[im-tyler]

What

Decision D4 of the P3 plan (CLI side): Teploy-home apps can build from a
git repository — GitHub, GitLab, Forgejo/Gitea, Cursor Origin, or any git
host over SSH/HTTPS — with one server-side admitter.

• Config: git: {repository, branch, paths, poll, submodules} (Teploy
  home only; folder loader refuses it). With git: set, image: becomes
  optional (and setting both is refused). context:/dockerfile: are
  relative to the repo root. build_secrets: [KEY] passes age-store values
  as docker build --secret — never in config, layers, argv or logs.
• Credentials (teploy config source key --app … --host … [--type ssh|token]): ed25519 deploy key generated on the server (public
  half printed, private half age-encrypted outside /deployments at
  /etc/teploy/apps/<app> as root, ~/.config/teploy/apps otherwise), or
  an HTTPS token read from stdin (used via GIT_ASKPASS, never in
  URLs/.git/config/argv). config source host-key pins the forge's SSH
  host key (ssh-keyscan server-side, fingerprints shown,
  --expected-fingerprint verification); fetches run
  StrictHostKeyChecking=yes against it. The age identity is tried at
  /etc/teploy/age-key then /deployments/.age-key (aligns with W2's
  move). config source show --json (no secrets) and remove.
• Build path: per-app bare mirror
  (/deployments/.teploy/apps/<app>/mirror.git, code only) → fetch with
  the app credential → git archive <commit> into the attempt build dir →
  existing builder. Watermark refs keep ancestry-checkable commits
  reachable across force-pushes. Submodules off: .gitmodules present →
  explicit error (submodules: true refused at validation).
• One admitter (teploy trigger poll --app X --host S [--now] [--hint <sha>], --all for the timer): fenced app lock; ls-remote with
  the credential; hint only wakes (remote head wins); dedup by
  (app, ref, commit); per-(app,ref) watermark + ancestry check on the
  mirror; force-push → ONE recorded refusal per (ref, head), refused until
  teploy trigger reset --app X --ref R; changed paths computed on the
  server (git diff --name-only) filtered by git.paths defaulting to
  context:; failed commit retried at most 2×, then only a new commit,
  teploy trigger retry, or a redeploy; superseding always deploys the
  newest admitted head. Records under
  /deployments/.teploy/apps/<app>/admissions/ (flock), events
  trigger.admit/trigger.refuse with {ref, commit, reason}.
  --json → {app, ref, head, admitted, reason?, deployed_release?}.
• Timer: teploy trigger install-timer --host S installs an
  idempotent systemd pair running /deployments/.bin/teploy trigger poll --all every minute (per-app intervals honored via admissions
  timestamps); offered after config source key (best-effort);
  doctor gains a git-trigger check (timer present, resident binary
  supports trigger poll). Nothing per-app in crontab.
• Deploy from config: teploy deploy --app X with git: builds the
  branch head from the mirror under the lock, records the commit as
  source_revision (release provenance + deploy event), honors the same
  force-push refusal, and advances the watermark.
• Tokens git-source-v1, trigger-poll-v1; contracts corpus rev 14
  (source-show-envelope, source-key-envelope, trigger-poll-envelope,
  regenerated version-handshake); events: trigger.admit reason detail,
  new source.connect kind.

Deliberate deviations (documented in README/CHANGELOG): static
Teploy-home apps with git: stay refused; git.submodules: true is
refused pending implementation; file:// repositories are accepted as a
privileged config change (same-server sources; also what the tests
use); image: + git: together is refused rather than choosing one.

Testing

• go vet ./..., go test -race ./... green locally.
• New integration tests drive the real server-side helper over a
  LocalExecutor against local bare-repo fixtures: poll admit/dedup,
  supersede + stale hint, interval/poll: off, force-push refusal +
  reset, path filter, retry budget + retry, repository change,
  branch loss, manual-deploy watermark, path matcher, config/confighome
  validation, build --secret command shape, doctor check, contracts
  goldens.
• Live check on infra-home with the w4probe throwaway app (cleaned up
  after): ssh deploy-key generation, host-key pin, poll admit + deploy
  (whoami image), second commit poll, force-push refusal + reset, path
  filter, timer install/uninstall.

🤖 Generated with Claude Code