Production deployment

The production Compose file uses the existing deploy_default Docker network and Caddy proxy. The selected host name is git.finluth.com.

1. Create a DNS A record for git.finluth.com pointing to the Finluth VPS (149.28.136.40).
2. Add https://git.finluth.com/auth/google/callback to the same Google OAuth client's Authorized redirect URIs.
3. On the VPS, create /opt/finluth-git, copy this app there, copy .finluth/ as /opt/finluth-git/data/, and create a mode-600 .env containing the Google OAuth credentials, GOOGLE_ALLOWED_DOMAINS=finluth.com,gmail.com, and GOOGLE_ADMIN_EMAILS with the workspace administrator's verified Google email(s). Configure this before enabling the access-control release so existing private repositories remain manageable.
4. Add the contents of deploy/Caddyfile.snippet to /opt/finluth/deploy/Caddyfile, then reload the existing Caddy service.
5. Ensure the data directory is writable by the container's node user (UID 1000), then deploy the currently checked-out code:

cd /opt/finluth-git
chown -R 1000:1000 data
sh deploy/deploy.sh

The deployment script rebuilds and starts the production Compose service, matching Finluth's deploy/deploy.sh workflow. It does not pull or change Git state; update the checkout separately before running it.

The health endpoint is /healthz.

Backups

The daily systemd backup timer runs deploy/backup.sh, encrypts the complete data directory, restores the archive into a temporary directory, runs git fsck on each restored bare repository, checks every referenced LFS payload, and verifies every stored LFS payload against its SHA-256 name. It copies the archive to BACKUP_SCP_TARGET or BACKUP_RCLONE_REMOTE when configured.

Install it on the production server after deploying the updated image and scripts:

install -m 600 /dev/null /etc/finluth-git-backup.env
nano /etc/finluth-git-backup.env # set BACKUP_PASSPHRASE to a long, unique secret
./deploy/install-backup-timer.sh

Keep the passphrase outside the VPS as well; it is required to recover encrypted archives. Optionally add BACKUP_SCP_TARGET or BACKUP_RCLONE_REMOTE and BACKUP_RETENTION_DAYS to the root-only environment file. Retention is disabled unless a positive number of days is set.

Check the schedule and recent run with systemctl list-timers finluth-git-backup.timer and journalctl -u finluth-git-backup.service. Run a manual restore drill with deploy/verify-backup.sh /path/to/finluth-git-YYYYMMDDTHHMMSSZ-<pid>.tar.gz.enc. Each successful drill records a per-repository verification time in the data directory, shown in the repository’s Backup & recovery panel; failed attempts leave the last verified time visible and show the latest error. The temporary restore is removed when the command exits.