orchestra/deploy/DEPLOYMENT.md

Deployment verification

Both binaries embed their Git revision, UTC build time, and dirty flag. Build the coordinator with deploy/redeploy.sh; it installs and restarts the local orchestra.service.

Browser operator login

The browser UI requires ORCHESTRA_WEB_USERNAME and ORCHESTRA_WEB_PASSWORD_HASH. Generate a bcrypt hash without putting the password in shell history:

go run ./cmd/orchestra-password

Set the emitted hash in the service environment along with the chosen username, then restart the coordinator. ORCHESTRA_WEB_TOKEN is not used by the browser UI anymore.

Build a worker for staging on workpc with:

revision=$(git rev-parse HEAD)
build_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)
dirty=false; test -z "$(git status --porcelain)" || dirty=true
go build -ldflags "-X orchestra/internal/buildinfo.Revision=$revision -X orchestra/internal/buildinfo.Time=$build_time -X orchestra/internal/buildinfo.Dirty=$dirty" -o orchestra-worker ./cmd/orchestra-worker
scp orchestra-worker workpc:~/orchestra-deploy/orchestra-worker
ssh workpc 'sha256sum ~/orchestra-deploy/orchestra-worker'

The worker receives only the path to a normal project configuration file: ORCHESTRA_WORKER_PROJECT_CONFIG_FILE=/etc/orchestra/worker-projects.json. That file contains a JSON object whose project entries contain repo, worktree_root, and remote; mount or provision it like any other worker configuration. The legacy single-checkout ORCHESTRA_WORKER_PROJECTS comma list remains supported for one existing checkout. An absent project is ineligible for routing.

Verify the coordinator at GET /v1/admin/diagnostics with the normal admin credential: its build object is the coordinator provenance. GET /v1/federation/workers shows every worker's build, supported projects, and worker-local health without SSH.