prometheus/deploy/README.md

# Prometheus — deploy

Everything in this directory lands on a VPS the first time Prometheus is set
up on it, plus files that get swapped out on each release.

```
deploy/
  prometheus-service.service        systemd unit — the Node service on :3700
  prometheus-x.conf                 angie vhost — TLS-terminated reverse proxy
  prometheus-snapshot.service       systemd unit — weekly snapshot job
  prometheus-snapshot.timer         systemd timer — Sunday 04:00 UTC
  apps-silentmode-st.conf           angie vhost — SEO mirror (apps.silentmode.st)
  make-tls-cert.sh                  (re-)generate the self-signed cert, print the pin
```

## First-time install (VPS, root)

```bash
# Code
useradd -r -s /usr/sbin/nologin -d /opt/prometheus prometheus
mkdir -p /opt/prometheus
rsync -av --exclude=node_modules --exclude=db.sqlite\* --exclude=uploads \
          --exclude=.keys --exclude=build \
          <workstation>:Prometheus/ /opt/prometheus/
cd /opt/prometheus && npm install --omit=dev
chown -R prometheus:prometheus /opt/prometheus
mkdir -p /opt/prometheus/{uploads,.keys,build}
chown prometheus:prometheus /opt/prometheus/{uploads,.keys,build}

# TLS cert for prometheus.x (prints the fingerprint — save it for #6)
sudo bash /opt/prometheus/deploy/make-tls-cert.sh

# angie
install -m644 /opt/prometheus/deploy/prometheus-x.conf     /etc/angie/http.d/
install -m644 /opt/prometheus/deploy/apps-silentmode-st.conf /etc/angie/http.d/
angie -t && systemctl reload angie

# systemd
install -m644 /opt/prometheus/deploy/prometheus-service.service   /etc/systemd/system/
install -m644 /opt/prometheus/deploy/prometheus-snapshot.service  /etc/systemd/system/
install -m644 /opt/prometheus/deploy/prometheus-snapshot.timer    /etc/systemd/system/

# Instance-specific environment (NOT in the repo)
cat > /etc/default/prometheus <<EOF
ADMIN_PUBLISHER=<a BNS name you own>
# VIRUSTOTAL_API_KEY=<key>              # optional
# PAYMENT_REQUIRED=1                    # enable paid wave
# PROMETHEUS_PAYMENT_ADDRESS=<cashaddr> # required when PAYMENT_REQUIRED=1
# PROMETHEUS_LISTING_FEE_USD=1
EOF
chmod 600 /etc/default/prometheus

systemctl daemon-reload
systemctl enable --now prometheus-service.service
systemctl enable --now prometheus-snapshot.timer

# Verify
curl -k https://127.0.0.1/healthz    # should return 200 and {ok:true,…}
```

## Register the on-chain record (workstation)

```bash
IP=$(curl -s https://ifconfig.io)       # or the VPS's public IP as you know it
TLS=<the fingerprint make-tls-cert.sh printed>

node Argus/src/register.js prometheus.x "{\"ip\":\"$IP\",\"tls\":\"$TLS\"}"
# Prompts for the chipnet keystore password (or set DEVIANT_KEYSTORE_PASSWORD).
```

The current record (as of 2026-10-08) is `{"u":"https://silentmode.st/prometheus/"}`.
The register command above replaces it. Within a few minutes of the TX
confirming on chipnet, Theseus and Ariadne resolve `prometheus.x` to the live
service rather than the silentmode.st teaser.

## Updates

Code: rsync Prometheus/ again, `npm install --omit=dev` (safe no-op if deps
unchanged), `systemctl restart prometheus-service`.

Snapshot: nothing to do — the timer runs itself.

Cert rotation: re-run make-tls-cert.sh, grab the new fingerprint, re-register
the `tls` record, reload angie. Theseus and Ariadne pick up the new cert as
soon as the record TX confirms.

## Rollback

Code: rsync the previous checkout, restart. There is no "schema down migration"
discipline yet — the DB file is append-only in practice (new columns, new
tables); if a rollback hits a schema change you have to decide what to do with
the newer rows.

Record: `node Argus/src/register.js prometheus.x '{"u":"https://silentmode.st/prometheus/"}'`
puts the name back to redirecting at the ICANN mirror. Takes the same few
minutes as any other record change.