Runbook — Deploy to the Linux box (Stage 2/3)

Prerequisites

• Box with Docker + Compose; Clerk application (keys); Cloudflare tunnel token; Gemini paid API key.
• Tunnel hostnames: www. → platform:3000 · app. → web:80 · api. → api:8000.

Steps

1. git clone https://github.com/BobMck/lifebot-v2 && cd lifebot-v2
2. cp .env.prod.example .env → set PUBLIC_DOMAIN, CLERK_PUBLISHABLE_KEY, CLERK_SECRET_KEY, CLERK_JWKS_URL, CLERK_ISSUER, TUNNEL_TOKEN.
3. docker compose -f docker-compose.yml -f docker-compose.prod.yml --profile tunnel up -d --build (dev bypass is OFF; db/redis publish no host ports; api/web/platform bind loopback only).
4. Backups: crontab -e → 15 2 * * * /path/to/lifebot-v2/ops/backup.sh (dump fails loudly if the vaults table is missing — the wrapped-key tier is the DR crown jewel).

Verification

• curl http://127.0.0.1:8080/health → {"status":"ok"}; tunnel logs show registered connections.
• From an external network: sign in via Clerk on app.<domain>, unlock, data round-trips.
• Restore drill into a scratch postgres:16 container; confirm vaults/records counts.

Rollback

• docker compose down (containers only); previous images remain; DB volume untouched.
• Compromise: rotate TUNNEL_TOKEN + Clerk keys; user data stays unreadable (zero-knowledge).