Files

T

dsql f9e5e4f24d split Deploy into a hub + 3 sub-pages; inline comments over annotations

The Deploy page got long and the code annotations rendered inconsistently
(some as (n) numbers, some as clickable +, and a marker on a fully-commented
line made that line vanish). Fix both:

- Deploy is now a HUB (docs/deploy/index.md): the intro + collision rule +
  central-deploy note, then card links to three focused sub-pages. Deploy
  stays the single global-nav entry; sub-pages are not_in_nav, reached from
  the hub cards.
  - deploy/compose.md — compose convention, storage tiers, how deploy fills
    it in, subprocess/browser knobs, checklist
  - deploy/dockerfile.md — services-account image, COPY, layer caching, uv
  - deploy/secrets.md — keeping secrets out of the image
- Replace code annotations with INLINE COMMENTS on the compose/Dockerfile
  examples: everything visible at once, no + to click, and the commented
  MOUNTS_DIR line no longer disappears.
- Update inbound links (index card, standards, workflow, environments) to
  deploy/ and deploy/compose.md; nav Deploy -> deploy/index.md with
  not_in_nav for the sub-pages.

Verified in-browser: hub cards link correctly, sub-pages render with visible
inline comments (0 annotation markers), left nav shows only Deploy;
mkdocs build --strict clean (validates not_in_nav + all cross-links).

Signed-off-by: disqualifier <dev@disqualifier.me>

2026-07-01 02:32:16 -04:00

832 B

Raw Blame History

Secrets

!!! warning "Secrets never go in the image" We do not commit secrets (usually, lol). They stay gitignored and live on the host in your config dir, reaching your container read-only via ${CONFIG_DIR}. Add them to .dockerignore so a COPY . . can't sweep them into a layer.

How it works

Secrets live on the host, in your config dir — never in git, never in the image.
They reach the container read-only via the injected ${CONFIG_DIR} mount (see Compose convention).
Keep them out of the build context: list them in .dockerignore so a blanket COPY . . can't pull them into a layer.

Rotating a secret

A host-side edit — update the file and the service picks it up on restart. No rebuild, and nothing you run: flag it and we handle the restart.

832 B Raw Blame History

Secrets

How it works

Rotating a secret

832 B

Raw Blame History