Beta server infrastructure

The new server runs on three Oracle Cloud VMs in Amsterdam (eu-amsterdam-1, compartment sailever), built with OpenTofu from infra/oci/. The app VM sailever-beta (public subnet, only ports 80 and 443 open) runs kamal-proxy with Let's Encrypt and the Rails container for beta.sailever.com (website: sign-in, logbook, pairing page) and api.sailever.com (watch API). The DB VM sailever-db sits in a private subnet without a public IP: Postgres 16 with its data on a 50 GB block volume, reachable only from the app servers on 5432, over TLS that Rails checks (sslmode=verify-full against a private CA made by tofu). Uploaded files are in the OCI Object Storage bucket sailever-files; a nightly encrypted pg_dump goes to sailever-backups; mail goes out through OCI Email Delivery. The worker VM sailever-worker (private subnet, no inbound port, 2 OCPU / 12 GB) runs all background jobs: the Rails jobs role (Solid Queue, uploads first; the app VM keeps one fallback thread for them) and, at the lowest priority, the tile builds (depth layer and monthly basemap), which upload to R2. The move of the Rails jobs and the basemap build to the worker VM is in code, not deployed yet (ADR 011). Map tiles (with the depth layer) and the email logo come from Cloudflare R2, served on tiles.sailever.com (a Worker) and assets.sailever.com. SSH reaches each VM only through its own Cloudflare Tunnel behind Cloudflare Access (ssh / ssh-db / ssh-worker.sailever.com), for the owner (One-time PIN) and the deploy service token. www.sailever.com stays on the old Hetzner server until launch.

Status 2026-10-23: live since the first deploy on 2026-10-17; the worker VM since 2026-10-22, building the depth layer v2; WatchApp 1.1.0 on Garmin and Wear OS pairs and uploads from real watches (closed beta: only invited accounts can sign in). Two kinds of change: the app is deployed by GitHub Actions (Run workflow on main); infrastructure changes only by tofu on the owner's Mac.

Pick a view below. Every box is a button: click it (or Tab to it and press Enter) to see what it is, where it lives, which file defines it, its status and who can reach it. Related items in the panel jump to their box, in another view if needed.

• Live 99
• In code, not applied yet 2
• Later: step 3.11 3
• Dropped 2
• Old site, until launch 2

Next

Still open in docs/plans/beta_server_next_steps.md:

1. Watch releases (5.6, 6.5): Garmin 1.1.0 store beta, Wear OS to Play internal testing and review; then the end-to-end check 6.3 on both watches.
2. Pairing redirect (5.2): sailever.com/pair reaches beta through the apex 301 to www and the old app's 302; the planned Cloudflare 302 rule is not active. At launch the new app on www serves /pair itself.
3. Jobs on the worker VM (ADR 011): tofu apply (NSG rule db_postgres_worker), infra/oci/db-allow-worker.sh once on the DB VM, then the server deploy (role jobs) and the Worker deploy (basemap build).
4. Launch (7.3): www moves to the new server, SAILEVER_BETA=false, beta → www 301, both /pair redirects to www, old app archived; then the beta applications go.
5. Cleanup: 7.1 (old history backup), old Cloudflare token and the leaked age key (docs/credentials.md §8). Later (3.11): load balancer, second app server.