Infrastructure Deployment Protocol
When This Skill Activates
- "Deploy this", "push to production", "setup server"
- "Docker", "containerize", "docker-compose"
- "VPS setup", "server configuration"
- "Coolify", "nginx", "reverse proxy"
- "SSL", "HTTPS", "Let's Encrypt"
Pre-Deployment Checklist
Before ANY Deployment:
bash
1# 1. Verify build works locally
2npm run build # or equivalent
3
4# 2. Run tests
5npm test
6
7# 3. Check for env vars
8cat .env.example # Document required vars
9
10# 4. Verify no secrets in code
11grep -r "sk_live\|api_key\|password" --include="*.ts" --include="*.js" || echo "Clean"
Docker Deployment
Production Dockerfile (Node.js)
dockerfile
1# Build stage
2FROM node:20-alpine AS builder
3WORKDIR /app
4COPY package*.json ./
5RUN npm ci --only=production
6COPY . .
7RUN npm run build
8
9# Production stage
10FROM node:20-alpine AS runner
11WORKDIR /app
12ENV NODE_ENV=production
13
14# Non-root user for security
15RUN addgroup --system --gid 1001 nodejs
16RUN adduser --system --uid 1001 appuser
17
18COPY --from=builder --chown=appuser:nodejs /app/dist ./dist
19COPY --from=builder --chown=appuser:nodejs /app/node_modules ./node_modules
20COPY --from=builder --chown=appuser:nodejs /app/package.json ./
21
22USER appuser
23EXPOSE 3000
24CMD ["node", "dist/index.js"]
Docker Compose (Production)
yaml
1version: '3.8'
2
3services:
4 app:
5 build: .
6 restart: unless-stopped
7 environment:
8 - NODE_ENV=production
9 - DATABASE_URL=${DATABASE_URL}
10 ports:
11 - "3000:3000"
12 healthcheck:
13 test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
14 interval: 30s
15 timeout: 10s
16 retries: 3
17 deploy:
18 resources:
19 limits:
20 memory: 512M
21 cpus: '0.5'
22
23 db:
24 image: postgres:16-alpine
25 restart: unless-stopped
26 environment:
27 POSTGRES_DB: ${DB_NAME}
28 POSTGRES_USER: ${DB_USER}
29 POSTGRES_PASSWORD: ${DB_PASSWORD}
30 volumes:
31 - postgres_data:/var/lib/postgresql/data
32 healthcheck:
33 test: ["CMD-SHELL", "pg_isready -U ${DB_USER}"]
34 interval: 10s
35 timeout: 5s
36 retries: 5
37
38volumes:
39 postgres_data:
VPS Initial Setup
1. Security Hardening (Run First)
bash
1# Update system
2apt update && apt upgrade -y
3
4# Create deploy user
5adduser deploy
6usermod -aG sudo deploy
7
8# Setup SSH keys (on local machine)
9ssh-copy-id deploy@YOUR_SERVER_IP
10
11# Disable password auth
12sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
13sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
14sudo systemctl restart sshd
15
16# Setup firewall
17sudo ufw allow OpenSSH
18sudo ufw allow 80/tcp
19sudo ufw allow 443/tcp
20sudo ufw enable
21
22# Install fail2ban
23sudo apt install fail2ban -y
24sudo systemctl enable fail2ban
2. Docker Installation
bash
1curl -fsSL https://get.docker.com | sh
2sudo usermod -aG docker deploy
3newgrp docker
3. Coolify (Self-Hosted PaaS)
bash
1curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash
Nginx Reverse Proxy
With SSL (Let's Encrypt)
nginx
1server {
2 listen 80;
3 server_name yourdomain.com;
4 return 301 https://$server_name$request_uri;
5}
6
7server {
8 listen 443 ssl http2;
9 server_name yourdomain.com;
10
11 ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
12 ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
13
14 # Security headers
15 add_header X-Frame-Options "SAMEORIGIN" always;
16 add_header X-Content-Type-Options "nosniff" always;
17 add_header X-XSS-Protection "1; mode=block" always;
18
19 location / {
20 proxy_pass http://localhost:3000;
21 proxy_http_version 1.1;
22 proxy_set_header Upgrade $http_upgrade;
23 proxy_set_header Connection 'upgrade';
24 proxy_set_header Host $host;
25 proxy_set_header X-Real-IP $remote_addr;
26 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
27 proxy_set_header X-Forwarded-Proto $scheme;
28 proxy_cache_bypass $http_upgrade;
29 }
30}
Get SSL Certificate
bash
1sudo apt install certbot python3-certbot-nginx -y
2sudo certbot --nginx -d yourdomain.com
Deployment Commands
Build and Deploy
bash
1# Build image
2docker build -t myapp:latest .
3
4# Stop old container
5docker stop myapp || true
6docker rm myapp || true
7
8# Run new container
9docker run -d \
10 --name myapp \
11 --restart unless-stopped \
12 -p 3000:3000 \
13 --env-file .env.production \
14 myapp:latest
15
16# Verify running
17docker ps
18docker logs myapp --tail 50
Zero-Downtime Deployment
bash
1# Start new container on different port
2docker run -d --name myapp-new -p 3001:3000 myapp:latest
3
4# Wait for health check
5sleep 10
6curl -f http://localhost:3001/health
7
8# Switch nginx upstream
9# Then remove old container
10docker stop myapp-old && docker rm myapp-old
Monitoring
Basic Health Check Endpoint
typescript
1app.get('/health', (req, res) => {
2 res.json({
3 status: 'healthy',
4 timestamp: new Date().toISOString(),
5 uptime: process.uptime()
6 });
7});
Log Commands
bash
1# Follow logs
2docker logs -f myapp
3
4# Last 100 lines
5docker logs myapp --tail 100
6
7# With timestamps
8docker logs myapp -t --since 1h
Rollback Procedure
bash
1# List available images
2docker images myapp
3
4# Rollback to previous
5docker stop myapp
6docker run -d --name myapp -p 3000:3000 myapp:previous-tag
Security Checklist
