Deploys
Push to main, the deployer pulls. Never change containers by hand.
How a deploy works
- Make the change in the right repo.
- Test it locally, including on a phone-size screen.
- Push to the
mainbranch. - Within about a minute the deployer (
yanu-deploy, run byyanu-deploy.timer) fetches it, rebuilds only that repo's services, restarts them and waits until they are healthy. If a service does not become healthy, it is put back on its previous image. - Check the page or API you changed. The deployer log is
/var/log/yanu-deploy.log.
Who owns what
- yanu-infra owns nginx, Docker Compose files, backup scripts and the deployer. Host names, ports and TLS live there.
- Each app repo owns its own code and Dockerfile. App repos ship an nginx example under
deploy/nginx/, but the real config is in yanu-infra.
Ports inside the server
Every container publishes only on 127.0.0.1. nginx on the host terminates TLS and passes traffic on.
| Service | Port |
|---|---|
| yanu-web (smsyanu.com) | 3007 |
| yanu-auth | 8004 |
| yanu-auth-ui | 3001 |
| yanu-sms-web | 3005 |
| yanu-docs | 3006 |
| yanu-sms-api | 8010 |
| yanu-smpp-api | 8001 |
| yanu-smpp-portal | 3010 |
| jasmin HTTP API and jcli console | 1401 and 8990 (private network only) |
Only nginx is open to the internet on 80 and 443, plus SMPP on 2775 for allowed IPs. nginx refuses /internal/ paths on every host.
The SMPP firewall: every minute yanu-smpp-allowlist.timer runs scripts/smpp-allowlist-sync.sh. It reads every active bind's allowed IPs from yanu-smpp (/api/v1/internal/firewall/allowlist) and loads them into the nftables table inet yanu_smpp, which drops new connections to 2775 from any other address. Extra addresses, such as a monitor, go in SMPP_ALWAYS_ALLOW in /etc/yanu/firewall.env. Check it with nft list table inet yanu_smpp.
nginx sends smpp.smsyanu.com/api/ to yanu-smpp-api and everything else on that host to the portal.
Rules
- Never edit files inside a running container. The next deploy wipes the change, and nobody knows it happened.
- Never change the server by hand for anything yanu-infra owns. Change the repo and deploy.
- Deploy one service at a time. Check it before the next.
- Avoid deploys during busy sending hours.
Roll back
Revert the bad commit on main and push. The deployer deploys the reverted version.
Which repos the deployer watches, and which services each one rebuilds, is listed in deployer/repos.conf in yanu-infra.