trace/deploy

TraceCD deployment on HK-1

The production stack lives at /opt/tracecd on 156.238.122.140 and is sized for a 1-core, 1-GiB host.

Services

• MySQL 8.0.40: Docker-only tracecd-net; no host port is published.
• Gitea 1.22.6: HTTPS at git.1633292.cn; host ports 3000 and 2222 remain bound to loopback.
• Gitea Actions runner: capacity 1, label centos-env, Docker socket access.
• TraceCD: built by Gitea Actions, bound to 127.0.0.1:8080 and served by host Nginx.
• Nginx: HTTPS for t.1633292.cn and git.1633292.cn. Its stream module owns public port 443 and routes these two SNI names to local TLS virtual hosts; all other SNI traffic passes unchanged to Xray on 127.0.0.1:7443.

Bootstrap

Copy compose.yaml, runner-config.yaml, nginx-tracecd.conf, nginx-sni.conf, and bootstrap-env.sh to /opt/tracecd. Install nginx-mod-stream and certbot, issue certificates for both hostnames, move Xray's listener to 127.0.0.1:7443, and add this top-level block to /etc/nginx/nginx.conf:

stream {
    include /etc/nginx/stream.d/*.conf;
}

Then run:

cd /opt/tracecd
chmod 700 bootstrap-env.sh
./bootstrap-env.sh
install -m 644 nginx-tracecd.conf /etc/nginx/conf.d/tracecd.conf
install -D -m 644 nginx-sni.conf /etc/nginx/stream.d/sni.conf
nginx -t && systemctl reload nginx
docker compose pull
docker compose up -d

bootstrap-env.sh creates random database and bootstrap passwords in stack.env and app.env, both mode 0600. Add DEEPSEEK_API_KEY and MIMO_API_KEY to app.env on the server; never commit either file.

Operations

cd /opt/tracecd
docker compose ps
docker compose logs --tail 100 mysql gitea runner
docker stats --no-stream
curl -I https://t.1633292.cn/login
curl -I https://git.1633292.cn/user/login

Certbot's packaged systemd timer renews the certificates. A successful renewal must be followed by systemctl reload nginx; /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh provides that hook on the server.

The workflow in .gitea/workflows/deploy.yaml builds on pushes to dev, joins the application to tracecd-net, loads /opt/tracecd/app.env, and replaces only trace-container.