- deploy.md: new 'Getting your files into the image' subsection — a
multi-tab annotated block (single file / directory / deps-first) showing
COPY <src> <dest> patterns, plus a warning not to COPY secrets.
- clarify volume ownership: 'Logs and config are ours; the rest is yours' —
we inject/manage the logs + config host mounts; devs put everything else
in named volumes Docker owns.
- remove all /srv/mounts: dropped the MOUNTS_DIR volume + env var and every
mounts reference from the compose block, injected-vars, paths line, and
checklist. environments.md + index.md mounts mentions cleaned too.
Verified in-browser: COPY tabs switch, volume tip renders, zero mounts refs
remain; mkdocs build --strict clean.
Signed-off-by: disqualifier <dev@disqualifier.me>
Supersedes the prior 'name everything after the repo' guidance, which caused
container-name collisions at fleet scale. The dev's compose now names nothing
repo-specific; the deploy layer injects identity and host paths.
deploy.md:
- replace the 'One name everywhere' danger callout with 'Your compose names
nothing repo-specific' (no container_name, no hardcoded names/paths)
- rewrite the compose example to the standard: svc service key,
restart: unless-stopped (required — host unit is oneshot), host paths via
${LOGS_DIR}/${CONFIG_DIR}/${MOUNTS_DIR} with :-./ local fallbacks, bare
'cache' volume. Keep user: "1337:1337" + HOME=/tmp (the services account
identity — not repo-specific)
- add 'How deploy fills it in' (injected env vars a dev can rely on + the
resulting docker ps names) and 'Onboarding a service' (deploy <host>
<workspace> <git-url> [name], deploy key handled via Gitea API)
- update paths to <name>, subprocess example to svc, checklist to the new
rules; drop docker CLI from secret rotation (host-side edit, we restart)
standards.md:
- add a 'Service compose' section: short convention + Right/Wrong tabs
(the nova before/after), linking to the Deploy guide for the full detail
Kept the services-account (1337) section and uid-agnostic Dockerfile notes.
Verified in-browser; mkdocs build --strict clean (cross-ref anchor resolves).
Signed-off-by: disqualifier <dev@disqualifier.me>
Add a prominent danger admonition ('One name everywhere — repo = container =
volumes') right under the intro: the repo name is the name; the compose
service key, container_name, and every named volume must all use it. Spell
out the consequence — mismatched names break deploy, monitoring, and log
scraping, which key off the repo name.
Make the compose example teach it: rename yourapp -> myrepo throughout
(service key, container_name: myrepo, myrepo-data volume) with annotations
calling out each spot where the repo name must appear.
Verified in-browser; mkdocs build --strict clean.
Signed-off-by: disqualifier <dev@disqualifier.me>
uv is presented as the recommended faster, standards-compliant drop-in;
pip stays the baseline/fallback. uv command syntax verified against
docs.astral.sh/uv before writing.
environments.md:
- new 'uv (optional, faster)' section: install from pyproject
(uv pip install . / -e . / '.[dev]'), the uv sync managed-venv flow,
and a note that uv.lock is local-only/gitignored (not committed)
- pinning subsection: pin direct deps in pyproject via == or git @ref,
with a warning that this pins direct deps only — transitive deps still
float at build time (documented tradeoff)
- uv equivalents added beside pip in the Local .venv and Docker tabs
deploy.md:
- 'Faster builds with uv' tip: uv-from-ghcr COPY, ENV UV_COMPILE_BYTECODE=1,
uv pip install --system . (reads pyproject, no lock)
- layer-caching shows the uv variant beside the pip one
- checklist notes uv pip install + UV_COMPILE_BYTECODE; fix stray 'configs'
plural -> 'config'
.gitignore: ignore uv.lock (local-only, never committed).
Verified in-browser; mkdocs build --strict clean (anchors resolve).
Signed-off-by: disqualifier <dev@disqualifier.me>
- deploy.md: /srv/configs -> /srv/config (singular is canonical) across the
compose mount, paths table, secrets path, and rotation snippet. Add the
repo+compose row (/srv/docker/<workspace>/<project>, created by the clone,
not pre-provisioned) and a note that all /srv paths are owned by the
services user (1337) — rounding out the canonical layout.
- workflow.md: the first 'per-project git identity' link pointed at a
nonexistent #per-project-git-identity anchor; point it at #handy-shell-setup
(where the gitsetup alias lives), matching the other link to the same spot.
Did not touch pip/requirements, chmod a+rwX + user 1337, HOME=/tmp, init,
layer caching, or the git-install caveat — all intentional standards.
Verified: mkdocs build --strict clean (validates anchors); table renders.
Signed-off-by: disqualifier <dev@disqualifier.me>
Host paths now follow one shape: /srv/<kind>/<workspace>/<project>/ across
configs, logs, and mounts (mounts added as its own row; configs gains the
workspace segment it was missing).
- deploy.md: compose volumes, paths table, secrets path + rotation snippet
all use <workspace>; add a yellow (warning) admonition ABOVE the table
explaining it — individual dev = lowercase username (ricky, xattam),
shared/official project = workspace (bots, web, apis) — so it stands out
from the all-blue palette and reads before the table.
- index.md: placeholder example uses <workspace>.
Verified in-browser; mkdocs build --strict clean.
Signed-off-by: disqualifier <dev@disqualifier.me>
- index.md: 'building and shipping with Rethink Studios' -> 'building and
shipping on our network' (it's the network, not the company)
- workflow.md + its index card: 'how we actually work day to day' ->
'get hands on with how we dev'
- deploy.md: drop the 'see the light / ready to host whatever you've built'
pitch for a plain 'how a project gets onto rethink-net'; trim the now-
duplicate eligibility tip
Signed-off-by: disqualifier <dev@disqualifier.me>
deploy.md:
- fix logs path to /srv/logs/<dev>/<project>
- reframe permissions as a deployer-side heads-up (bind-mount ownership is
handled at deploy time; 'if your bot won't start or logs vanish, flag us')
instead of a dev task / heavy footgun
- git in the image only when the container needs it (host always has git)
- NEW: layer caching (requirements before code copy)
- NEW: subprocess/browser workloads — init:true (tini + PID-1 shell-wrapper
gotcha), shm_size 2gb, mem_limit; with code annotations and a warning
- refresh the compose-needs checklist accordingly
standards.md:
- NEW: licensing — no per-file headers; single top-level LICENSE only when a
repo is for outside use
Verified: mkdocs build --strict clean; new deploy sections rendered.
Signed-off-by: disqualifier <dev@disqualifier.me>
Make the things that matter stand out, matching the Gitea callout look:
- extra.css: brand-orange warning admonitions (#f57c00, the lambda orange),
hotter danger (#e8590c), blue note/info and cyan tip/example, plus blue
code-annotation markers.
- deploy.md: footgun -> danger callout, secrets -> orange warning, eligible
-> tip; Dockerfile and compose gain numbered code annotations explaining
each magic line; paths/mounts as a table; a restart snippet for rotation.
- workflow.md: warning on setting per-repo git identity before first commit;
tip elevating verify-by-executing.
Verified in-browser: computed border colors match (warning #f57c00,
danger #e8590c), 4 annotation markers render in brand blue, admonition
icons + tinted headers match the Gitea style. mkdocs build --strict clean.
Signed-off-by: disqualifier <dev@disqualifier.me>
dsql