Deployment

Compose files

File	Use
docker-compose.yaml	Local development: PostgreSQL and backend; run the frontend separately with npm run dev.
docker-compose.prod.yml	NAS deployment: published GHCR backend and frontend images behind Traefik.

The production Compose file expects the NAS Docker networks and environment files to exist. It runs database migrations from the backend container entrypoint before starting the service. Back up the database before deploying schema-changing versions.

GHCR image publishing

The workflow .github/workflows/docker-publish.yml builds independent images from backend/Dockerfile and frontend/Dockerfile:

• ghcr.io/berufskolleg-meschede/meschede-backend
• ghcr.io/berufskolleg-meschede/meschede-frontend

Images are published on pushes to main, pushes of valid vMAJOR.MINOR.PATCH tags (optional prerelease suffix), and published GitHub Releases with a v tag. Pull requests do not publish images. Maintainers can also manually run the workflow from main with an existing release_tag; the workflow checks out that tag's source.

Each publishing run tags both images with latest, sha-<7 character commit>, and, when a release tag is supplied, the release tag. GitHub Release assets do not need to contain container archives: GHCR is the registry used by the NAS to pull the images.

Pin a version on the NAS

Set this in the environment file used by docker-compose.prod.yml:

MES_IMAGE_TAG=v0.2.1

Then pull and recreate the services:

docker compose -f docker-compose.prod.yml pull
docker compose -f docker-compose.prod.yml up -d

Check the GitHub Actions run for both image build jobs and confirm the requested tag exists in the two GHCR packages before deploying. To roll forward or back, change MES_IMAGE_TAG and repeat the pull/up commands.

See Configuration for secrets, network targets, and environment files. Do not commit production secrets.