Satis — Pipeline¶
The Satis index is kept up to date via a Bitbucket Pipeline that runs update-satis.sh on the production server whenever a change is pushed to the repository.
Pipeline configuration lives in bitbucket-pipelines.yml.
How the pipeline works¶
| Step | What happens |
|---|---|
| Trigger | Any push to the repository (default pipeline) |
| SSH setup | Creates .ssh/, decodes $PROD_SSH_KEY and writes it as id_rsa |
| Cloudflare Tunnel | cloudflared establishes a secure connection to the production server via Cloudflare Access using $CF_ACCESS_CLIENT_ID and $CF_ACCESS_CLIENT_SECRET |
| Remote execution | SSH into the server → navigate to $PROD_PROJECT_PATH → run ./update-satis.sh |
Required Bitbucket variables¶
These must be set as repository secrets in Bitbucket:
| Variable | Description |
|---|---|
PROD_SSH_KEY | Base64-encoded private key for the production server |
PROD_USER | SSH username on the production server |
PROD_SSH_URL | Hostname of the production server |
PROD_PROJECT_PATH | Path to the project root on the production server |
CF_ACCESS_CLIENT_ID | Cloudflare Access client ID |
CF_ACCESS_CLIENT_SECRET | Cloudflare Access client secret |