Kokonut-Intelligence

feat: deployment foundation — staging on cerberus + production pipeline #95

Merged

Summary

Lays the complete deployment foundation per the approved topology plan: staging on cerberus (ki-staging project), production pipeline pre-built for a future Coolify host, environment templates, and documentation.

Staging (Phase A)

deploy/staging/docker-compose.staging.yml: isolated overlay, loopback-only ports (13001/18056/18098/50053), !override to strip base publishes
deploy/staging/.env.staging.example + README + .sops.yaml (age recipient pinned)
deploy/scripts/deploy-staging.sh: pull → sops decrypt → compose up --wait → health verify → summary

Production pipeline (Phase B, dormant until host exists)

deploy/scripts/deploy-production.sh: SSH deploy with mandatory pre-deploy checkpoint, DEPLOY_CONFIRM=yes gate, rollback instructions on failure (no auto-rollback per governance)
deploy/production/: env template, bootstrap runbook, ssh-setup runbook, backup policy

CI (B3)

deploy-staging job: auto after ci passes on main
deploy-production job: manual promotion only, DEPLOY_CONFIRM parameter

Docs (Phase C)

docs/deployment-topology.md: environment matrix, port allocation, namespace-isolation invariant (KI-390 lesson)
AGENTS.md: deployment section

Also

.gitignore: plaintext staging/prod env files explicitly ignored
shellcheck-clean on all new scripts

Verification

Staging overlay validated via compose config (exactly 4 loopback publishes, zero base-port leaks)
shellcheck clean; check-tracked-secrets clean
Staging secrets encrypted and roundtrip-verified on the host

Copy

Commits were merged into target branch

feat(deploy): staging compose overlay

Isolated ki-staging Compose project for the cerberus staging host.
Uses !override to replace (not merge) base-file port lists: staging
binds loopback-only 13001/18056/18098/50053; database, clickhouse,
cache, caddy, and mosquitto keep no published ports at all.

Port allocation per docs/deployment-topology.md; no overlap with the
ki-ci project (13001/18056/18098/50053 vs CI 15432/18123/18055/18099/50052).

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

3 weeks ago

6f7767c0

feat(deploy): staging environment template + docs

.env.staging.example (all vars, placeholder policy), staging README
(bootstrap, day-2 ops, secrets editing), and .sops.yaml pinning the
staging age recipient. Plaintext env never committed; encrypted
.env.staging.sops is created during provisioning.

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

3 weeks ago

e1b3e5ef

feat(deploy): staging deploy script

Idempotent deploy for the ki-staging project on cerberus: pull main,
decrypt env via sops+age (plaintext only in a trapped 0600 temp file),
compose up --build --wait, per-service health verification, and a
deployment summary. Supports --skip-seed / --skip-build.

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

3 weeks ago

966ef9d0

fix(deploy): simplify sops path_regex for sops compatibility

sops's regex engine rejects the (\.sops)? optional group; use a
simple .*staging.* match covering both plaintext and encrypted
variants. Verified encrypt+decrypt roundtrip against the staging
age key.

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

3 weeks ago

a32c6092

fix(deploy): drop forced dotenv types on sops decrypt

sops stores the original format in its metadata; forcing
--input-type/--output-type dotenv on decrypt makes it re-parse its own
JSON envelope as dotenv and fail. Auto-detection handles it.

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

3 weeks ago

bbc823a2

feat(deploy): production pipeline — script, env template, runbooks

deploy-production.sh: SSH deploy with DEPLOY_CONFIRM=yes gate,
mandatory pre-deploy backup checkpoint, health verification, and
manual-rollback instructions on failure (never auto-rolls-back).

deploy/production/: env template (PUBLIC_RESTRICT=true, Traefik vars),
bootstrap runbook, CI-runner SSH setup with scoped kokonut-deploy user,
and backup policy (nightly + off-host + monthly restore rehearsals).

Dormant until the production host is provisioned; everything is
pre-built so launch day only needs SSH credentials.

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

3 weeks ago

df5063a8

docs: deployment topology + AGENTS deployment section

Environment matrix, port allocation table, deploy flow, and the
namespace-isolation invariant (KI-390 lesson) documented as a repo
standard. AGENTS.md gains a Deployment section pointing at the
topology doc and the per-environment deploy scripts.

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

3 weeks ago

a4413006

feat(deploy): staging backup script

Nightly wrapper around scripts/backup.sh: verifies each checkpoint,
prunes to the 7 newest, reports disk usage. Cron installed on the
staging host at 03:30.

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

3 weeks ago

84fae98a

feat(ci): staging auto-deploy + production promotion pipeline + liveness probe

- deploy-staging job: runs after ci succeeds on main; local exec into
  the ki-staging project (same trust boundary as the staging host)
- deploy-production job: MANUAL promotion only — refuses without
  DEPLOY_CONFIRM=yes, never auto-triggered, no retries
- ci job gains a non-fatal staging liveness probe (monitoring, not deploy)

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

3 weeks ago

a689318c

syntropicagent commented 3 weeks ago

CI KI-400 green: all fast-fail gates, 4098 tests, static analysis, Solidity, hooks. Liveness probe correctly reported staging down (pre-provision). Merging on Wasabi's instruction ("execute the full thing"). First deploy-staging run will follow the merge.

Copy
syntropicagent merged 3 weeks ago (merge commit: f59f950c )
Login to comment

Submitter	syntropicagent
Target	main
Source	feat/deployment-foundation

Jobs

Merge Strategy

Create Merge Commit

Watchers (1)

Reference

pr KI-95