Infrastructure Deployment Protocol

When This Skill Activates

• "Deploy this", "push to production", "setup server"
• "Docker", "containerize", "docker-compose"
• "VPS setup", "server configuration"
• "Coolify", "nginx", "reverse proxy"
• "SSL", "HTTPS", "Let's Encrypt"

Pre-Deployment Checklist

Before ANY Deployment:

bash
1# 1. Verify build works locally
2npm run build  # or equivalent
3
4# 2. Run tests
5npm test
6
7# 3. Check for env vars
8cat .env.example  # Document required vars
9
10# 4. Verify no secrets in code
11grep -r "sk_live\|api_key\|password" --include="*.ts" --include="*.js" || echo "Clean"

Docker Deployment

Production Dockerfile (Node.js)

dockerfile
1# Build stage
2FROM node:20-alpine AS builder
3WORKDIR /app
4COPY package*.json ./
5RUN npm ci --only=production
6COPY . .
7RUN npm run build
8
9# Production stage
10FROM node:20-alpine AS runner
11WORKDIR /app
12ENV NODE_ENV=production
13
14# Non-root user for security
15RUN addgroup --system --gid 1001 nodejs
16RUN adduser --system --uid 1001 appuser
17
18COPY --from=builder --chown=appuser:nodejs /app/dist ./dist
19COPY --from=builder --chown=appuser:nodejs /app/node_modules ./node_modules
20COPY --from=builder --chown=appuser:nodejs /app/package.json ./
21
22USER appuser
23EXPOSE 3000
24CMD ["node", "dist/index.js"]

Docker Compose (Production)

yaml
1version: '3.8'
2
3services:
4  app:
5    build: .
6    restart: unless-stopped
7    environment:
8      - NODE_ENV=production
9      - DATABASE_URL=${DATABASE_URL}
10    ports:
11      - "3000:3000"
12    healthcheck:
13      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
14      interval: 30s
15      timeout: 10s
16      retries: 3
17    deploy:
18      resources:
19        limits:
20          memory: 512M
21          cpus: '0.5'
22
23  db:
24    image: postgres:16-alpine
25    restart: unless-stopped
26    environment:
27      POSTGRES_DB: ${DB_NAME}
28      POSTGRES_USER: ${DB_USER}
29      POSTGRES_PASSWORD: ${DB_PASSWORD}
30    volumes:
31      - postgres_data:/var/lib/postgresql/data
32    healthcheck:
33      test: ["CMD-SHELL", "pg_isready -U ${DB_USER}"]
34      interval: 10s
35      timeout: 5s
36      retries: 5
37
38volumes:
39  postgres_data:

VPS Initial Setup

1. Security Hardening (Run First)

bash
1# Update system
2apt update && apt upgrade -y
3
4# Create deploy user
5adduser deploy
6usermod -aG sudo deploy
7
8# Setup SSH keys (on local machine)
9ssh-copy-id deploy@YOUR_SERVER_IP
10
11# Disable password auth
12sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
13sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
14sudo systemctl restart sshd
15
16# Setup firewall
17sudo ufw allow OpenSSH
18sudo ufw allow 80/tcp
19sudo ufw allow 443/tcp
20sudo ufw enable
21
22# Install fail2ban
23sudo apt install fail2ban -y
24sudo systemctl enable fail2ban

2. Docker Installation

bash
1curl -fsSL https://get.docker.com | sh
2sudo usermod -aG docker deploy
3newgrp docker

3. Coolify (Self-Hosted PaaS)

bash
1curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

Nginx Reverse Proxy

With SSL (Let's Encrypt)

nginx
1server {
2    listen 80;
3    server_name yourdomain.com;
4    return 301 https://$server_name$request_uri;
5}
6
7server {
8    listen 443 ssl http2;
9    server_name yourdomain.com;
10
11    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
12    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
13
14    # Security headers
15    add_header X-Frame-Options "SAMEORIGIN" always;
16    add_header X-Content-Type-Options "nosniff" always;
17    add_header X-XSS-Protection "1; mode=block" always;
18
19    location / {
20        proxy_pass http://localhost:3000;
21        proxy_http_version 1.1;
22        proxy_set_header Upgrade $http_upgrade;
23        proxy_set_header Connection 'upgrade';
24        proxy_set_header Host $host;
25        proxy_set_header X-Real-IP $remote_addr;
26        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
27        proxy_set_header X-Forwarded-Proto $scheme;
28        proxy_cache_bypass $http_upgrade;
29    }
30}

Get SSL Certificate

bash
1sudo apt install certbot python3-certbot-nginx -y
2sudo certbot --nginx -d yourdomain.com

Deployment Commands

Build and Deploy

bash
1# Build image
2docker build -t myapp:latest .
3
4# Stop old container
5docker stop myapp || true
6docker rm myapp || true
7
8# Run new container
9docker run -d \
10  --name myapp \
11  --restart unless-stopped \
12  -p 3000:3000 \
13  --env-file .env.production \
14  myapp:latest
15
16# Verify running
17docker ps
18docker logs myapp --tail 50

Zero-Downtime Deployment

bash
1# Start new container on different port
2docker run -d --name myapp-new -p 3001:3000 myapp:latest
3
4# Wait for health check
5sleep 10
6curl -f http://localhost:3001/health
7
8# Switch nginx upstream
9# Then remove old container
10docker stop myapp-old && docker rm myapp-old

Monitoring

Basic Health Check Endpoint

typescript
1app.get('/health', (req, res) => {
2  res.json({
3    status: 'healthy',
4    timestamp: new Date().toISOString(),
5    uptime: process.uptime()
6  });
7});

Log Commands

bash
1# Follow logs
2docker logs -f myapp
3
4# Last 100 lines
5docker logs myapp --tail 100
6
7# With timestamps
8docker logs myapp -t --since 1h

Rollback Procedure

bash
1# List available images
2docker images myapp
3
4# Rollback to previous
5docker stop myapp
6docker run -d --name myapp -p 3000:3000 myapp:previous-tag

Security Checklist

• SSH key auth only (no passwords)
• Firewall enabled (ufw)
• Fail2ban running
• Non-root user for app
• Secrets in env vars, not code
• HTTPS with valid cert
• Security headers configured
• Regular security updates scheduled