| 1 | # CNB Deploy Templates |
| 2 | |
| 3 | The root `.cnb.yml` is intentionally source-controlled in GitHub because CNB is |
| 4 | a one-way mirror from GitHub. Do not add or edit `.cnb.yml` only on the CNB |
| 5 | side; the next GitHub sync will overwrite it. |
| 6 | |
| 7 | The active root `.cnb.yml` does two things: |
| 8 | |
| 9 | - runs Feishu bridge and version-drift checks when CNB receives `main`; |
| 10 | - builds Linux x64 release assets from `v*` tags, creates the CNB release, and |
| 11 | uploads `codewhale-linux-x64`, `codewhale-tui-linux-x64`, and |
| 12 | `deepseek-artifacts-sha256.txt`. |
| 13 | |
| 14 | The files in this directory are retained as deploy-button templates for Tencent |
| 15 | Lighthouse. Copy only the deploy environment file after the Lighthouse instance |
| 16 | is already working manually: |
| 17 | |
| 18 | ```bash |
| 19 | mkdir -p .cnb |
| 20 | cp deploy/tencent-lighthouse/cnb/tag_deploy.yml.example .cnb/tag_deploy.yml |
| 21 | ``` |
| 22 | |
| 23 | If you also need to customize `.cnb.yml`, edit the root file in GitHub and let |
| 24 | the one-way mirror carry it to CNB. |
| 25 | |
| 26 | ## Required CNB Secrets |
| 27 | |
| 28 | Configure these as protected CNB environment variables or secrets: |
| 29 | |
| 30 | - `LIGHTHOUSE_HOST`: public IP or DNS name of the Lighthouse instance |
| 31 | - `LIGHTHOUSE_SSH_TARGET`: SSH target, for example `ubuntu@203.0.113.10` |
| 32 | - `LIGHTHOUSE_SSH_PRIVATE_KEY`: private deploy key allowed to update the server |
| 33 | - `CODEWHALE_REPO_BRANCH`: branch or tag to deploy, for example `main` |
| 34 | |
| 35 | Optional: |
| 36 | |
| 37 | - `CODEWHALE_REPO_URL`: defaults to the CNB mirror URL |
| 38 | - `LIGHTHOUSE_SSH_PORT`: defaults to `22` |
| 39 | |
| 40 | The server side should already have the runtime checkout, environment files, |
| 41 | and systemd services installed by the maintainer-owned server setup process. |
| 42 | |
| 43 | ## Safety Notes |
| 44 | |
| 45 | - Do not store Feishu App Secret or provider API keys in CNB. They belong in |
| 46 | `/etc/codewhale/*.env` on Lighthouse. |
| 47 | - Do not expose `127.0.0.1:7878` through EdgeOne, a security group, or a public |
| 48 | reverse proxy. |
| 49 | - Start with a manual deploy button. Automatic deploy on every `main` push is |
| 50 | convenient later, but it can consume CNB quota and restart the phone bridge |
| 51 | while a turn is active. |
| 52 |