`sudo -u deploy deploy.sh` (manual deploy, re-deploy, rollback) keeps
root's working directory /root, which deploy cannot read; GNU find then
fails in preflight and the run stops. Every path is absolute, so lib.sh
now changes to / first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`pbpaste | ssh petrolyst /root/secrets-init.sh keycloak-secret` sends the
secret without a trailing newline. read then sets the value but returns
non-zero, and set -e ended the script silently before storing it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Traefik as the server-wide edge (TLS via Let's Encrypt, dashboard on
traefik.petrolyst.com behind oauth2-proxy and Keycloak). The
fuel-monitoring stack: Superset on atoma.petrolyst.com with Keycloak login
and Petrolyst branding, Trino reading the TimescaleDB fuel-db as catalog
"fuel". Customization lives in petrolyst-insights/, deployment in the other
folders.
Deploys run server-side (deploy/deploy.sh) from a Gitea workflow or
manually; releases are immutable, Superset metadata is backed up before
migrations, and deploy/rollback.sh restores it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Nasim SadatandClaude Opus 5.5