fix(deploy): add canonical production compose.yml (VS-43) #66

Merged

David merged 1 commit from fix/VS-43-canonical-prod-compose into main

2026-06-21 16:34:07 +02:00

David commented

2026-06-21 15:36:34 +02:00

Owner

Summary

Fixes the production crash-loop [FATAL tini] exec meshcentral failed: No such file or directory (VS-43).

The repo and the published image are already correct. Source of truth on 2026-06-21:

git grep -i meshcentral on main: only the README acknowledgement line.
Registry dev.a8n.run/psa-systems-private/vervain-server:latest (built 01:48 UTC) has Entrypoint=["/sbin/tini","--"], Cmd=["vervain", ..., "run"].

The meshcentral string is coming from a deployment-side command:/entrypoint: override left over from the binary rename, running against the new vervain image. The host .env confirms it (RUST_LOG=info,meshcentral=debug,...). The enabling gap: no version-controlled production compose, so each host hand-maintained a deploy file that drifted across the rename.

Change

Add compose.yml (production) that pulls the published image and relies on the image's own ENTRYPOINT/CMD - no command:/entrypoint: override, so the binary name lives only in the Dockerfile and a future rename cannot break a running deployment.
Valid compose schema (docker compose -f compose.yml config passes); names follow the convention (vervain-server / vervain-data / vervain-private); agent-fetcher + secret are an optional commented block.
README points at compose.yml as the canonical production deploy.

Host remediation (the running server)

This PR does not change your host's compose file. To recover the live deployment:

Remove the stale command:/entrypoint: that names meshcentral (or adopt this compose.yml).
Refresh .env (meshcentral log targets to vervain).
docker compose pull && docker compose up -d --force-recreate.

Verification

docker compose -f compose.yml config validates; the resolved service has no command/entrypoint override (uses the image's vervain ... run). Pre-commit hook (fmt/clippy/full test suite) passed on commit.

🤖 Generated with Claude Code

## Summary Fixes the production crash-loop `[FATAL tini] exec meshcentral failed: No such file or directory` (VS-43). **The repo and the published image are already correct.** Source of truth on 2026-06-21: - `git grep -i meshcentral` on `main`: only the README acknowledgement line. - Registry `dev.a8n.run/psa-systems-private/vervain-server:latest` (built 01:48 UTC) has `Entrypoint=["/sbin/tini","--"]`, `Cmd=["vervain", ..., "run"]`. The `meshcentral` string is coming from a **deployment-side `command:`/`entrypoint:` override** left over from the binary rename, running against the new `vervain` image. The host `.env` confirms it (`RUST_LOG=info,meshcentral=debug,...`). The enabling gap: no version-controlled production compose, so each host hand-maintained a deploy file that drifted across the rename. ## Change - Add `compose.yml` (production) that pulls the published image and relies on the image's own `ENTRYPOINT`/`CMD` - **no `command:`/`entrypoint:` override**, so the binary name lives only in the Dockerfile and a future rename cannot break a running deployment. - Valid compose schema (`docker compose -f compose.yml config` passes); names follow the convention (`vervain-server` / `vervain-data` / `vervain-private`); agent-fetcher + secret are an optional commented block. - README points at `compose.yml` as the canonical production deploy. ## Host remediation (the running server) This PR does not change your host's compose file. To recover the live deployment: 1. Remove the stale `command:`/`entrypoint:` that names `meshcentral` (or adopt this `compose.yml`). 2. Refresh `.env` (`meshcentral` log targets to `vervain`). 3. `docker compose pull && docker compose up -d --force-recreate`. ## Verification `docker compose -f compose.yml config` validates; the resolved service has no command/entrypoint override (uses the image's `vervain ... run`). Pre-commit hook (fmt/clippy/full test suite) passed on commit. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

David added 1 commit

2026-06-21 15:36:34 +02:00

fix(deploy): add canonical production compose.yml

Check / fmt + clippy + build + tests (pull_request) Successful in 5m12s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

94b8400649

Deployed vervain-server containers crash-loop with "exec meshcentral failed: No such file or directory". The repo and the published image are correct (image Cmd is `vervain ... run`); the stale `meshcentral` comes from a deployment-side `command:`/`entrypoint:` override left over from the MeshCentral to Vervain binary rename, running against the new image.

The enabling gap was that no production compose file was version-controlled (only compose.dev.yml), so each host hand-maintained a deploy file that drifted across the rename.

Add compose.yml at the repo root that pulls the published image and relies on the image's own ENTRYPOINT/CMD with no command/entrypoint override, so the binary name lives only in the Dockerfile and a future rename cannot break a running deployment. Names follow the convention (service vervain-server, volume vervain-data, network vervain-private); the agent-binary fetcher and its secret are an optional commented block. Validated with `docker compose -f compose.yml config`. README points at it as the canonical production deploy.

Host remediation for the currently-broken deployment: remove the stale `command:`/`entrypoint:` naming meshcentral, refresh `.env`, then `docker compose pull && docker compose up -d --force-recreate`.

#VS-43

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>