myResume2/docs/DEPLOYMENT.md

Deployment with Forgejo Releases and local Docker builds

This repository's origin remote is the Forgejo repository. Forgejo only discovers workflows in .forgejo/workflows/, which is why the deployment workflows live there.

One-time Forgejo setup

1. Enable Actions for the Forgejo instance and repository.
2. Register an act_runner with the node-22 label. It needs Node 22, Git, tar, curl, and network access to the Forgejo instance. It does not need Docker.

The workflow uses Forgejo's short-lived automatic FORGEJO_TOKEN to create the release and upload assets. No Docker Hub account, registry, or repository secret is needed. Keep the runner limited to repositories you trust.

Local mounted résumé data and the private cvExampleMe profile are excluded from the Docker build context, so publishing cannot accidentally embed that data in an image.

What is published

• A pushed semver tag such as v5.0.1 creates a Forgejo release.
• The release contains my-resume2-v5.0.1.tar.gz and its .sha256 checksum.

The archive is generated directly from the tagged Git commit. It intentionally does not contain node_modules or a container image.

Deploy an image

After a successful Action run, download the release archive to the target server, verify it, and build the Docker image locally:

sha256sum -c my-resume2-v5.0.1.tar.gz.sha256
tar -xzf my-resume2-v5.0.1.tar.gz
cd my-resume2-v5.0.1
docker compose -f compose.release.yml up -d --build

The persistent resume_data Docker volume keeps your custom me.json and images when you deploy a newer release. To use a host directory instead, replace the volume entry in compose.release.yml with a bind mount:

  - /srv/resume:/home/node/app/public/ress/mountedRess

The short-lived init-resume-data service only sets ownership on a new named volume; the resume server itself continues to run as the unprivileged node user.

Check the container endpoint with curl http://127.0.0.1:8000/health. The image is built and retained only on the target server. A reverse proxy should terminate HTTPS in front of the container.