main
tag: launch-2026-06-01
tag: magicmirror-v0.1.1
tag: magicmirror-v0.3.0
tag: mnw-cli-v0.1.2
tag: mnw-cli-v0.1.3
tag: mnw-cli-v0.1.4
tag: pom-v0.4.1
tag: pom-v0.4.2
tag: pom-v0.4.3
tag: pom-v0.4.4
tag: pom-v0.4.5
tag: wam-v0.3.0
tag: wam-v0.3.1
Files
Commits
Tags
Notes
Issues
Retire the hand-deploy script to a cutover reference
Phase 4 cutover: server/deploy/deploy.sh moves to
server/deploy/archive/deploy.sh.legacy with a header saying what replaced
it and why it is not a fallback. Kept, not deleted, as a record of the old
remote layout and restart sequence.
Repoint the four docs that named the old path.
Co-Authored-By
Claude Opus 5 (1M context) <noreply@anthropic.com>
5 files changed,
+24 insertions,
-6 deletions
67
67
building on the prod box. The operator procedure lives in
68
68
`sando/deploy/README.md`.
69
69
70
-
The old `server/deploy/deploy.sh` is retained only as a cutover reference and
71
-
must not be used.
70
+
The old hand-deploy script is retained only as a cutover reference at
71
+
`server/deploy/archive/deploy.sh.legacy` and must not be used.
72
72
73
73
### Testing
74
74
476
476
`env!("CARGO_PKG_VERSION")` for Sentry release strings. Bump the version in
477
477
`Cargo.toml` before every production deploy.
478
478
479
-
`server/deploy/deploy.sh` is a retained cutover reference, not a supported path.
479
+
`server/deploy/archive/deploy.sh.legacy` is a retained cutover reference, not a
480
+
supported path.
191
191
on the Sando host, then over Tailscale SSH as root on the target, copy the
192
192
current release dir to a new one, stream the new `makenotwork` binary in, stream
193
193
a tar of `static/` + `docs/` (`docs/` = `server/site-docs/{public,examples}` +
194
-
`server/docs/business/assumptions.toml`, mirroring `server/deploy/deploy.sh`),
194
+
`server/docs/business/assumptions.toml`, mirroring
195
+
`server/deploy/archive/deploy.sh.legacy`),
195
196
flip the `current` symlink, and `systemctl restart makenotwork.service` (which
196
197
boot-migrates). Old release dirs are kept for rollback.
197
198
15
15
locked to git-shell only. See `setup-git-ssh.sh` and `sshd-git.conf`.
16
16
No interactive shell, no port forwarding, no admin access.
17
17
- **Tailnet :2200** is the admin path. Full interactive shell, used for
18
-
every `deploy.sh` invocation and any manual maintenance. Reachable only
18
+
every Sando deploy and any manual maintenance. Reachable only
19
19
from devices on the tailnet (firewall rule `ufw allow in on tailscale0`
20
20
in `setup-firewall.sh`).
21
21
75
75
- Firewall: `deploy/setup-firewall.sh`
76
76
- Public sshd (git-only): `deploy/sshd-git.conf`, `deploy/setup-git-ssh.sh`
77
77
- Admin sshd (tailnet): `/etc/ssh/sshd_config` on the server
78
-
- Deploy entry point: `deploy/deploy.sh` (uses `-p 2200`)
78
+
- Deploy entry point: Sando (`sandod` on fw13, uses `-p 2200`). The retired
79
+
hand-deploy script is `deploy/archive/deploy.sh.legacy`.
79
80
- CI runner setup: `deploy/setup-ci.sh` (uses `-p 2200`)
1
1
#!/bin/bash
2
+
# RETIRED 2026-07-31. Do not run this.
3
+
#
4
+
# This was the hand-deploy script for the MNW server before the Sando cutover.
5
+
# Deploys now go through Sando, the pipeline controller: it builds natively,
6
+
# runs the gate tiers, and swaps the release on the prod host. The operator
7
+
# procedure is in sando/deploy/README.md.
8
+
#
9
+
# Kept as a reference for what the old path did — the remote layout, the
10
+
# service restarts, the config files it pushed — not as a fallback. It
11
+
# cross-compiles (which is no longer allowed), it knows nothing about the gate
12
+
# tiers, and its assumptions about the prod host drift further every month. If
13
+
# Sando is broken, fix Sando.
14
+
#
15
+
# Original header follows.
16
+
#
2
17
# Makenotwork Deployment Script
3
18
# Cross-compiles for x86_64 Linux on macOS, uploads everything, restarts services.
4
19
# Run from the MNW/server directory.