---
description: Backend production deploy must use git push then git pull on the API VM — never rsync/scp as the primary deploy path.
alwaysApply: true
---

# Backend deploy (git only)

When deploying the Meshkee CMS API to production (`api.meshkee.com` / VM `/opt/meshkee/app`):

1. **Commit** the changes (only when the user asked to commit/deploy).
2. **Push** to `origin` (`https://git.meshkee.com/Meshkee/backend.git`, usually `main`).
3. **On the API VM**, update from git and rebuild — do **not** rsync/scp the app tree as the normal deploy path.

```bash
ssh -i ~/.ssh/id_ed25519 root@185.164.72.119 'bash -s' <<'REMOTE'
set -euo pipefail
cd /opt/meshkee/app
git fetch origin
git reset --hard origin/main
./database/migrate.sh
npm ci
npm run prisma:generate
npm run build
pm2 restart meshkee-api
REMOTE
```

## Hard rules

- Never use `rsync`/`scp` of the full project as the default deploy once the VM has a working git remote.
- Preserve the server `.env` (never overwrite it from the laptop).
- Exclude: do not commit `.env`, secrets, `node_modules`, or `dist`.
- If `git pull` fails (missing deploy key / auth), fix git access on the VM — do not silently fall back to rsync unless the user explicitly allows an emergency sync.

## VM git access

Deploy key (read-only) on `git.meshkee.com` for repo `Meshkee/backend`, installed as `/root/.ssh/id_ed25519` on the API VM. Remote should be SSH: `git@git.meshkee.com:Meshkee/backend.git`.