Skip to content
NutsNews chestnut logoNutsNews Wiki

Technical guide · Core platform

Page status: Active

NutsNews Backend Bootstrap

This documents the initial operating model for ramideltoro/nutsnews-backend, which owns the backend server at backend.nutsnews.com / 65.75.201.18.

Visual overview

Primary diagram

System map

This documents the initial operating model for ramideltoro/nutsnews-backend, which owns the backend server at backend.nutsnews.com / 65.75.201.18.

Render the repository-owned system map when you need it.

Diagram is not rendered yet.

View as text
NutsNews Backend Bootstrap

This documents the initial operating model for ramideltoro/nutsnews-backend, which owns the backend server at backend.nutsnews.com / 65.75.201.18.

flowchart TD
  accTitle: NutsNews Backend Bootstrap
  accDescr {
    This documents the initial operating model for ramideltoro/nutsnews-backend, which owns the backend server at backend.nutsnews.com / 65.75.201.18.
  }
  A[Run backend bootstrap workflow/manual runbook] --> B[Provision VPS host dependencies]
  B --> C[Install required packages and baseline tooling]
  C --> D[Create user/group/app directories]
  D --> E[Prepare app secret/config templates]
  E --> F[Bootstrap services to standby/baseline state]
  F --> G[Generate bootstrap health and drift artifacts]
  G --> H[Document follow-up bootstrap and bootstrap credential onboarding]

NutsNews Backend Bootstrap

Fullscreen diagram view.

NutsNews Backend Bootstrap

Section titled “NutsNews Backend Bootstrap”

This documents the initial operating model for ramideltoro/nutsnews-backend, which owns the backend server at backend.nutsnews.com / 65.75.201.18.

Summary

Section titled “Summary”

The backend repo now has a first bootstrap scaffold:

  • AGENTS.md defines backend-specific repo boundaries and safety rules.
  • README.md defines the host contract and chosen runtime shape.
  • runbooks/BACKEND_BOOTSTRAP.md is the backend bootstrap entry point.
  • ansible/ contains the initial production inventory and syntax-valid bootstrap contract playbook.

The scaffold does not mutate the backend server yet. It defines how future backend host changes should be made: pull request, checks, merge, protected pipeline check, approved protected apply, then read-only verification.

Backend Host Contract

Section titled “Backend Host Contract”
ItemValue
Hostnamebackend
IPv465.75.201.18
Target domainbackend.nutsnews.com
Target OSUbuntu 26.04 LTS
Reporamideltoro/nutsnews-backend

Runtime Direction

Section titled “Runtime Direction”

The backend runtime direction is:

  • Ansible for host configuration.
  • GitHub Actions protected workflow for check/apply once implemented.
  • Docker Compose for backend application services.
  • Caddy for reverse proxy once DNS, TLS, firewall, and health checks are ready.
  • Static read-only status dashboard backed by sanitized JSON snapshots.
  • PostgreSQL failover only after backup, restore, access-control, and failover design is reviewed.

No backend service is considered deployed until the protected pipeline applies it and read-only verification confirms it.

Cloud-Init Provider Warning

Section titled “Cloud-Init Provider Warning”

Backend issue #9 verified that cloud-init status --long reports:

status: done
extended_status: degraded done
detail: DataSourceNoCloud [seed=/dev/sr0]
errors: []

The recoverable warnings are deprecated NoCloud seed keys for chpasswd.list, lists, and multiline chpasswd syntax. The backend repo does not currently own a cloud-init template, so this is treated as provider image/bootstrap hygiene rather than an app blocker.

The backend rebuild path is Ansible plus the protected backend apply workflow. If this repo later owns cloud-init templates, they must use non-deprecated users and chpasswd syntax.

Read-only verification:

Terminal window
ssh -i ~/.ssh/servercheap_65_75_201_18 rami@65.75.201.18 'cloud-init status --long 2>&1 || true'

Boundaries

Section titled “Boundaries”
  • Public app work stays in ramideltoro/nutsnews.
  • Existing production VPS/GitOps platform work stays in ramideltoro/nutsnews-infra.
  • Shared documentation stays here in ramideltoro/nutsnews-docs.
  • Backend server setup for 65.75.201.18 stays in ramideltoro/nutsnews-backend.

Validation

Section titled “Validation”

Backend scaffold validation used:

Terminal window
git diff --check
/tmp/nutsnews-backend-ansible-venv/bin/ansible-playbook ansible/playbooks/bootstrap.yml --syntax-check -i ansible/inventories/production/hosts.yml

The Ansible CLI was installed in a temporary local virtual environment for validation only.

Current Limitations

Section titled “Current Limitations”

The backend protected apply workflow, GitHub Environment, Environment secrets, Cloudflare access, backup credentials, Supabase credentials, database credentials, and dashboard access boundary are not yet available in the backend repo.

Issues that require server mutation or provider changes must remain open until those prerequisites exist and the protected apply path is approved.