# Deployment

# Topology

Where	What
BHS128b (`ssh BHS128b`, ubuntu@51.161.112.85, OVH Beauharnois ADVANCE-2, 8 c/16 t, 128 GB) — since 2026-09-14	Docker Compose `infra/compose.yml` (project `ip`) in `/opt/internetpressure`: edge Caddy :8350 (bound to wg1 10.67.0.62), web, api, engine, bgp, corroboration, Postgres 17, ClickHouse 25.8, Redis 7. Volumes `ip_*` copied from BHS64b (tar over ssh, ~1 min downtime). Shares the server with cancerindex, company-atlas, rareindex, satelliteindex (native PM2).
BHS64b (former host, until 2026-09-14)	Stack stopped (`docker compose down`, volumes `ip_*` kept as a cold copy); still runs the DataCenterIndex crawl worker.
BHS64 gateway	`tunnelctl add www.internetpressure.io BHS128b:8350` (+ apex redirect — apex `internetpressure.io` has no A record at GoDaddy yet). DNS `A www → 51.161.112.61` (GoDaddy).
Probes	`ca-qc-01` M4M36 · `ca-mtl-01` BHS128 · `us-atl-01` m2m16b · `fr-gra-01` R9128 · `ie-dub-01` m1m16 · `tr-ist-01` m4mh · `tr-usk-01` m4mi · `cy-ayn-01` m4mg — LaunchDaemon `io.internetpressure.probe` (macOS) / `ip-probe.service` (Linux)

Secrets: deploy/.env on the server only (copy in ~/.internetpressure/env.bhs128b on the laptop; env.bhs64b = the former host, same secrets, WG_IP=10.67.0.61). Probe keys live in production Postgres; sudo passwords of rented Macs in ~/.internetpressure/sudo.txt.

# Commands

bash

deploy/bin/prep-server.sh            # once: wg1 peer to BHS64, ufw, /opt/internetpressure, deploy/.env with random secrets
deploy/bin/deploy.sh                 # rsync → build images on BHS64b → compose up → migrate + seed → health
deploy/bin/deploy.sh route           # (re)create the public route on the gateway
deploy/bin/deploy.sh status|logs [svc]|restart [svc]|migrate|up|build
deploy/bin/probes.sh build           # cross-compile the Go agent
deploy/bin/probes.sh keys            # probe ids + HMAC keys (from production)
deploy/bin/probes.sh install [id…]   # push + install/upgrade the agent on the nodes
deploy/bin/probes.sh status          # /healthz of every probe

Admin token: grep IP_ADMIN_TOKEN ~/.internetpressure/env.bhs64b → paste in https://www.internetpressure.io/admin.

# Operations

Logs: deploy/bin/deploy.sh logs engine (or api, bgp, web, edge).
ClickHouse shell: ssh BHS64b 'cd /opt/internetpressure && docker compose -f infra/compose.yml --env-file deploy/.env exec clickhouse clickhouse-client -u ip --password "$(grep CLICKHOUSE_PASSWORD deploy/.env | cut -d= -f2)" -d ip'.
Postgres: … exec postgres psql -U ip ip.
Config changes (weights…) are done in /admin → Scoring; the file packages/config/pressure.yaml is the default.
Adding a probe: POST /api/admin/probes (or add to data/seed/probes.yaml + deploy.sh migrate), then probes.sh install <id>. Add the node to ~/.internetpressure/sudo.txt if its sudo needs a password.
Adding targets: /admin → Targets or data/targets/targets.yaml + deploy.sh migrate (seed is idempotent; it does not delete).
The instrument's own health: GET /api/v1/status (internal_status ok/degraded/stale) and /admin → Overview.

# Backups

ClickHouse and Postgres volumes live on BHS64b's RAID-1 NVMe. deploy/bin/backup.sh (to add) should pg_dump and BACKUP TABLE … TO Disk to BHS128 nightly; pressure_history and bgp_stats_10s are the irreplaceable tables.