DevOps & Deployment

​

Deployment Surfaces

​

Read This In Order

1. Environments & Release Flow
2. Web Docker Deployment
3. TanStack/Rust Local And Deployment
4. GitHub Actions Runbook
5. Secrets & Configuration

​

Core Principles

• GitHub Actions is the canonical automation layer for hosted deployments, platform build validation, and database migrations.
• tuturuuu.ts can disable individual workflows; ci-check.yml enforces that toggle before a job does real work.
• bun check includes path-sensitive Discord Python validation when the local diff touches apps/discord/** or .github/workflows/discord-python-ci.yml. That path runs the same blocking checks as Discord Python CI through scripts/check-discord-python.js.
• Vercel handles hosted satellite web deployments, opt-in TanStack frontend build validation, platform preview build validation, and the hosted platform production deploy. Supabase migrations run as separate workflows; main drives staging schema promotion and production drives production schema promotion.
• Self-hosted web deployment is Docker-based, and blue/green rollout is the supported rebuild-before-restart path.
• The TanStack/Rust migration runs in parallel with apps/web: apps/tanstack-web (TanStack Start) and apps/backend (Rust, port 7820) ship as Docker sidecars and Cloudflare Workers, and the TanStack frontend has Vercel build validation when it points at an HTTPS backend origin. See TanStack/Rust Local And Deployment, Web Docker Deployment, and the TanStack/Rust migration plan.
• Secrets live in GitHub Actions secrets/variables or local env files such as apps/web/.env.local. They do not belong in the repo.

​

Operational Flow

​

What Changed Recently

• The TanStack/Rust migration runtimes are now first-class deployment surfaces: apps/backend (Rust) builds a native binary, a Docker image, and a Cloudflare Worker bundle via .github/workflows/rust-backend.yml; apps/tanstack-web validates type-checks/tests, deploys as a Cloudflare Worker (tuturuuu-tanstack-web) bound to the backend Worker (tuturuuu-backend), and has Vercel preview/production build workflows for frontend compatibility against a separate HTTPS backend origin. Cloudflare uploads are manual-dispatch only and preflight CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID, and Worker runtime secret names before deploying.
• apps/web now supports both in-place Docker production deploys and blue/green deploys.
• docker-setup-check.yaml validates Docker parity, renders both compose files, and builds both the dev and production web images.
• Production Redis in Docker now requires a token, but scripts/docker-web.js satisfies that automatically by generating and injecting the value unless you explicitly opt out with --without-redis. Watcher-managed Infrastructure projects do not inherit that platform Redis token; they start with Redis disabled and require project-scoped MANAGED_PROJECT_<PROJECT_ID>_UPSTASH_* credentials when Redis is intentionally enabled.