Skip to content

VM Box

What this box is doing

This VM is a mixed-purpose utility and semi-production host. It is not a single-app deployment target.

At a high level it currently carries:

  • Docker Compose application stacks under /home/steam/apps
  • Jenkins for deploy automation under /home/steam/automation/jenkins
  • host nginx as the public reverse proxy and TLS endpoint
  • systemd timers for recurring host maintenance tasks
  • stateful backup directories for PostgreSQL and MongoDB based apps

Important host paths

Path Purpose
/home/steam/apps app checkouts and compose projects
/home/steam/automation deploy wrapper, app registry, Jenkins config, and docs
/etc/nginx/sites-available nginx vhost definitions
/etc/nginx/sites-enabled enabled nginx sites
/etc/nginx/ssl shared TLS certificate and private key
/home/steam/apps/affine/backups/postgres Affine PostgreSQL backups
/home/steam/apps/harmonious-accord/backups/postgres Harmonious Accord PostgreSQL backups
/home/steam/apps/KPCalorieTracking/backups/mongodb KP Calorie Tracking MongoDB backups

Public entrypoints covered by this docs set

The automation docs are strongest for the services that have been registered into the shared deployment system.

Those currently include:

  • docs.ilgaming.xyz for this documentation site
  • jenkins.ilgaming.xyz for the automation dashboard
  • keycloak.ilgaming.xyz for shared platform login
  • the managed application endpoints listed in Managed Apps

Other directories under /home/steam/apps may exist on the box but are not fully represented in the automation registry yet. Those should be treated as partially documented until they are onboarded.

Reverse proxy conventions

Most public sites follow the same pattern:

  • bind the application locally on 127.0.0.1:<port> or localhost:<port>
  • terminate TLS at host nginx with the shared ilgaming.xyz certificate
  • proxy the traffic to the local port with forwarded host and proto headers
  • add websocket upgrade headers when the app needs them

Operations notes

  • Jenkins and the docs site are both reverse proxied through host nginx rather than exposing container ports publicly.
  • The onboarding helper can write and validate nginx configs, but host nginx still needs a reload to activate a new site.
  • deployctl.sh refuses to auto-pull git-backed apps when the working tree is dirty. That guard is intentional on this box.