Skip to main content
This section is the runbook for shipping and operating Tuturuuu. It documents the deployment surfaces that exist in this repository today, the workflows that own them, and the commands the team should use when something needs to be built, released, or recovered.

​
Deployment Surfaces

​
Read This In Order

  1. Environments & Release Flow
  2. Web Docker Deployment
  3. TanStack/Rust Local And Deployment
  4. GitHub Actions Runbook
  5. Secrets & Configuration

​
Core Principles

  • GitHub Actions is the canonical automation layer for hosted deployments, platform build validation, and database migrations.
  • tuturuuu.ts can disable individual workflows; ci-check.yml enforces that toggle before a job does real work.
  • bun check includes path-sensitive Discord Python validation when the local diff touches apps/discord/** or .github/workflows/discord-python-ci.yml. That path runs the same blocking checks as Discord Python CI through scripts/check-discord-python.js.
  • Vercel handles hosted satellite web deployments, opt-in TanStack frontend build validation, platform preview build validation, and the hosted platform production deploy. Supabase migrations run as separate workflows; main drives staging schema promotion and production drives production schema promotion.
  • Self-hosted web deployment is Docker-based, and blue/green rollout is the supported rebuild-before-restart path.
  • The TanStack/Rust migration runs in parallel with apps/web: apps/tanstack-web (TanStack Start) and apps/backend (Rust, port 7820) ship as Docker sidecars and Cloudflare Workers, and the TanStack frontend has Vercel build validation when it points at an HTTPS backend origin. See TanStack/Rust Local And Deployment, Web Docker Deployment, and the TanStack/Rust migration plan.
  • Secrets live in GitHub Actions secrets/variables or local env files such as apps/web/.env.local. They do not belong in the repo.

​
Operational Flow

​
What Changed Recently

  • The TanStack/Rust migration runtimes are now first-class deployment surfaces: apps/backend (Rust) builds a native binary, a Docker image, and a Cloudflare Worker bundle via .github/workflows/rust-backend.yml; apps/tanstack-web validates type-checks/tests, deploys as a Cloudflare Worker (tuturuuu-tanstack-web) bound to the backend Worker (tuturuuu-backend), and has Vercel preview/production build workflows for frontend compatibility against a separate HTTPS backend origin. Cloudflare uploads are manual-dispatch only and preflight CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID, and Worker runtime secret names before deploying.
  • apps/web now supports both in-place Docker production deploys and blue/green deploys.
  • docker-setup-check.yaml validates Docker parity, renders both compose files, and builds both the dev and production web images.
  • Production Redis in Docker now requires a token, but scripts/docker-web.js satisfies that automatically by generating and injecting the value unless you explicitly opt out with --without-redis. Watcher-managed Infrastructure projects do not inherit that platform Redis token; they start with Redis disabled and require project-scoped MANAGED_PROJECT_<PROJECT_ID>_UPSTASH_* credentials when Redis is intentionally enabled.
If you are changing deployment behavior, update this section and add any new page to apps/docs/docs.json.