Deployment¶
Environments¶
| dev | prd | |
|---|---|---|
| Control plane | https://dev.api.jumorouter.com (jumo-control-plane-dev) |
https://api.jumorouter.com (jumo-control-plane-prd) |
| Admin | https://dev.admin.jumorouter.com (jumo-web-dev) |
https://admin.jumorouter.com (jumo-web-prd) |
| D1 | jumo-dev (bb9fd7b7-…) |
jumo-prd (8c925dbc-…) |
| Deployed by | every vX.Y.Z tag |
same tag, manual job |
Docs: https://docs.jumorouter.com, deployed from main of docs.
Cloudflare account and zone jumorouter.com are shared with lengua's account.
Custom domains create their DNS records and certificates; no Terraform yet.
GitLab¶
Group jumo-router (private): platform/{proto,control-plane,web},
edge/{agent,firmware}, infra/ci-templates, docs.
| Variable (group) | Protected | Use |
|---|---|---|
CLOUDFLARE_API_TOKEN |
yes | Workers Scripts, D1, Workers Routes: Edit; DNS: Edit; Zone, Account Settings: Read |
CLOUDFLARE_ACCOUNT_ID |
no | |
ADMIN_API_KEY_DEV, BETTER_AUTH_SECRET_DEV |
no | dev Worker secrets |
ADMIN_API_KEY_PRD, BETTER_AUTH_SECRET_PRD |
yes | prd Worker secrets |
Group variables cannot be environment-scoped on the free tier: deploy jobs
read NAME_<ENV> (secret_for in templates/cloudflare.yml). Tags v* are
protected on control-plane, web and agent, so tag pipelines can read the
protected variables. Local copies of the secrets: control-plane/.secrets.dev
and .secrets.prd (git-ignored, mode 600).
Pipelines¶
| Repo | Every push | Tag vX.Y.Z |
|---|---|---|
| proto | buf lint, buf breaking vs previous commit |
|
| control-plane | typecheck, lint, format, tests | push secrets, migrate D1, deploy dev; prd manual |
| web | svelte-check, lint, format, build | build, deploy dev; prd manual |
| agent | golangci-lint, go test -race |
binaries for every router CPU (artifacts) |
| docs | mkdocs build --strict |
deployed on every push to main |
Releasing¶
- Merge to
main(checks green). git tag -a vX.Y.Z -m "..." && git push origin vX.Y.Zon control-plane, then web (the admin binds to the control plane of the same environment).- Check dev, then press deploy:prd in each tag pipeline.
Rollback: redeploy the previous tag's deploy:* job, or
wrangler rollback --env <env>. D1 migrations only add; never edit an applied one.
First staff account¶
POST /internal/staff with the admin key (see the admin guide). Dev account:
nathan@fourrier.dev, password in .secrets.dev.