bunfork
Documentation menu

Deploy & recover

A release should be identifiable, replaceable, and recoverable. Bunfork builds a local owned bundle and keeps runtime state outside it.

Create a native release

./target/release/bunfork deploy

./bunfork-dist/bunfork \
  --database "$HOME/.local/share/bunfork/bunfork.db" \
  --key-file "$HOME/.config/bunfork/db.key" \
  serve --token-file "$HOME/.config/bunfork/api.token"

deploy takes a project lock, runs tests, release-builds, stages, hashes, fsyncs, and atomically installs bunfork-dist. Its bunfork.json inventory owns every bundled file except the manifest itself.

Runtime database, key, and token paths are intentionally not bundled. Keep immutable release files under $HOME/.local/lib/bunfork, mutable data under $HOME/.local/share/bunfork, and secrets under $HOME/.config/bunfork.

Bundle an admitted static site

./target/release/bunfork deploy \
  --artifact frontend/out \
  --static-manifest bunfork-static.json

The static bundle contains the Bunfork binary, admitted site, strict artifact manifest, deployment inventory, and service units. It runs from any working directory and needs no data secrets.

./bunfork-dist/bunfork serve \
  --static ./bunfork-dist/site \
  --manifest ./bunfork-dist/bunfork-static.json

Replace only what Bunfork owns

If the output already exists, --force first validates its complete inventory and binary. Modified or unowned directories are refused. A verified previous release is preserved as a sibling and is never automatically deleted.

Hardened user services

The bundle includes native and static systemd user units configured for 0.0.0.0:3100. They set a restrictive umask and enable filesystem/process controls including NoNewPrivileges, ProtectSystem=strict, an empty capability set, and restricted address families.

Bunfork copies the units; the operator still installs/enables them and configures the host firewall and TLS proxy.

Backup and restore

  1. Create an explicit backup

    ./target/release/bunfork backup \
  --out backups/pre-release.db

    The destination must not already exist. Publication is synced and the encrypted schema is reopened and verified.

  2. Stop the server before restore

    systemctl --user stop bunfork.service

    Bunfork has no distributed or online-restore lock. Quiesce every writer first.

  3. Restore with acknowledgement

    ./target/release/bunfork restore \
  backups/pre-release.db --yes

    The backup is verified, installed atomically, and the prior live database is retained with a timestamped name.

Deployment boundary

Bunfork creates and validates local release directories. It does not provision machines, transfer releases, configure DNS or TLS, manage remote backup storage, or remove retained releases. Those stay explicit operator responsibilities.