Say which deployment path the docs describe (#104, partial)

claude-bot commented

2026-09-05 01:58:28 +00:00

Contributor

Addresses the three in-repo items from #104. Does not close it — see below.

What this does

docs/setup.md §7 and docker-compose.registry.yml now say plainly that they're the dev-host and self-hoster path, not the production runbook. Reading §7 as "how Iris is deployed" was an easy inference and a wrong one: this repo builds and publishes an image, the Ansible/IaC repo deploys it, and the registry is the boundary between them.

The open question, answered by asking rather than assuming

Confirm whether pulling git.rhoving.com/rbrooks/iris-wled requires authentication. The dev host pulls fine, but it may simply already be logged in — if auth is required, prod needs a read-only pull token.

It does not require authentication. Checked against the live registry:

GET /v2/                                                    -> 401
     Www-Authenticate: Bearer realm=".../v2/token", service="container_registry"
GET /v2/token?service=container_registry
      &scope=repository:rbrooks/iris-wled:pull              -> 200, token issued anonymously
GET /v2/rbrooks/iris-wled/manifests/main  (with that token) -> 200

The initial 401 is the standard registry challenge, not a refusal — an anonymous client is issued a token that grants pull, because the repo is public. So production needs no pull secret and no read-only token, and docker login is optional rather than the required one-time step §7 presented it as.

That holds only while the repository stays public, which is now written down beside the finding along with the transcript, so the next person can re-check rather than re-derive.

Why this doesn't close #104

The issue's substance is an IaC role that deploys a pinned tag with its own secrets and a health-checked rollout. That belongs in the Ansible repo, which I'm not working in, and the issue itself says it's blocked:

#4 must actually work first. IaC would consume :X.Y.Z, and only release.yml produces those tags — the workflow that has never run once. Proving the release pipeline is a prerequisite, not a parallel task.

So the remaining acceptance criteria — a tag producing :X.Y.Z plus a Forgejo release, an IaC role deploying to a prod host, data/ persisting across a redeploy, the deploy waiting on /api/v1/health, rollback as one variable — are all downstream of #4 and outside this repo. #104 stays open with its first three checkboxes done.

🤖 Generated with Claude Code

Addresses the three in-repo items from #104. **Does not close it** — see below. ## What this does `docs/setup.md` §7 and `docker-compose.registry.yml` now say plainly that they're the **dev-host and self-hoster path**, not the production runbook. Reading §7 as "how Iris is deployed" was an easy inference and a wrong one: this repo builds and publishes an image, the Ansible/IaC repo deploys it, and the registry is the boundary between them. ## The open question, answered by asking rather than assuming > Confirm whether pulling `git.rhoving.com/rbrooks/iris-wled` requires authentication. The dev host pulls fine, but it may simply already be logged in — if auth is required, prod needs a **read-only** pull token. **It does not require authentication.** Checked against the live registry: ``` GET /v2/ -> 401 Www-Authenticate: Bearer realm=".../v2/token", service="container_registry" GET /v2/token?service=container_registry &scope=repository:rbrooks/iris-wled:pull -> 200, token issued anonymously GET /v2/rbrooks/iris-wled/manifests/main (with that token) -> 200 ``` The initial 401 is the standard registry challenge, not a refusal — an anonymous client is issued a token that grants `pull`, because the repo is public. So **production needs no pull secret and no read-only token**, and `docker login` is optional rather than the required one-time step §7 presented it as. That holds only while the repository stays public, which is now written down beside the finding along with the transcript, so the next person can re-check rather than re-derive. ## Why this doesn't close #104 The issue's substance is an **IaC role that deploys a pinned tag with its own secrets and a health-checked rollout**. That belongs in the Ansible repo, which I'm not working in, and the issue itself says it's blocked: > **#4 must actually work first.** IaC would consume `:X.Y.Z`, and only `release.yml` produces those tags — the workflow that has never run once. Proving the release pipeline is a prerequisite, not a parallel task. So the remaining acceptance criteria — a tag producing `:X.Y.Z` plus a Forgejo release, an IaC role deploying to a prod host, `data/` persisting across a redeploy, the deploy waiting on `/api/v1/health`, rollback as one variable — are all downstream of #4 and outside this repo. #104 stays open with its first three checkboxes done. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit

2026-09-05 01:58:28 +00:00

Say which deployment path the docs describe (#104 , partial)

CI / Dockerfile lint (pull_request) Successful in 7s

Details

CI / Alembic migration check (pull_request) Successful in 40s

Details

CI / Docker build, health smoke & E2E (pull_request) Has been cancelled

Details

CI / Pre-commit hooks (pull_request) Has been cancelled

Details

CI / Python tests (pull_request) Has been cancelled

Details

CI / Python lint & type-check (pull_request) Has been cancelled

Details

CI / Frontend lint, test & build (pull_request) Has been cancelled

Details

0bdbfe55d8

The three in-repo items from #104. The issue's substance -- an IaC role
that deploys a pinned tag with its own secrets and a health-checked
rollout -- belongs in the Ansible repo and is blocked on #4 regardless,
since it consumes :X.Y.Z tags that release.yml has never once produced.

docs/setup.md §7 and docker-compose.registry.yml now say plainly that
they are the dev-host and self-hoster path. Reading §7 as "how Iris is
deployed" was an easy inference and a wrong one: this repo builds and
publishes an image, the IaC repo deploys it, and the registry is the
boundary between them.

The open question -- whether pulling needs authentication -- is answered
by asking the registry rather than assuming. It does not: an anonymous
client is issued a token granting pull on this repository, and the
manifest fetch returns 200. So production needs no pull secret and no
read-only token, and docker login is optional rather than the required
one-time step §7 presented it as. That holds only while the repo is
public, which is now written down beside the finding along with the
transcript of the check.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

claude-bot referenced this pull request

2026-09-05 01:58:41 +00:00

Production deployment via the Ansible/IaC repo; Iris builds and publishes only #104

rbrooks force-pushed docs/104-deploy-boundary from 0bdbfe55d8

CI / Dockerfile lint (pull_request) Successful in 7s

Details

CI / Alembic migration check (pull_request) Successful in 40s

Details

CI / Docker build, health smoke & E2E (pull_request) Has been cancelled

Details

CI / Pre-commit hooks (pull_request) Has been cancelled

Details