# TraceCD deployment on HK-1

The production stack lives at `/opt/tracecd` on `156.238.122.140` and is sized for a 1-core, 1-GiB host.

## Services

- MySQL 8.0.40: Docker-only `tracecd-net`; no host port is published.
- Gitea 1.22.6: host ports 3000 and 2222 are mapped, but remain blocked by the host firewall unless explicitly opened.
- Gitea Actions runner: capacity 1, label `centos-env`, Docker socket access.
- TraceCD: built by Gitea Actions, bound to `127.0.0.1:8080` and served by host Nginx.
- Nginx: `t.1633292.cn` on port 80. Port 443 remains owned by Xray.

## Bootstrap

Copy `compose.yaml`, `runner-config.yaml`, `nginx-tracecd.conf`, and `bootstrap-env.sh` to `/opt/tracecd`. Then run:

```bash
cd /opt/tracecd
chmod 700 bootstrap-env.sh
./bootstrap-env.sh
install -m 644 nginx-tracecd.conf /etc/nginx/conf.d/tracecd.conf
nginx -t && systemctl reload nginx
docker compose pull
docker compose up -d
```

`bootstrap-env.sh` creates random database and bootstrap passwords in `stack.env` and `app.env`, both mode 0600. Add `DEEPSEEK_API_KEY` and `MIMO_API_KEY` to `app.env` on the server; never commit either file.

## Operations

```bash
cd /opt/tracecd
docker compose ps
docker compose logs --tail 100 mysql gitea runner
docker stats --no-stream
curl -I -H 'Host: t.1633292.cn' http://127.0.0.1/
```

The workflow in `.gitea/workflows/deploy.yaml` builds on pushes to `dev`, joins the application to `tracecd-net`, loads `/opt/tracecd/app.env`, and replaces only `trace-container`.