Deployment Guides

Codex runs as a small CLI on your machine. Install it with your package manager of choice, then confirm the version.

npm install -g @openai/codex
codex --version

From the repository root, start a session and ask Codex to build out the deployment. Describe the target platform and let it work through the manifest.

cd ~/projects/api
codex "Plan a production deployment for this service and write it up."

Once the plan looks right, tell Codex to execute it. It will install dependencies, run the build, and push the artifact.

codex -C "Review the plan, fix anything unsafe, then deploy."

After the deploy finishes, check the health endpoint and the logs to confirm traffic is flowing to the new revision.

curl -f https://api.example.com/health
codex "Summarize the last deploy from the platform logs."

A homeline starts with a machine that stays on. A small NUC, a Raspberry Pi, or an old tower all work. Install a server OS with SSH enabled.

ssh homelab@192.168.1.10
sudo apt update && sudo apt upgrade -y

Give the box a static lease in your router so the line never moves. If you run services in containers, pin Docker to that network.

version: "3.9"
services:
  web:
    image: nginx:alpine
    ports:
      - "8080:80"
    restart: unless-stopped

Rather than port-forwarding and exposing IPs, attach the box to a private overlay (next section) and reach it by a stable name. Keep SSH key-only and drop password auth.

sudo nano /etc/ssh/sshd_config
# set:
#   PasswordAuthentication no
#   PermitRootLogin no
sudo systemctl restart ssh

Reach the service by its hostname from another device on the same network before moving on to remote access.

curl -I http://homelab:8080
ping homelab.local

Create a VM or blade with your provider's API. Choose a region close to your users and attach a public address and a boot disk.

provider create \
  --name dc01 \
  --region us-west \
  --plan standard-2 \
  --disk 40GB

Start with a deny-by-default policy. Open only the ports your services need, and prefer the overlay for admin access.

firewall set dc01 \
  --allow 80/tcp \
  --allow 443/tcp \
  --deny all

Bootstrap Docker and a reverse proxy, then run your service behind it. Keep the proxy as the single public entry point.

docker pull nginx
docker run --name proxy -d -p 80:80 -p 443:443 nginx
systemctl enable --now docker

Create an A record to the node's public address and issue TLS. Confirm with a header check and the health route.

# record: app.example.com A 203.0.113.42
acme issue --domain app.example.com
curl -I https://app.example.com

Reboot the box once and confirm services come back automatically. A boot script or a container restart policy saves you a late-night call.

reboot
sleep 30
curl -f https://app.example.com/health

Tailscale connects every machine into one private WireGuard-style mesh. Install the agent on each host, then authenticate.

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Once devices are logged into the same tailnet they can address each other by name, no port forwarding involved. Check the status page.

tailscale status
# dc01     - 100.64.0.3   linux
# homelab  - 100.64.0.9   linux

Use a funnel or serve to publish a port to the tailnet (or the public web) without touching your router's config.

sudo tailscale serve --bg --https=443 8080
curl https://dc01.tailnet.ts.net

Define an ACL so only certain users and tags can reach the service. Keep the mesh on a need-to-touch basis.

"acls": [
  { "action": "accept", "src": ["tag:ops"], "dst": ["tag:svc:*"] }
]

Enable the agent service so the node rejoins the tailnet after any reboot, which keeps remote admin reachable.

sudo systemctl enable --now tailscaled
sudo reboot