A deploy workflow, started only by hand (or through the API) and only
from master, pulls the chosen image (release tag, sha or latest) and
runs that image's own update.sh against VM103's compose directory
through the Docker socket. update.sh now copies the database through the
running server first, installs the image's compose.yaml and update.sh
with --install, and restores the previous compose file together with
the previous image when the new version does not come up. CI also
builds release tags v*.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
One image for both processes (node:24-slim pinned by digest, Node 24.21 / SQLite 3.53 as in development).
compose: server on the proxy network with traefik labels in the house convention (web-secured, certresolver http,
ipwhitelist LAN only), driver with no network; both non-root, read-only rootfs, no capabilities, no host port,
no Docker socket. Data in /srv/appdata/homelab-upgrade/data.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>