .env.mih34 werkator repo-init # clone the watched repo, rootfs archive, init --apply
tools/remote --env-file .env.mih34 werkator instance-start # init --apply --systemd, place .htaccess, enable the unit
tools/remote --env-file .env.mih34 port-forward start # browser tunnel while no public domain is set up
```
Layout on the host: the watched repository at `$WERKATOR_PATH/werkator/`, the unpacked runtime at `$WERKATOR_PATH/.werkator/werkator/`, the werkdock binary at `$WERKATOR_PATH/.werkator/bin/werkdock`.
@@ -285,7 +287,7 @@ Fill `git.account`/`git.token` in the machine config when the origin is private,
Updates are one command, refused while a build runs (`FORCE=1` overrides):
```bash
tools/remote werkator instance-update
tools/remote --env-file .env.mih34 werkator instance-update
```
The previous runtime stays as `.werkator/werkator.prev` for one deployment as the rollback asset.