Files

Trey t 34553f3bec Add K3s dev deployment setup for single-node VPS

Mirrors the prod deploy-k3s/ setup but runs all services in-cluster
on a single node: PostgreSQL (replaces Neon), MinIO S3-compatible
storage (replaces B2), Redis, API, worker, and admin.

Includes fully automated setup scripts (00-init through 04-verify),
server hardening (SSH, fail2ban, ufw), Let's Encrypt TLS via Traefik,
network policies, RBAC, and security contexts matching prod.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-30 21:30:39 -05:00

932 B

Raw Permalink Blame History

Secrets Directory

Create these files before running scripts/02-setup-secrets.sh:

File	Purpose
`postgres_password.txt`	In-cluster PostgreSQL password
`secret_key.txt`	App signing secret (minimum 32 characters)
`email_host_password.txt`	SMTP password (Fastmail app password)
`fcm_server_key.txt`	Firebase Cloud Messaging server key (optional — Android not yet ready)
`apns_auth_key.p8`	Apple Push Notification private key
`minio_root_password.txt`	MinIO root password (minimum 8 characters)

Optional (only if tls.mode: cloudflare in config.yaml):

File	Purpose
`cloudflare-origin.crt`	Cloudflare origin certificate (PEM)
`cloudflare-origin.key`	Cloudflare origin certificate key (PEM)

All string config (registry token, domains, etc.) goes in config.yaml instead. These files are gitignored and should never be committed.

932 B Raw Permalink Blame History

Secrets Directory

932 B

Raw Permalink Blame History