Runbook — Home server deploy (ThinkCentre M70q Ubuntu)

Prerequisites

• Ubuntu on ThinkCentre; you are on the home network (or Tailscale)
• Docker Engine + Compose plugin
• LUKS (or equivalent) on data volume — see SAAS-Lifebot/runbooks/pre-invite-security-gate
• Private git remote with SAAS-Lifebot code
• Clerk application; Tailscale and/or Cloudflare Tunnel

Steps

1. git clone <remote> SAAS-Lifebot && cd SAAS-Lifebot
2. Copy .env.example → .env (mode 600). Set: - CLERK_SECRET_KEY, NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY - APP_SECRET (≥32 random bytes, hex/base64) - DATABASE_URL=postgres://lifebot:...@db:5432/lifebot - NEXT_PUBLIC_APP_URL=https://<your-host>
3. docker compose up -d --build
4. Confirm: docker compose ps healthy; open app URL
5. Clerk dashboard: add production URL to allowed origins / redirect URLs
6. Expose: - Tailscale: install tailscale; share MagicDNS HTTPS or Serve - Cloudflare Tunnel: point hostname at http://127.0.0.1:3000
7. Run SAAS-Lifebot/runbooks/pre-invite-security-gate
8. Create your account; complete vault + consent; optional demo seed

Verification

• HTTPS or Tailscale only (no plain LAN HTTP for real data)
• Login works; Health unlocks after vault password
• docker compose exec db psql … shows ciphertext in sealed columns

Rollback

docker compose down (add -v only if you intend to wipe DB). Restore from encrypted backup if needed.