mealno.in | DevOps Guide

One-Time Setup

Do this exactly ONCE per computer to install Git, configure line endings, and attach your identity.

# 1. Set your identity
git config --global user.name "Your Name"
git config --global user.email "your-email@mealno.in"

# 2. Set default branch to main (not master)
git config --global init.defaultBranch main

# 3. Fix line endings (CRITICAL if team uses both Mac & Windows)
# If on Windows:
git config --global core.autocrlf true
# If on Mac/Linux:
git config --global core.autocrlf input

# 4. Verify your settings
git config --list

Start a New Project

Follow strictly in order when starting a blank local folder on your computer.

cd "C:/Users/Arnab/Desktop/MyWebsite"
git init

# Create a .gitignore file and add standard exclusions
echo "node_modules/" >> .gitignore
echo ".env" >> .gitignore
echo "dist/" >> .gitignore
echo "build/" >> .gitignore

# 1. Link the server (the "origin")
git remote add origin https://gitea.mealno.in/USERNAME/REPO.git
# 2. Stage and Commit files
git add .
git commit -m "Initial commit with .gitignore"
# 3. Push to server (-u sets the default upstream tracking)
git push -u origin main

The Daily Workflow

You will type these three commands dozens of times a week. Master this loop.

Syncing & Status

How to safely check your work and manage incoming changes from teammates.

Stashing: The "Pause Game" Button

You're halfway through coding a feature, but an urgent bug comes in. You can't commit broken code, but you need to switch tasks. Stash it.

# 1. Hide your current messy work in a temporary drawer
git stash -m "Half finished nav bar"
# (Your files revert to the last clean commit automatically)

# 2. ... fix the urgent bug, commit, push ...

# 3. Bring your messy work back out of the drawer
git stash pop

Branching & Teamwork

Never experiment on the live website. Use Branches.

Modern Branch Workflow (git switch)

Note: git switch is the modern, safer alternative to the older git checkout.

# 1. Create a new branch and switch to it (-c means create)
git switch -c feat/new-login-page

# 2. Do your normal work (add, commit)
git add .
git commit -m "Build new login UI"

# 3. Push this specific branch to the server
git push -u origin feat/new-login-page

Undoing Mistakes

Panic mode? Don't worry, Git is a time machine. Here is how to fix errors safely based on the exact situation.

# Discard changes to tracked files
git restore .
# Delete newly created (untracked) files/folders
git clean -fd

git reset --soft HEAD~1

# 1. Find the bad commit ID (e.g., a1b2c3d)
git log --oneline -n 5

# 2. Tell git to generate an inverse commit
git revert a1b2c3d

# 3. Push to fix the live site
git push origin main

🔐 Authentication & Tokens

💡 Hardcoding the Token (Private PC Only)

To stop typing the token every time you push, embed it in the URL. Never do this on a shared computer.

git remote set-url origin https://USERNAME:TOKEN_GOES_HERE@gitea.mealno.in/USERNAME/PROJECT.git

Clearing Stale Passwords

If Windows/Mac cached your old password and refuses to ask for the new Token, clear the cache:

# Windows: Open Start Menu -> "Credential Manager" -> "Windows Credentials" -> Delete the git entry.
# Mac: Open "Keychain Access" -> Search "git" -> Delete the entry.
# Universal Terminal fallback:
git credential-manager reject https://gitea.mealno.in

Deploying with Coolify

Coolify pulls code from Gitea, builds it into a Docker container, and puts it live on the internet.

Environment Variables (.env)

The only secure way to handle API keys, database passwords, and config.

Production Secrets (Coolify)

Since the live server doesn't have your local .env file, you must inject them via Coolify:

1. Open Project in Coolify -> Click Environment Variables tab.
2. Click + Add.
3. Key: DATABASE_URL | Value: postgres://...
4. Check "Is Build Env?" ONLY if it is a Build-Time variable (like React).
5. Check "Is Secret?" to hide it from UI logs.
6. Click Save -> Click Redeploy (required to bake them into the build).

Managing Coolify

DBs & Backups

App Architecture

How code travels from your laptop to the live domain, and how containers talk to each other.

Internal Container Networking

Containers running on the same server (like a Node API and a Postgres DB) do not need to route out to the public internet to talk to each other. They use the Internal Docker Network.

DNS & Ports

Server Hardening

Raw Linux servers are brute-forced by bots within minutes. Secure it immediately.

1. Disable Password SSH Login

Passwords can be brute-forced. SSH Keys cannot. Generate a key, add it to the server, and disable passwords entirely.

ssh-keygen -t ed25519 -C "admin@mealno.in"
# Copy the output key to the server's ~/.ssh/authorized_keys

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

sudo systemctl restart sshd

2. Uncomplicated Firewall (UFW)

Block all ports except the ones you explicitly need.

# CRITICAL: Allow SSH BEFORE enabling firewall
sudo ufw allow 22
# Allow Web Traffic
sudo ufw allow 80
sudo ufw allow 443
sudo ufw enable

3. Fail2Ban

A service that monitors logs. If an IP fails to login via SSH 5 times, it permanently bans that IP at the firewall level. Configured in /etc/fail2ban/jail.local.

Advanced Secrets

Manually copying `.env` files across a team of 10 developers leads to leaks.

External Secret Managers (Doppler)

Enterprise teams use centralized vaults like Doppler, HashiCorp Vault, or AWS Secrets Manager.

doppler run -- npm run dev

Secret Rotation

Database passwords and API keys should be changed (rotated) every 90 days. If an employee leaves, keys must be rotated immediately to revoke access.

Monitoring & Logs

Observability means knowing the internal state of your system just by looking at its outputs.

The 4 Golden Signals

docker run -d --restart=always -p 3001:3001 -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:1

# PromQL Example: Server 500 Errors
rate(http_requests_total{status="500"}[5m])

Centralized Logs (ELK/Loki)

Running docker logs is fine for 1 app. If you have 10 microservices, you need a central tool (like Grafana Loki) to search all logs simultaneously, retaining them for compliance.

Alerting Systems

Metrics are useless if nobody looks at them. Alerts wake you up when things break.

🚨 Emergency Playbook

Website down? Don't panic. Work through this checklist in order. Stop when you find the issue.