Deployment

Setup script

contrib/setup.sh provisions a Raspberry Pi and brings the stack up. It installs Docker and ufw, opens the firewall ports, optionally configures a 4G modem, and runs docker compose with the right profile.

Production deployment:

curl -s https://raw.githubusercontent.com/judahpaul16/canarygc/main/contrib/setup.sh | \
    bash -s --

Local testing against ArduPilot SITL:

curl -s https://raw.githubusercontent.com/judahpaul16/canarygc/main/contrib/setup.sh | \
    bash -s -- --simulation

Install without the system setup (Docker, firewall, networking):

curl -s https://raw.githubusercontent.com/judahpaul16/canarygc/main/contrib/setup.sh | \
    bash -s -- --install-only

Other flags: --setup-only runs the system setup without starting the stack, and --list-cameras lists attached cameras.

Compose profiles

The repo ships a single docker-compose.yml. The two deployment-relevant profiles are below; the development-px4, development-betaflight, and development-inav variants are covered in Development.

• production runs the built Node server (app), an nginx reverse proxy (nginx), and the WebRTC camera bridge (webrtc). nginx serves the app on port 80, so the station answers at its hostname; the app itself binds 3000, and the autopilot is reached over /dev/ttyACM0. A named volume holds the SQLite database across redeploys.
• development runs the Vite dev server (app-dev) and the ArduPilot SITL container (sitl). The app binds 5173; SITL exposes MAVLink on 5760.

The production app service pulls the published image, ghcr.io/judahpaul16/canarygc:latest, which CI builds for amd64 and arm64 on every release.

CI/CD

.github/workflows/ci.yml runs on push and pull request to main.

• check installs dependencies and runs npm run lint, npm run check, npm run build, and npm audit --audit-level=moderate.
• release runs on pushes to main. It walks the commits since the latest v[0-9]* tag and tags each at its cumulative version, then cuts a GitHub release per commit. The bump comes from the commit subject: patch by default, minor for [minor update], major for [major update]. [skip ci] skips the release.
• image builds a multi-arch image (linux/amd64, linux/arm64) from compose/svelte-kit/Dockerfile.prod and pushes it to Docker Hub and GHCR, tagged with the release version and latest.

The image build and push run automatically on every push to main.

Required secrets

Secret	Used by
DOCKERHUB_USERNAME, DOCKERHUB_PASSWORD	Docker Hub image push
RELEASE_PAT	Release job tag push and release creation. Needs a token with workflow scope, since the release tags commits that modify .github/workflows.
GITHUB_TOKEN	GHCR image push (provided by Actions)