clusev/docker/release/README.md

Release bridge (host watcher) — DEV ONLY

The dashboard "Release" page (Deploy to Staging) cuts a release candidate by asking the host to do the git work, so the container never holds git credentials — the same isolation as the WireGuard bridge.

• clusev-release.sh serve-request — reads run/release-request.json (the dashboard wrote it), re-validates, bumps config/clusev.php, commits, tags vX.Y.Z-rcN, pushes to Gitea (token read host-side from /home/nexxo/.env.gitea), and writes run/release-result-<id>.json for the dashboard to poll. Roll back leaves no half-release if the push fails.
• clusev-release-request.path / .service — a systemd .path watcher that runs the handler when a request file appears.

Enable on the dev box

These units are installed only when CLUSEV_RELEASE_CONTROLS=true is in the project .env (install.sh gates them). To enable manually:

cd /home/nexxo/clusev
sudo install -m 0644 docker/release/clusev-release-request.service /etc/systemd/system/
sudo install -m 0644 docker/release/clusev-release-request.path    /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now clusev-release-request.path

The dev docker-compose.yml must bind-mount ./run to the container's storage/app/restart-signal (shared with the WireGuard/restart bridges) so the dashboard's request lands where the watcher looks.

Verify (manual gate)

This is the end-to-end gate (like the WireGuard runbook): with the watcher enabled and the flag on, open /release, click a bump button, confirm, and check that vX.Y.Z-rcN lands on Gitea (and, via the push-mirror, on GitHub-private). The handler never logs the Gitea token.