# Deployment Automation Scripts

Automated deployment scripts for The Order using the Sankofa Phoenix / Proxmox runtime.

## Overview

The active deployment path is now Sankofa Phoenix / Proxmox-native. The scripts in this directory now:

- build The Order locally
- package the `portal-public` Next.js standalone bundle
- sync it to the Order public CT on Proxmox
- refresh the Order HAProxy edge
- verify direct, edge, and public health endpoints

The default topology is:

- `order-portal-public` CT `10090` at `192.168.11.36:3000`
- `order-haproxy` CT `10210` at `192.168.11.39:80`
- public URL `https://the-order.sankofa.nexus`
- Phoenix public URL `https://phoenix.sankofa.nexus`

## Quick Start

```bash
# Deploy the frontend to the default dev target
./scripts/deploy/deploy.sh --phase 11 --environment dev

# Run the direct sync script
./scripts/deploy/sync-portal-public-to-sankofa-phoenix.sh

# Full phase flow
./scripts/deploy/deploy.sh --all --environment dev
```

## Configuration

Configuration is managed in `config.sh`. The most important variables are:

- `PROXMOX_HOST`
- `ORDER_PORTAL_PUBLIC_VMID`
- `ORDER_PORTAL_PUBLIC_IP`
- `ORDER_HAPROXY_VMID`
- `ORDER_HAPROXY_IP`
- `SANKOFA_PHOENIX_URL`
- `THE_ORDER_PUBLIC_URL`
- `IMAGE_REGISTRY`
- `IMAGE_TAG`

Example:

```bash
export ENVIRONMENT=prod
export PROXMOX_HOST=192.168.11.11
export ORDER_PORTAL_PUBLIC_VMID=10090
export ORDER_HAPROXY_VMID=10210
./scripts/deploy/deploy.sh --phase 11
```

## Phase Scripts

### Phase 1: Prerequisites

- verifies local tooling
- verifies SSH access to Proxmox
- records the Sankofa / Order runtime targets

```bash
./scripts/deploy/phase1-prerequisites.sh
```

### Phase 2: Sankofa Phoenix Target Preparation

- confirms the Order public CT and HAProxy CT are reachable
- previews the HAProxy config for `the-order.sankofa.nexus`
- probes Phoenix public health

```bash
./scripts/deploy/phase2-sankofa-phoenix-target.sh
```

### Phase 6: Build & Package

- builds all packages and applications
- creates local Docker images for services and apps
- previews the Phoenix deployment artifact

```bash
./scripts/deploy/phase6-build-package.sh
```

### Phase 11: Frontend Applications Deployment

- builds `portal-public`
- syncs the standalone bundle to CT `10090`
- installs or refreshes the `the-order-portal-public` systemd service
- reprovisions the Order HAProxy edge on `10210`
- verifies LAN and public health endpoints

```bash
./scripts/deploy/phase11-frontend-apps.sh
```

## Usage Examples

### Frontend deployment

```bash
./scripts/deploy/deploy.sh --phase 11 --environment dev
```

### Build only

```bash
./scripts/deploy/deploy.sh --phase 6 --environment dev
```

### Continue from the last saved state

```bash
./scripts/deploy/deploy.sh --continue
```

## State Management

Deployment state is saved in `.deployment/${ENVIRONMENT}.state`.

Artifacts and image manifests are written under `.deployment/artifacts/`.

## Logging

All deployment logs are saved to `logs/deployment-YYYYMMDD-HHMMSS.log`.

```bash
tail -f logs/deployment-*.log
```

## Manual Steps

Some phases still require external operator work:

- `Phase 3`: identity-provider / Entra setup
- `Phase 8`: secret injection into the chosen backend
- `Phase 12`: DNS / NPM updates if you are changing routing
- `Phase 13`: central monitoring / alert wiring

## Troubleshooting

### Check deployment state

```bash
cat .deployment/dev.state
```

### Verify Order runtime access

```bash
ssh root@192.168.11.11 "pct status 10090 && pct status 10210"
curl -fsS http://192.168.11.36:3000/api/health
curl -fsS -H 'Host: the-order.sankofa.nexus' http://192.168.11.39/api/health
curl -fsS https://the-order.sankofa.nexus/api/health
```

### Verify Phoenix public access

```bash
curl -fsS https://phoenix.sankofa.nexus/health
```

### View CT service logs

```bash
ssh root@192.168.11.11 "pct exec 10090 -- journalctl -u the-order-portal-public -n 100 --no-pager"
```

## Security Notes

- never commit secrets to the repository
- keep Proxmox SSH access limited to operator hosts
- review CT and HAProxy targets before applying changes
- prefer the documented `10090 -> 10210 -> public` path over ad hoc edits