chore: production infrastructure and CI/CD pipeline#36
Conversation
There was a problem hiding this comment.
Pull request overview
This PR introduces production/development Docker Compose infrastructure and a GitHub-based deployment pipeline intended to deploy the app to a VPS, plus a small frontend ignore-list update.
Changes:
- Add
compose.dev.ymlfor local development (Node container + Mosquitto). - Add
compose.prod.ymlfor production deployment (build frontend image + Mosquitto with persistent volumes). - Add a GitHub deployment workflow and update
frontend/.gitignorewith OS/model ignores.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| frontend/.gitignore | Ignore model assets and OS-specific files in the frontend workspace. |
| compose.prod.yml | Define production services (frontend build + Mosquitto) and persistence volumes. |
| compose.dev.yml | Define development services (pnpm dev server in Node container + Mosquitto). |
| .github/deploy.yml | Add an automated VPS deployment pipeline using SCP + SSH. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| mosquitto: | ||
| image: eclipse-mosquitto:latest | ||
| container_name: mosquitto | ||
| ports: | ||
| - "1883:1883" | ||
| - "9001:9001" | ||
| volumes: |
There was a problem hiding this comment.
Using eclipse-mosquitto:latest makes deployments non-reproducible and can unexpectedly pull breaking/security changes. Pin the Mosquitto image to a specific version tag for production stability (and ideally align dev/prod tags).
| ports: | ||
| - "1883:1883" | ||
| - "9001:9001" | ||
| volumes: | ||
| - ./mqtt/mosquitto.conf:/mosquitto/config/mosquitto.conf | ||
| - mosquitto_data:/mosquitto/data | ||
| - mosquitto_log:/mosquitto/log |
There was a problem hiding this comment.
Mosquitto is published on host ports 1883/9001; combined with the current mqtt/mosquitto.conf settings (allow_anonymous true on both listeners), this allows unauthenticated access from the network. For production, restrict exposure (bind to localhost / private network, or remove public port mappings) and/or enable authentication/TLS in Mosquitto.
github-project-automation
Bot
moved this from In review
to Done
in @The-Leyn's Pinball_three.js
No description provided.