From 53f6c41100e72d4365fe749159b291f74342f66d Mon Sep 17 00:00:00 2001 From: mrwulf Date: Mon, 6 Jul 2026 17:22:43 +0200 Subject: [PATCH] DEPLOY.md: as-built record - the LTL is LIVE at zkdefi.org/lean-transparency-log Deployed from the provider notebook over the dedicated deploy key. The host runs a compose stack, so the LTL joined it as a read-only container (read_only: true, :ro volumes, no published ports, compose-network-only) rather than the host-systemd variant; the domain's Caddy site block gained a path handle that precedes the existing catch-all, validated in a throwaway container before reload, with timestamped backups of both config files. The servable log dir is reconstructed FROM the published GitHub mirror (the server holds witness-grade data only - no keys). Live smoke over the public internet from the provider machine: /docs (the SVG site), /v1/sth, /healthz (tree size 8) all 200; the existing service on the domain unaffected; and the complete agent flow ran against the production URL - log-fetch, receipt-verify through the dogfood verifier with a fresh pin store and freshness policy, and sth-refresh confirming pin consistency online. DEPLOY.md now leads with the as-built compose record + update runbook (reconstruct.py helper installed server-side); the original systemd variant is kept for docker-less deployments. 54/54 tests. Co-Authored-By: Claude Fable 5 --- DEPLOY.md | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 51 insertions(+), 4 deletions(-) diff --git a/DEPLOY.md b/DEPLOY.md index b2b27ae..10e5160 100644 --- a/DEPLOY.md +++ b/DEPLOY.md @@ -1,9 +1,56 @@ # Deploying the online log at zkdefi.org/lean-transparency-log -Checklist for the server session. Deliberately generic about the host: -this file is public, so it names only what customers must know anyway -(the service URL) and standard software layouts - no provider inventory, -no credentials, nothing an attacker couldn't already get from public DNS. +STATUS: DEPLOYED (2026-07-06) and serving. This file is now the as-built +record plus the update runbook. Deliberately generic about the host: it +names only what customers must know anyway (the service URL) and standard +software layouts - no provider inventory, no credentials. + +## As built (docker compose variant) + +The target host runs a compose stack; the LTL joined it as a read-only +container instead of the host-systemd variant below: + +- app + published-log clones + reconstructed log dir under the compose + project directory (`ltl/app`, `ltl/published`, `ltl/log`); +- compose service: `python:3.12-alpine`, `read_only: true`, both volumes + mounted `:ro`, NO published ports (reachable only on the compose + network), `restart: unless-stopped`; +- Caddy site block for the domain gained a path `handle` that takes + precedence over the existing catch-all: + +```caddy +redir /lean-transparency-log /lean-transparency-log/docs +handle /lean-transparency-log/* { + reverse_proxy ltl:8461 +} +handle { + reverse_proxy +} +``` + +- config validated in a throwaway caddy container before `caddy reload`; + Caddyfile and compose file backed up with timestamps first. + +Update runbook (after each new proof-check run on the provider machine): + +```bash +# on the provider machine +pacta_provider log-append ... # sign new head (offline, dogfood) +pacta_provider log-publish --log-dir ... --git-dir --public-key +cd && git add -A && git commit -m "log update" && git push +tar czf /tmp/pacta-app.tgz --exclude=.git --exclude='provider/state' --exclude='provider/out' --exclude='dogfood/state' --exclude='dogfood/*/target' --exclude='.venv' --exclude='__pycache__' --exclude='artifacts*' --exclude='repos' . # only when app code changed +scp /tmp/pacta-app.tgz zkdefi-ltl:/ltl/ +ssh zkdefi-ltl 'cd /ltl && (cd published && git pull) && \ + python3 reconstruct.py && cd .. && sudo docker compose restart ltl' +``` + +(`reconstruct.py` = the entries.jsonl/sth-history rebuild from step 1 +below; it lives in the server's ltl dir.) + +--- + +The remainder of this file is the original host-systemd variant, kept for +deployments without docker. ## What gets deployed