Skip to content

✨(dev-instance) deploy a dev instance from the dev branch - #1

Merged
YousefED merged 7 commits into
devfrom
dev-instance/setup
Oct 9, 2026
Merged

YousefED merged 7 commits into
devfrom
dev-instance/setup

Conversation

@YousefED

@YousefED YousefED commented Oct 9, 2026

Copy link
Copy Markdown

Purpose

This change adds a dev instance of Docs on one server. A merge to the dev branch deploys it.

Changes

  • deploy/dev-instance/: a Docker Compose stack for one server. It contains Docs, yhub, y-provider, PostgreSQL, Redis, Valkey for yhub, an S3 store, Keycloak with dev users, and Caddy for TLS.
  • .github/workflows/dev-instance.yml: on a push to dev, the workflow builds the frontend, yhub and y-provider images. It pushes them to GHCR and deploys them over SSH.
    • From the Actions tab, you can deploy another ref (for example a PR that is not merged). There is one server, so the last deploy wins.
  • Every deploy makes sure that a sample document exists: "07/10 meeting agenda (sample)", with 15 named versions by alice, bob, carol and dave. The deploy builds its history offline, with the recorded times, and stores it in yhub. This takes less than a minute. When the document exists, the deploy does not change it. The data of the document is on the server only, not in the repository.
  • The demo users alice, bob, carol and dave have their user name as password. The admin accounts have random passwords on the server. deploy/dev-instance/README.md tells how to read them.
  • The backend image is the upstream lasuite/impress-backend:main image of the base commit. Its digest is pinned in compose.yaml.
  • The nginx template of the compose example now also routes /collaboration/version/ to yhub. Before this change, named versions failed with 404 on a compose deployment. This fix is a separate commit.

Secrets

The secrets are not in the repository.

  • The server generates its secrets in /opt/docs/.env on the first deploy.
  • The workflow uses only the DEPLOY_* Actions secrets.
  • To pull images from GHCR, the server uses the token of the job. It does not keep the token after the deploy.

How to test

  1. Merge this PR into dev.
  2. Make sure that the "Dev instance" workflow is successful.
  3. Open https://167-233-225-101.sslip.io and log in as alice (password: alice).
  4. Make sure that the sample document is in the list of documents.

The version history reads and writes named versions on
/collaboration/version/. The helm ingress routes it, but the nginx
template of the compose example did not, so named versions failed
with 404 on a compose deployment.

Signed-off-by: yousefed <yousefdardiry@gmail.com>
A push to the dev branch builds the frontend, yhub and y-provider
images, pushes them to GHCR and deploys them on the dev server with
docker compose. The server runs Docs with Keycloak, an S3 store and
Caddy for TLS. The secrets are generated on the server, in a .env
file that is not in the repository.

Signed-off-by: yousefed <yousefdardiry@gmail.com>
The seed script signs in as the dev users and writes a recorded
history version by version through the collaboration routes, so the
history panel shows several versions by several authors. It runs
from the dev instance workflow on request.

Signed-off-by: yousefed <yousefdardiry@gmail.com>
Caddy refused an empty email in its global options, and Keycloak could
not write its database to a volume that root owned. Caddy now uses no
global options, and the Keycloak volume holds its whole data folder.

Signed-off-by: yousefed <yousefdardiry@gmail.com>
The dev instance workflow takes a ref input when it is run by hand, so
a branch that is not merged can go on the server for a short time. The
images are tagged with the commit only, so such a deploy does not
change the images of the dev branch.

Signed-off-by: yousefed <yousefdardiry@gmail.com>
The seed no longer writes the history in real time. It builds the
history offline, with each edit attributed to its author at its
recorded time, and stores it in yhub the way the full migration does.
Every deploy runs it, and it does nothing when the document exists.
It takes less than a minute instead of more than an hour.

Signed-off-by: yousefed <yousefdardiry@gmail.com>
The demo users alice, bob, carol and dave have their user name as
password, also on a Keycloak that already exists. The admin accounts
keep random passwords on the server. The README lists the users and
tells how to read the admin passwords.

Signed-off-by: yousefed <yousefdardiry@gmail.com>
@YousefED
YousefED merged commit 4763913 into dev Oct 9, 2026
18 of 19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant