Deployment

The page and the relay are deployed separately, on two machines and two addresses.

The page and the documentation

Published from a computer with yarn deploy (scripts/deploy.sh), as the project is still small. It refuses uncommitted changes, then:

1. dependency audit and tests;
2. building the page and this site, which has its own, docs.corico.infobrisson.fr;
3. Brotli precompression;
4. upload with rsync in place of the previous files (--delay-updates and --delete-after).

There are no dated releases and no switch by symlink. public/.htaccess sets the page's security headers, and docs/docs.htaccess those of the documentation.

Why the documentation has its own site: the page keeps the app password and the encryption key in the browser, readable by anything running at the same address. The documentation needs scripts allowed inline (VitePress), a weaker protection than the page's: on another origin, it can reach nothing of this. Old addresses under /docs/ are redirected.

The forge's CI only checks the style and runs the tests on each push to main. Its publishing job stays commented in .gitlab-ci.yml, for later.

The relay

The relay's role in the server configuration, a private Ansible repository, runs yarn release, which runs the checks and produces release/corico.mjs, a single file. It copies it to /opt/corico and restarts the service if the file has changed. There are no versions kept and no symlink.

The systemd sandbox allows only the local machine, including the DNS resolver, and the Nextcloud address (IPAddressAllow). If this address changes, the relay answers 502: change the allowed address in the server configuration and deploy again.