GitOps for my edge VPS
My cluster is GitOps’d end to end: I merge to main and ArgoCD picks it up. My edge VPS didn’t have this. It runs the public-facing stack (Caddy, Authelia, CrowdSec) on Docker Compose. So updating it meant SSHing in to scp a config and docker compose up by hand. I wanted the same there.
The loop
A systemd timer runs a reconcile script every ~15 minutes. It basically does git fetch + reset --hard origin/main, rsyncs an allowlist of tracked files into /opt/<svc>/, and then, for services whose files actually changed, runs docker compose pull && up -d. Renovate runs as a Forgejo Action and opens the image-bump PRs.
The allowlist
The sync uses an explicit allowlist: only files named in the map are written. Secrets, .env files, etc. are not in there. Deleting a file from git does not delete it from the box currently.
Compiling Caddy
Caddy required some more work, because it has to be compiled. It’s not a container here but a custom xcaddy build with the Layer 4 and CrowdSec modules compiled.
The reconcile there compares the running binary’s module versions against the pinned versions in BUILD.txt, and on a diff it rebuilds Caddy inside a golang container, runs caddy validate on the candidate against the live Caddyfile, swaps /usr/bin/caddy, and restarts, keeping a .bak, and rolling back if Caddy doesn’t come back up. A merged Renovate bump to BUILD.txt then rebuilds and redeploys itself.
What stays manual
Not everything auto-applies on the VPS. The Caddyfile itself, the systemd units, and the reconcile’s own timer/service are excluded. I’m still a little afraid that updating those could cause downtime.