Skip to main content

Day to day (VPS)

On client installations and reference client the layout is the bundle: /opt/sis. The real env file is /opt/sis/.env. /opt/sis/infra/.env is not the env file — it is comments.

The only correct way to bring up or recreate​

# On the VPS, from /opt/sis:
tools/ops/prod-up.sh <service> [service...]
# equivalent to:
containers compose --env-file .env \
  -f infra/containers-compose.yml -f infra/containers-compose.prod.yml \
  up -d --force-recreate <service>

Names are compose service keys (agents-host-operaciones, society-graph-ui), not always the container_name (society-agents-host-operaciones). Find them with:

grep -nB6 'container_name: <name>' infra/containers-compose.yml

Never​

  • containers start <container> on a down stack member: it comes back without a container orchestrator network (Networks={}) → cannot resolve pg, publishes no ports (public 502), and can still look “Up (healthy)” inside. Verified 2026-07-13.
  • containers compose up without --env-file .env or without the prod overlay → default password → InvalidPasswordError against real pg-data.
  • Channel config in infra/ (lost on the next deploy). It belongs in the profile .env.

The prod overlay makes pg_PASSWORD required (${pg_PASSWORD:?}). Without it, the base compose default wins.

Bind: SOCIETY_BIND_IP=0.0.0.0 + containers-USER firewall (sis-firewall.sh). Legitimate access: private mesh or host edge proxy. A new SIS port without re-running the firewall is open to the internet. The firewall pattern covers ^(society|copilot|sis-).

edge proxy config: bind-mount by inode. mv / sed -i leave the container on the old file and edge-proxy reload says config is unchanged with no error. Write by truncate (cat nuevo > edge-proxyfile) or recreate. edge-proxy validate before installing.

messaging channel (reference client only): do not recreate agents-host-operaciones lightly; the session cannot be reproduced. Skill actualiza-legaldesign and runbook 23 § messaging channel.

Health: tools/ops/prod-healthcheck.sh every 5 min on both VPS boxes.