/home/mrjunejune/zenbu: hg-web/README.md comparison

comparison hg-web/README.md @ 249:c5129452493e

[deploy] Bundle Mercurial with hg-web Co-authored-by: Copilot <[email protected]>

author	MrJuneJune <me@mrjunejune.com>
date	Tue, 04 Aug 2026 04:16:45 -0700
parents	8bb0ac8f4587
children

comparison

equal deleted inserted replaced

-:b8b6e726964a
+:c5129452493e
 ```bash
 bazel run //hg-web:dev
 ```
 This starts `hg serve` on `127.0.0.1:4444` and `hg_web_server` on port `6970`.
-Stopping the Bazel target stops both child processes.
+The `hg serve` process comes from `//third_party/mercurial:runtime` and points at
+the current workspace. Stopping the Bazel target stops both child processes.
-The bundle contains `hg_web_server` and `hg-web/src/`, including generated
-`page.js`, markdown WASM, highlight.js, styles, and image assets.
+The bundle contains `hg_web_server`, `hg-web/run_hg_web`, a pinned pure-Python
+Mercurial runtime, and `hg-web/src/`, including generated `page.js`, markdown
+WASM, highlight.js, styles, and image assets.
 ## Deployment contract
 The expected production layout is:
 ```text
 nginx
 -> hg_web_server.service
--> /opt/hg_web_server_bundle_active/hg_web_server
+-> /opt/hg_web_server/active/hg-web/run_hg_web
--> working directory: /opt/hg_web_server_bundle_active
+-> bundled Mercurial 7.2.3 serves
--> hg serve service on 127.0.0.1:4444
+/opt/hg_web_server/repository on 127.0.0.1:4444
-```
+-> hg_web_server serves the forge on 127.0.0.1:6970
+```
-`deploy.sh` builds an optimized bundle into a revisioned release directory,
-atomically repoints `/opt/hg_web_server_bundle_active`, restarts
+`deploy.sh` follows the same new/active bundle swap as the personal site. It
-`hg_web_server.service`, and checks `http://127.0.0.1:6970/`. A failed restart
+builds the optimized bundle and maintains a canonical repository outside the
-or health check restores the previous release and restarts it. The service,
+release directories. The first deploy creates it with a locking-aware local
-release root, active path, health URL, user, and group can be overridden with
+clone. Later deploys create a Mercurial bundle from the workspace and pull that
-environment variables.
+bundle into the persistent repository, preserving any commits pushed directly
+to production. The script verifies the repository, installs the systemd unit,
+swaps the active directory, restarts the combined service, and checks
+`http://127.0.0.1:6970/`. A failed restart restores the previous active
+directory.
+There is no separate production `hg serve` service and no dependency on the
+host's `hg` command. The pinned Mercurial wheel requires CPython 3.11. The
+systemd unit uses `KillMode=control-group`, so both the Mercurial and C child
+processes stop together.
+On its first run, deploy also installs `/etc/nginx/sites-available/hg-web` when
+Nginx uses Debian-style `sites-available`/`sites-enabled` directories. Existing
+site files are left untouched.
+```bash
+NGINX_SERVER_NAME=zenbu.babocoder.com bazel run //hg-web:deploy
+```
+The checked-in template listens on origin HTTP port 80, which works when TLS is
+terminated upstream. For direct origin TLS, provide a complete certificate-aware
+template:
+```bash
+NGINX_SITE_TEMPLATE=/etc/nginx/templates/hg-web-tls.conf \
+bazel run //hg-web:deploy
+```
+Set `MANAGE_NGINX=false` to leave Nginx untouched. `NGINX_SITE_NAME`,
+`NGINX_SITE_AVAILABLE`, and `NGINX_SITE_ENABLED` can override the destination
+names and paths. `DEPLOY_ROOT` controls the validated deployment root;
+`REPOSITORY_PATH` can override the persistent canonical repository within it.
+Pushes are disabled by default. `HG_ALLOW_PUSH=true` enables unauthenticated
+pushes in the internal `hg serve`; only use it when `/repo` is protected by
+Nginx authentication or another trusted access layer.
 ## Publishing
 Push committed Mercurial changes to the configured server: