deploy: production moved to OVH BHS128 (native PM2/Postgres/Redis), release procedure and gotchas
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
1 changed file +12 −1
modified
deploy/README.md
+12 −1
@@ -1,6 +1,17 @@ | |||||
| 1 | # Deploying WebSensor on MacLustr | 1 | # Deploying WebSensor on MacLustr | ||
| 2 | 2 | ||||
| 3 | −WebSensor runs as four PM2 processes on one node (M4M64b), published through the MacLustr Tunnel (WireGuard + | 3 | +> **Since 2026-09-13 production runs on the OVH server BHS128** (`ssh BHS128`, ubuntu@51.161.112.69, Ubuntu 24.04, 12 threads / 128 GB), | ||
| 4 | +> outside `mld`: code in `~/apps/websensor`, Postgres 17 native (db/role `websensor`/`websensor`, **C.UTF-8** like the Mac source — with | ||||
| 5 | +> en_US.UTF-8 the generated `events.search` tsvector rejected a 5 836-byte keyword), Redis native, blobs in `~/websensor-data/blobs`, | ||||
| 6 | +> PM2 under systemd (`pm2-ubuntu`, `LimitNOFILE` 1 048 576 for the 48 fetch workers) with `~/apps/pm2.websensor.config.cjs` generated | ||||
| 7 | +> from the mld manifest by `~/apps/.manifests/gen-pm2.py` (secrets, 0600). Tunnel route: `mlt add www.websensor.io BHS128:8260` | ||||
| 8 | +> (BHS64 Caddy → wg1 10.67.0.60); firewall `ufw allow in on wg1 from 10.67.0.1 to any port 8260 proto tcp`. The move was triggered by the | ||||
| 9 | +> LAN uplink (Bell) collapsing under the ~6 000 outbound connections of the engine + factory (NAT table). | ||||
| 10 | +> **Release on BHS128**: `rsync -az --exclude node_modules --exclude .git --exclude 'apps/web/.next' --exclude data --exclude 'deploy/*.mld.json' . BHS128:apps/websensor/` | ||||
| 11 | +> then `ssh BHS128 'cd apps/websensor && pnpm install --frozen-lockfile && DATABASE_URL=postgres://websensor:websensor@127.0.0.1:5432/websensor pnpm db:migrate && DATABASE_URL=postgres://websensor:websensor@127.0.0.1:5432/websensor node node_modules/tsx/dist/cli.mjs apps/engine/src/cli.ts sync && API_URL=http://127.0.0.1:8260 NEXT_PUBLIC_SITE_URL=https://www.websensor.io pnpm --filter @websensor/web build && pm2 restart websensor-engine websensor-factory websensor-api websensor-web && pm2 save'`. | ||||
| 12 | +> The M4M64b copy is kept as a cold backup (retired from `mld` with `--keep-dir`); the `mld` procedure below still works to move back. | ||||
| 13 | + | ||||
| 14 | +WebSensor formerly ran as four PM2 processes on one node (M4M64b), published through the MacLustr Tunnel (WireGuard + | ||||
| 4 | Caddy on the OVH gateway BHS64, `www.websensor.io`; ngrok was retired on 2026-09-10), orchestrated by `mld` from the | 15 | Caddy on the OVH gateway BHS64, `www.websensor.io`; ngrok was retired on 2026-09-10), orchestrated by `mld` from the | ||
| 5 | M1M32 gateway. | 16 | M1M32 gateway. | ||
| 6 | 17 | ||||
| 7 | 18 | ||||