change image

docs/deployment.md

@@ -1,14 +1,16 @@
 # Server deployment: Komodo + Docker Compose
 
-This stack runs PHP 8.3/Apache, MySQL 8.4 LTS, and phpMyAdmin 5.2. No Node build,
-registry, or separate Komodo Build resource is required. The app image is built
-on your Docker host. MySQL has no published port. Database, application sessions,
-and phpMyAdmin sessions use persistent named volumes. Two one-shot services import
-an initial SQL dump safely and apply migrations before Apache starts.
+This stack runs PHP 8.3/Apache, MySQL 8.4 LTS, and phpMyAdmin 5.2. Gitea Actions
+builds and publishes `gitea.cptckp.com/nurinda/recruitment-hc:latest`; deployment
+only pulls and runs images. No local build or separate Komodo Build resource is
+required. `compose.yaml` is the only Compose file. MySQL has no published port.
+Database, application sessions, and phpMyAdmin sessions use persistent named
+volumes. Two one-shot services import an initial SQL dump safely and apply
+migrations before Apache starts.
 
-To build/publish the app in Gitea Actions instead of on the server, see
-[the image build guide](image-build.md), including registry secrets and Komodo
-settings for pulling the published image. Local builds remain the default below.
+See [the image build guide](image-build.md) for CI registry secrets, runner
+requirements, and registry pull credentials. Wait for a successful image build
+before deploying.
 
 ## 1. Configure the Komodo Stack
 
@@ -22,8 +24,10 @@ Commit/push the deployment files, then create a **Stack** in Komodo:
 | Run directory | `.` (repository root) |
 | Compose file paths | `compose.yaml` |
 | Project name | `recruitment-hc` |
-| Run build (`run_build`) | **Enabled** — rebuilds PHP code on redeploy |
-| Auto pull (`auto_pull`) | **Disabled** — app is built locally |
+| Run build (`run_build`) | **Disabled** — Gitea Actions builds the image |
+| Auto pull (`auto_pull`) | **Enabled** — pull the published image before deployment |
+| Extra args | `--no-build` — image-only deployment |
+| Ignore services | `db-init`, `migrate` — ignore exited setup services for status checks |
 | Destroy before deploy | **Disabled** |
 | Automatic image updates | **Disabled** — upgrade deliberately after backup |
 
@@ -33,6 +37,10 @@ secrets. Generate each password with `openssl rand -hex 32`. Use Komodo secrets
 if available; do not commit the populated environment to Git. Leave the environment
 file path at `.env`: Komodo writes it and passes it to Compose.
 
+For a private package, configure Komodo's Registry provider/account for
+`gitea.cptckp.com` with a token allowed to read the image. Keep these credentials
+separate from the CI write token.
+
 Before deploying, transfer your trusted initial SQL dump to the Docker host and
 set `DB_INIT_SQL_PATH` as described below. Deploy the Stack: startup waits for
 MySQL, runs `db-init`, runs `migrate`, then starts the app. The one-shot services
@@ -40,7 +48,7 @@ should finish with exit code 0; they do not remain running.
 
 For a files-on-host Stack instead, put the repository on the server, select
 **Files on host**, set Run directory to its absolute path, and use the same
-Compose/build/environment settings.
+Compose/image/environment settings.
 
 Official reference: [Komodo Compose Stacks](https://komo.do/docs/deploy/compose).
 
@@ -242,8 +250,9 @@ and deploy; initialization and migrations run automatically. Restoring over an
 existing database requires a separate, explicitly approved recovery procedure;
 normal startup never replaces its tables.
 
-To update, back up, pull the new commit in Komodo and redeploy with **Run build**
-enabled. The database volume is reused; successful imports are never repeated.
+To update, back up, wait for Gitea Actions to publish the new image, then pull the
+new commit in Komodo and redeploy with **Run build disabled** and **Auto pull
+enabled**. The database volume is reused; successful imports are never repeated.
 The migration service runs before the updated app starts. Rolling back an
 image does not undo schema changes; use a tested database restore if necessary.
 Image tags track compatible patch releases; consider pinning tested image digests
@@ -269,8 +278,10 @@ cp .env.example .env
 chmod 600 .env
 # Edit .env: replace both passwords and set DB_INIT_SQL_PATH to your trusted dump.
 # The SQL file must already exist on this Docker host.
+# For a private image, first run: docker login gitea.cptckp.com
 docker compose --env-file .env -p recruitment-hc config --quiet
-docker compose --env-file .env -p recruitment-hc up -d --build
+docker compose --env-file .env -p recruitment-hc pull
+docker compose --env-file .env -p recruitment-hc up -d --no-build
 ```
 
 Setup is automatic. Inspect `db-init`/`migrate` logs, create an admin as needed

docs/image-build.md

@@ -59,27 +59,20 @@ and update those pins when upgrading actions.
 
 ## Use the published image with Komodo
 
-The workflow only builds/publishes; it does **not** redeploy Komodo. The existing
-`compose.yaml` still builds locally and remains usable without a registry.
+The workflow only builds/publishes; it does **not** redeploy Komodo.
+[`compose.yaml`](../compose.yaml) directly uses
+`gitea.cptckp.com/nurinda/recruitment-hc:latest` for both `app` and `migrate`.
+It has no local `build` declarations and requires no override file.
 
-To deploy the CI image instead, add a small override file in your server-side
-Stack run directory, for example `compose.image.yaml`:
+For reproducible deployments, replace the shared `app-image` YAML anchor's
+`:latest` with the tested image digest (`@sha256:...`). Both services then use
+that same pinned image.
 
-```yaml
-services:
-  app:
-    image: gitea.cptckp.com/nurinda/recruitment-hc:latest
-  migrate:
-    image: gitea.cptckp.com/nurinda/recruitment-hc:latest
-```
+Use only `compose.yaml` in the Komodo Stack's Compose file paths. Then:
 
-Prefer replacing `:latest` with the tested image digest (`@sha256:...` instead
-of `:latest`).
-Include both `compose.yaml` and `compose.image.yaml` in the Komodo Stack's Compose
-file paths, in that order. Then:
-
-- Disable **Run build** so Komodo does not build/tag a local image over the CI image.
+- Disable **Run build**; Gitea Actions is responsible for building the image.
 - Enable **Auto pull** so the image is pulled before deployment.
+- Keep **Extra args** as `["--no-build"]` to explicitly enforce image-only deployment.
 - Configure Komodo's Registry provider/account for `gitea.cptckp.com`; for private
   packages, use a token with **Packages: Read** on an account allowed to pull them.
   Keep this separate from the CI write token.
@@ -88,10 +81,12 @@ file paths, in that order. Then:
   a trusted dump on the Docker host. Initialization/migrations run automatically;
   follow [the deployment guide](deployment.md).
 
-Compose retains both services' base `build` declarations in this simple override. Use
-`docker compose ... up -d --no-build` for manual deployments of the CI image
-(after registry login and `docker compose ... pull`); do **not** use `--build`.
-Komodo's Auto pull supplies the image before `up`, with Run build disabled.
+For manual deployments, run `docker compose ... pull` followed by
+`docker compose ... up -d --no-build` after registry login; do **not** use `--build`.
+Komodo's Auto pull supplies the image before `up`, with Run build disabled and
+`--no-build` set. The `recruitment-hc` entry in `komodo-sync/resources/stacks/web.toml`
+uses this single-file configuration. Push the application changes and wait for
+Gitea Actions to publish successfully before applying that Stack configuration.
 
 For example, after configuring registry authentication on the server: