From 4056470a4669713b6fb4eca92d72e11645fb303c Mon Sep 17 00:00:00 2001 From: aygea Date: Tue, 28 Jul 2026 14:29:17 -0700 Subject: [PATCH] Docs: record docker-compose + webhook deploy architecture in CLAUDE.md Includes the self-revert trap warning (git reset --hard in redeploy wipes uncommitted deploy files). Co-Authored-By: Claude --- CLAUDE.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/CLAUDE.md b/CLAUDE.md index 0976eae..1206c89 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -26,7 +26,19 @@ README.md **Git policy:** source only is committed (`prompts/`, `outputs/`, `data/benchmark_history.json`, `generate_dashboard.py`, `Dockerfile`, docs). The generated `dashboard.html` + `pages/` are gitignored — Coolify rebuilds them on each push via the Dockerfile's `python3 generate_dashboard.py` step. If you ever want to commit the built HTML instead, uncomment those lines in `.gitignore`. -**Remote:** `ssh://git@git.itsaygea.com:2222/admin/modelTesting.git` (SSH key auth as `admin` verified). Push to `main` → Coolify rebuilds. +**Remote:** `ssh://git@git.itsaygea.com:2222/admin/modelTesting.git` (SSH key auth as `admin` verified). Push to `main` → auto-deploys (see Deploy section below). + +## Deploy: docker compose + Gitea-push webhook (on mewtwo) + +Coolify was abandoned — replaced by a self-contained Docker setup on the Proxmox host `mewtwo` (LAN `10.0.0.22`). + +- **Dashboard:** `docker compose up` builds the `Dockerfile` (Python stage runs `generate_dashboard.py`, nginx stage serves `dashboard.html`+`pages/` and proxies `/hook`). Container `llm-benchmark`, bound `0.0.0.0:31415:80`, `restart: unless-stopped`. Netbird exposes it as `https://llmtesting.itsaygea.com`. +- **Auto-deploy webhook:** systemd service `llm-bench-webhook` runs `webhook.py`, listening `0.0.0.0:41798`. The dashboard nginx proxies `/hook` → `host:41798` (via `extra_hosts: host-gateway`). Gitea posts push events to `https://llmtesting.itsaygea.com/hook`; on a valid push to `main` it runs `git fetch && git reset --hard origin/main && ./deploy.sh up`. +- **Auth chain (in order):** Authorization Bearer token (`WEBHOOK_AUTH_TOKEN` / `.webhook.auth`) → 401 if missing/wrong; then HMAC `X-Gitea-Signature` (`WEBHOOK_SECRET` / `.webhook.secret`) → 403; then ref==`refs/heads/main`. +- **Secrets:** `.webhook.secret` and `.webhook.auth` are gitignored — generated by `./deploy-webhook.sh install`. +- **Commands:** `./deploy.sh [up|logs|down|status]` (dashboard), `./deploy-webhook.sh [install|status|secret|auth|uninstall]` (webhook). + +**⚠ Self-revert trap (learned the hard way):** the webhook's redeploy does `git reset --hard origin/main`. If you edit `webhook.py`/`Dockerfile`/`docker-compose.yml`/`deploy-webhook.sh` locally but DON'T commit+push first, any push (incl. your own test POSTs to `/hook`) resets those files back to the committed `origin/main` version, wiping your edits. Rule: **edit → commit → push → then restart/rebuild.** Never leave deploy-critical files uncommitted while the webhook is live. ``` prompts/