feat: branch-based deployment (main → staging, production → prod)

- main branch: auto-deploy to Dokku staging
- production branch: build Docker image and deploy to K8s production
- Add DEPLOYMENT.md with workflow documentation
- Create production branch for manual production deployments

Breaking change: pushing to main no longer deploys to production

2026-03-06 12:22:05 -06:00

3.2 KiB

Raw Blame History

Deployment Guide

Overview

Towerops uses a branch-based deployment strategy:

main branch → Dokku staging environment (automatic)
production branch → Kubernetes production cluster (automatic)

Staging Deployment (Dokku)

Automatic

Push or merge to main branch automatically deploys to Dokku staging:

git push origin main

The Forgejo Actions workflow pushes to the Dokku remote: dokku@204.110.191.231:towerops

Manual

You can also deploy manually:

git push dokku main

Production Deployment (Kubernetes)

Process

To deploy to production:

Merge main into production branch:

git checkout production
git merge main
git push origin production

Forgejo Actions will automatically:
- Build Docker image with tag production-<timestamp>-<commit>
- Push image to container registry (git.mcintire.me)
- Update k8s/deployment.yaml with new image tag
- Commit and push the update back to production branch
- Kubernetes (via FluxCD) picks up the change and deploys
Monitor the deployment:
```
kubectl get pods -n towerops -w
```

Rollback

To rollback to a previous version:

# Find the commit with the working version
git log k8s/deployment.yaml

# Reset to that commit
git checkout production
git reset --hard <commit-sha>
git push origin production --force

Or manually update the image tag in k8s/deployment.yaml and push.

Required Secrets

Forgejo Actions Secrets

Configure these in your Forgejo repository settings:

DOKKU_SSH_KEY - SSH private key for Dokku deployments
REGISTRY_URL - Container registry URL (e.g., git.mcintire.me)
REGISTRY_USER - Registry username
REGISTRY_PASSWORD - Registry password/token

Kubernetes Secrets

These must exist in the towerops namespace:

forgejo-registry - Docker registry credentials
towerops-secrets - Application secrets (RELEASE_COOKIE, SECRET_KEY_BASE, CLOAK_KEY)
towerops-db - Database connection
towerops-aws - AWS credentials
towerops-billing - Stripe API keys (optional)
towerops-redis - Redis/Valkey connection

Branch Protection

Recommended branch protection rules:

`main` branch

Require pull request reviews
Require status checks to pass
Auto-deploys to staging on merge

`production` branch

Require pull request reviews
Require status checks to pass
Only merge from main
Auto-deploys to production on merge

Troubleshooting

Staging deployment fails

Check Forgejo Actions logs and Dokku logs:

ssh dokku@204.110.191.231 logs towerops

Production deployment fails

Check Forgejo Actions logs for build errors
Check if image was pushed to registry

Check Kubernetes pod status:

kubectl get pods -n towerops
kubectl logs -n towerops deployment/towerops

Image not updating in Kubernetes

Verify k8s/deployment.yaml has the new image tag

Check FluxCD reconciliation:

kubectl get gitrepositories -n flux-system
kubectl get kustomizations -n flux-system

Manual rollout restart if needed:

kubectl rollout restart deployment/towerops -n towerops

3.2 KiB Raw Blame History