notes/docs/home-server/deployment.md

schema_version, id, type, scope, sensitivity, last_reviewed, sources, related, update_triggers, unknowns

schema_version	id	type	scope	sensitivity	last_reviewed	sources	related	update_triggers	unknowns
1	home-server.deployment	reference	jupiter portainer github stack-deployment secrets	private-infrastructure	2026-10-06	kind reference owner-report Portainer GitHub/main/PAT configuration, environment management and manual pull/redeploy workflow, 2026-10-06 kind reference owner-report No independent credential recovery; operational rules not established, 2026-10-06	home-server.reference home-server.host home-server.portainer home-server.authentication home-server.backups home-server.operations	deployment-workflow-change repository-change credential-rotation rollback-policy-change	github-pat-scopes-and-expiration post-deployment-health-criteria

Deployment

Setting	Source / workflow
Stack definitions	https://github.com/jayo60013/jupiter-stacks
Git ref	main
Repository authentication	GitHub PAT configured in Portainer
Environment values/secrets	Portainer stack environment settings
Deployment	Manually pull/redeploy each affected stack in Portainer
Portainer itself	Host shell script, not a managed Compose stack

Compose change -> push main -> manual Portainer pull/redeploy -> running stack

A Git commit is not deployment proof. Installed host Compose version is not proof of Portainer's Compose implementation.

Recovering deployment requires Portainer state or independently retrievable repository credentials and stack environment values. Portainer backups exist; credential/state restoration is untested. Do not put secret values in this site or Git.

No independent recovery arrangement exists for the PAT or stack secrets. Rollback, health-check gates, approval rules and UI-versus-Git drift policy are not established; do not assume permission to deploy, stop or delete services.

Host apt packages, fstab, RAID assembly, systemd units and Mercury nginx are outside the Compose deployment workflow.