From 8fb8d507a41d41c1826d740ddd8a69762a87a16b Mon Sep 17 00:00:00 2001
From: Bartal Laearsson <bartal@flo.fo>
Date: Wed, 19 Aug 2026 10:39:38 +0100
Subject: [PATCH] deployment files

---
 .gitignore   |  1 +
 Cargo.lock   |  2 +-
 Cargo.toml   |  2 +-
 Taskfile.yml | 85 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 docs/TODO.md | 15 +++++-----
 5 files changed, 95 insertions(+), 10 deletions(-)
 create mode 100644 Taskfile.yml

diff --git a/.gitignore b/.gitignore
index 417367c..55df204 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 /target
 *.db*
+*.log*
diff --git a/Cargo.lock b/Cargo.lock
index fa3250b..ffa1cd5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -868,7 +868,7 @@ dependencies = [
 ]
 
 [[package]]
-name = "hagfish"
+name = "hagfisk"
 version = "0.0.5"
 dependencies = [
  "anyhow",
diff --git a/Cargo.toml b/Cargo.toml
index cb25060..68bf6bb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,5 +1,5 @@
 [package]
-name = "hagfish"
+name = "hagfisk"
 version = "0.0.5"
 edition = "2024"
 description = "Faroese fisheries data pipeline and dashboard"
diff --git a/Taskfile.yml b/Taskfile.yml
new file mode 100644
index 0000000..5392bd3
--- /dev/null
+++ b/Taskfile.yml
@@ -0,0 +1,85 @@
+version: '3'
+
+env:
+  HOST: bl@flo-homeserver
+  HAGFISK_DIR: ~/hagfisk
+  SERVICE_DIR: ~/.config/systemd/user
+
+tasks:
+  build:
+    desc: Build binary locally
+    cmds:
+      - echo "Building hagfisk binary..."
+      - cargo build --release
+
+  deploy:
+    desc: Sync binary to server
+    deps: [build]
+    cmds:
+      - ssh -q {{.HOST}} "rm -rf {{.HAGFISK_DIR}}/hagfisk"
+      - echo "Syncing binary to remote..."
+      - rsync -avz --progress ./target/release/hagfisk {{.HOST}}:{{.HAGFISK_DIR}}/hagfisk
+      - echo "Restoring SELinux contexts..."
+      - ssh -t -q {{.HOST}} "sudo restorecon -RF {{.HAGFISK_DIR}}"
+      - ssh -q {{.HOST}} "systemctl --user daemon-reload"
+      - ssh -q {{.HOST}} "systemctl --user restart hagfisk.service"
+
+  enable-now-app:
+    desc: Enable now service
+    cmds:
+      - ssh {{.HOST}} "systemctl --user enable --now hagfisk.service"
+
+  start-app:
+    desc: Start service on remote
+    cmds:
+      - ssh {{.HOST}} "systemctl --user start hagfisk.service"
+
+  stop-app:
+    desc: Stop service on remote
+    cmds:
+      - ssh {{.HOST}} "systemctl --user stop hagfisk.service"
+
+  restart-app:
+    desc: Restart service on remote
+    cmds:
+      - ssh {{.HOST}} "systemctl --user restart hagfisk.service"
+
+  logs-app:
+    desc: Stream logs from remote
+    cmds:
+      - ssh {{.HOST}} "journalctl --user -u hagfisk -f"
+
+  ps-app:
+    desc: Show status of hagfisk
+    cmds:
+      - ssh {{.HOST}} "systemctl --user status hagfisk.service"
+
+  enable-now-ingest:
+    desc: Enable now service
+    cmds:
+      - ssh {{.HOST}} "systemctl --user enable --now hagfisk-ingest.service hagfisk-ingest.timer"
+
+  start-ingest:
+    desc: Start service on remote
+    cmds:
+      - ssh {{.HOST}} "systemctl --user start hagfisk-ingest.service hagfisk-ingest.timer"
+
+  stop-ingest:
+    desc: Stop service on remote
+    cmds:
+      - ssh {{.HOST}} "systemctl --user stop hagfisk-ingest.service hagfisk-ingest.timer"
+
+  restart-ingest:
+    desc: Restart service on remote
+    cmds:
+      - ssh {{.HOST}} "systemctl --user restart hagfisk-ingest.service hagfisk-ingest.timer"
+
+  logs-ingest:
+    desc: Stream logs from remote
+    cmds:
+      - ssh {{.HOST}} "journalctl --user -u hagfisk-ingest -f"
+
+  ps-ingest:
+    desc: Show status of hagfisk
+    cmds:
+      - ssh {{.HOST}} "systemctl --user status hagfisk-ingest.service"
diff --git a/docs/TODO.md b/docs/TODO.md
index dbb8743..1045626 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -93,7 +93,6 @@ hagfish/
 - [ ] 🔒 CORS hardening — Replace `CorsLayer::permissive()` with explicit allowed origins before production deployment
 - [ ] 🔒 Rate limiting — Optional: add `tower_governor` middleware to prevent abuse on public deployments
 - [ ] ⚠️ Startup config validation — Verify `data_source_url` is reachable, `duckdb_path` is writable before accepting connections
-- [ ] 📊 Metrics export (Prometheus) — Optional: track request counts, latencies, error rates via `prometheus` crate
 
 ### Phase 4: Frontend
 
@@ -115,17 +114,17 @@ hagfish/
 
 ### Phase 6: Bare Metal Deployment
 
-- [ ] 6.1 Write systemd service unit file (hagfish.service) — ExecStart=/usr/local/bin/hagfish serve, restart policy
-- [ ] 6.2 Write systemd timer (hagfish-ingest.timer + hagfish-ingest.service) — monthly, runs hagfish ingest
-- [ ] 6.3 Taskfile: build (release, static), deploy (rsync binary + config + units, ssh reload)
+- [x] 6.1 Write systemd service unit file (hagfish.service) — ExecStart=/usr/local/bin/hagfish serve, restart policy
+- [x] 6.2 Write systemd timer (hagfish-ingest.timer + hagfish-ingest.service) — monthly, runs hagfish ingest
+- [x] 6.3 Taskfile: build (release, static), deploy (rsync binary + config + units, ssh reload)
 - [ ] 6.4 README with ELI5 Technology Choices section (why DuckDB, why Rust, why embedded static assets)
 
+### Phase 7: post deploy fixes
+
+
 ---
 
 ## Current Status
 
-**Phase 1**: Complete ✅  
-**Phase 2**: Complete ✅  
-**Phase 3**: Complete ✅ (API operational, tests passing)  
+**Bug Fixes**: Next up
 **Production Hardening**: Deferred ⏸️  
-**Phase 4-6**: Pending — Start after MVP validation