byGalax
5bc30c950c
Move Supabase + LiveKit from the netralax.cloud VPS to a new netralax.de server. Adds the migration runbook (docs/), one-time move scripts (scripts/migrate/), and prod Caddy/LiveKit config templates (infra/). Repoints the desktop publish/changelog URLs and prod ops config to .de. JWT_SECRET + VAPID copied identically so already-installed clients keep working; the new server also serves the legacy .cloud hostnames. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2.8 KiB
Production scripts
Helper scripts that talk to the Hetzner VPS hosting Supabase + LiveKit.
All commands read shared config from config.sh.
Setup (once)
- Copy your SSH key to the server so scripts don't prompt for a password:
ssh-keygen -t ed25519 # only if you don't already have one # PROD now points at the netralax.de VPS (user "debian"; see config.sh). ssh-copy-id debian@141.95.34.204 ssh debian@141.95.34.204 'echo ok' - Make the scripts executable:
chmod +x scripts/prod/*.sh - Edit
scripts/prod/config.shwhen the server IP or domains change.
Scripts
push-migrations.sh [<filter>]
Uploads supabase/migrations/*.sql to /tmp/migrations on the server and
runs each file through docker compose exec db psql. Pass an optional
filter (substring match) to only apply specific timestamps.
push-edge-function.sh <name>
Uploads supabase/functions/<name>/ to
/opt/supabase/volumes/functions/<name>/ and restarts the edge-runtime
container.
gen-jwt.sh <jwt-secret>
Wrapper around scripts/gen-jwt.py. Prints fresh 10-year anon and
service_role HS256 JWTs for the given secret. Paste the results into
/opt/supabase/.env (ANON_KEY / SERVICE_ROLE_KEY) and the desktop
.env (SUPABASE_ANON_KEY).
create-invite.sh <code> [<uses>] [<days>]
INSERTs a signup-invite row into public.invites. Defaults: 50 uses,
365-day expiry.
logs.sh <stack> [<service>] [<tail-lines>]
Follows logs from either the supabase or livekit compose stack.
restart.sh <stack> [<service>]
Restarts one service, or (without a service) brings the whole stack down and back up.
tunnel-db.sh [<local-port>]
Opens ssh -L <local>:localhost:5432. Default local port is 5433.
Leave it running while you use psql / supabase db push / etc.
tunnel-mailpit.sh [<local-port>]
Opens a tunnel to the Mailpit web UI. Default local port is 8025.
rotate-livekit-keys.sh
Generates a fresh LiveKit API key + secret, rewrites the keys: block in
/opt/livekit/livekit.yaml, and restarts the SFU. After running, also
update the Supabase .env (LIVEKIT_API_KEY / LIVEKIT_API_SECRET) and
restart.sh supabase functions so the mint-livekit-token Edge Function
sees the new values.
Typical workflows
Ship a new migration
# add supabase/migrations/20260501_my_change.sql locally
./scripts/prod/push-migrations.sh 20260501
Ship a new Edge Function change
# edit supabase/functions/mint-livekit-token/index.ts locally
./scripts/prod/push-edge-function.sh mint-livekit-token
Debug a failing magic-link
./scripts/prod/logs.sh supabase auth 200
./scripts/prod/tunnel-mailpit.sh # open http://localhost:8025
Rotate LiveKit credentials
./scripts/prod/rotate-livekit-keys.sh
# follow the printed hint to update supabase .env + restart functions