Make /opt/stack a Forgejo git checkout instead of rsync-only

Prefer stack_deploy_method=git: init/fetch on the server, register an
SSH deploy key with Forgejo, and leave local secrets untracked. Document
git pull for day-to-day updates; keep rsync as an opt-in fallback.
This commit is contained in:
tim 2026-07-22 11:12:07 -07:00
parent 6c9e085cbd
commit 90f3cf62c5
4 changed files with 159 additions and 10 deletions

View file

@ -18,6 +18,19 @@ ansible-playbook site.yml -K # -K only if sudo still asks once; playboo
What it does: OS updates, tools (incl. Microsoft `edit`), Docker, AMD/Vulkan, UFW (LAN only), `/opt/stack` + `/storage`, `.env`, `arr-stack.service`, and **tim** as local admin (passwordless sudo, docker/video/render/…, owns stack + storage, permissive GPU nodes).
**Code on the server:** `/opt/stack` is a **git clone** of Forgejo `tim/stack` (`stack_deploy_method: git`).
Day-to-day updates on ser5:
```bash
ssh tim@192.168.8.123
cd /opt/stack
git pull
docker compose up -d # if compose/images changed
```
Ansible can also refresh code: `ansible-playbook site.yml -K --tags stack,deploy` (runs `git fetch` + checkout).
Local-only (not in git): `.env`, `config/`, `models/**/*.gguf`, `wireguard/wg0.conf`.
**Before first full stack start** (on ser5):
```bash