# Buzz VPS production override

This directory contains the local production adjustment for the official
[Block Buzz repository](https://github.com/block/buzz). It is intentionally
kept separate from the upstream Compose bundle in `../compose/`.

## Relay image

The deployment is pinned to Buzz Relay 0.2.1 and its immutable multi-architecture
manifest:

```text
ghcr.io/block/buzz:0.2.1@sha256:4e31b7c7abb7d00b6f513dc559e58d2b980416f1dc400aa01bcf762cf2989cfc
```

## Target architecture

```text
Nginx -> 127.0.0.1:5005 -> Buzz Relay :3000
```

Only the Relay is published on the host, and only on the loopback interface.
PostgreSQL, Redis, and MinIO remain internal to the isolated `buzz-net` Compose
network. This override does not use `struktur-net`, Caddy, or the development
Compose file and has no dependency on Hermes VPS.

## Git volume initialization

The Relay image runs as non-root UID/GID 1000. A fresh Docker named volume can
otherwise leave `/data/git` owned by root and prevent creation of
`/data/git/.pack-cache`. The one-shot `git-volume-init` service mounts the same
`buzz-git-data` volume, creates the cache directory, recursively sets ownership
to `1000:1000`, and must finish successfully before the Relay starts. The Relay
itself continues to run as its non-root image user.

## Environment and secrets

Copy `.env.example.local` to `.env` in this directory before the first start and
replace every placeholder with a real, stable value. The real `.env` must never
be committed to Git. No real secrets are stored in this repository template.

The public domain is `buzz.agentsolutions-mallorca.com`. Its HTTPS origin and
both supported Tauri origins are included in the CORS example.

## Backups

The named volumes for PostgreSQL, Redis, MinIO, and Git are not part of a normal
source-tree backup. They must be included explicitly in the future backup and
restore design. Preserve the environment secrets together with consistent
PostgreSQL, object-storage, and Git-volume snapshots.