Skip to content

server-setup.md

Latest commit

 

History

History
13 lines (10 loc) · 1.03 KB

server-setup.md

File metadata and controls

13 lines (10 loc) · 1.03 KB
Raw

One-time server setup

The commands below use the fictional application name example-app. Replace it before running anything.

  1. Create a dedicated, non-login application user and /srv/example-app/releases.
  2. Put runtime secrets in /etc/example-app/environment, owned by root with mode 600.
  3. Install and enable the supplied systemd unit after reviewing its paths and sandbox settings.
  4. Give the deployment user narrowly scoped permission to restart only this service.
  5. Add the deployment public key to that user's authorized_keys.
  6. Record the server host key locally with ssh-keyscan, verify its fingerprint through a trusted channel, and save the verified line as DEPLOY_KNOWN_HOSTS.
  7. Set repository environment secrets described in the README.

The remote script defaults to /srv/example-app, example-app, and a localhost readiness endpoint. Override APP_ROOT, SERVICE_NAME, and HEALTH_URL in a server-side wrapper if your application differs. Do not store runtime secrets in GitHub artifacts or the release directory.