deploy: production moved to OVH BHS128 (native PM2/Postgres/Redis), release procedure and gotchas

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Simon-Pierre Boucher committed 10 days ago (Sep 14, 2026) parent a918a9a

1 changed file +12 −1

modified deploy/README.md +12 −1

		`@@ -1,6 +1,17 @@`
1	1	# Deploying WebSensor on MacLustr
2	2
3		−WebSensor runs as four PM2 processes on one node (M4M64b), published through the MacLustr Tunnel (WireGuard +
	3	+> Since 2026-09-13 production runs on the OVH server BHS128 (`ssh BHS128`, ubuntu@51.161.112.69, Ubuntu 24.04, 12 threads / 128 GB),
	4	+> outside `mld`: code in `~/apps/websensor`, Postgres 17 native (db/role `websensor`/`websensor`, C.UTF-8 like the Mac source — with
	5	+> en_US.UTF-8 the generated `events.search` tsvector rejected a 5 836-byte keyword), Redis native, blobs in `~/websensor-data/blobs`,
	6	+> PM2 under systemd (`pm2-ubuntu`, `LimitNOFILE` 1 048 576 for the 48 fetch workers) with `~/apps/pm2.websensor.config.cjs` generated
	7	+> from the mld manifest by `~/apps/.manifests/gen-pm2.py` (secrets, 0600). Tunnel route: `mlt add www.websensor.io BHS128:8260`
	8	+> (BHS64 Caddy → wg1 10.67.0.60); firewall `ufw allow in on wg1 from 10.67.0.1 to any port 8260 proto tcp`. The move was triggered by the
	9	+> LAN uplink (Bell) collapsing under the ~6 000 outbound connections of the engine + factory (NAT table).
	10	+> Release on BHS128: `rsync -az --exclude node_modules --exclude .git --exclude 'apps/web/.next' --exclude data --exclude 'deploy/*.mld.json' . BHS128:apps/websensor/`
	11	+> then `ssh BHS128 'cd apps/websensor && pnpm install --frozen-lockfile && DATABASE_URL=postgres://websensor:websensor@127.0.0.1:5432/websensor pnpm db:migrate && DATABASE_URL=postgres://websensor:websensor@127.0.0.1:5432/websensor node node_modules/tsx/dist/cli.mjs apps/engine/src/cli.ts sync && API_URL=http://127.0.0.1:8260 NEXT_PUBLIC_SITE_URL=https://www.websensor.io pnpm --filter @websensor/web build && pm2 restart websensor-engine websensor-factory websensor-api websensor-web && pm2 save'`.
	12	+> The M4M64b copy is kept as a cold backup (retired from `mld` with `--keep-dir`); the `mld` procedure below still works to move back.
	13	+
	14	+WebSensor formerly ran as four PM2 processes on one node (M4M64b), published through the MacLustr Tunnel (WireGuard +
4	15	Caddy on the OVH gateway BHS64, `www.websensor.io`; ngrok was retired on 2026-09-10), orchestrated by `mld` from the
5	16	M1M32 gateway.
6	17
7	18