iw4L/docs/DEPLOY.md

Shipping a release

make setup-windows
make release                    # local build and packaging; VPS untouched
make publish [NAME...]          # upload the prepared package
make deploy [NAME...]           # release + publish that exact package
make github-release TAG=v0.1.0-demo.N NOTES=notes.md
make logs NAME SINCE=2h

Servers are the root's descriptors

The root folder (IW4L_GAMES) is the folder the game reads. Every .iw4l-server file in it is a server, and NAME is its file name without the extension. Address, TLS name, update URL and CA are read from that file. Each release ships every one of them byte for byte, so editing or adding a descriptor and running make deploy is how players receive a new address, name or server. Descriptors and the addresses in them stay outside the repository; make publish-check refuses a tracked .iw4l-server file or a public IPv4 literal.

cargo xtask master install creates a master and writes its descriptor into the root (see MASTER.md). Publishing reaches root@<host> from the descriptor's address and uses the systemd unit whose serve --bind listens on its port. HTTPS serves /updates/manifest.toml independently of the QUIC protocol and ALPN.

Packages

make release builds the Windows executable and the static master once, then writes dist/releases/<id>/: deployment.json, client/ and server/, iw4l-windows-community.zip with every descriptor, the public iw4l-windows.zip without them, and an unencrypted iw4l-server-release-<id>.zip for hosting panels:

server/
├── iw4l-master
└── updates/
    ├── manifest.toml
    └── iw4l-<executable-sha256>.exe.zst

A panel install keeps its certificate/key beside the binary and starts ./iw4l-master serve --bind 0.0.0.0:4433 --cert server-cert.pem --key server-key.pem --updates updates.

Publishing

publish takes RELEASE= or dist/releases/LATEST, and publishes to the descriptors inside that package: all of them, or the named ones. Every server must answer over ssh and have a unit before anything uploads. The unit's ExecStart names the binary, its directory (which holds masters/<sha>/, archived manifests/ and staging), the certificate directory and the served updates directory. Publish refuses a server whose installed CA differs from its descriptor's.

Uploads are inventoried by sha256 and staged, then promoted. The master is replaced and restarted only when its hash changed, and the previous binary is restored if the new one does not report the release protocol. The manifest is switched last; the one it replaces is kept as manifests/replaced-<sha>.toml. Then the manifest and the full blob are fetched over HTTPS from the descriptor's address under its TLS name and CA; a mismatch puts the previous manifest back.

Servers are published one after another, each to completion. A failure prints the exact make publish … RELEASE=… line for the servers that remain; rerunning skips files already in place and leaves an unchanged master running.

GitHub

make github-release takes the package (RELEASE= or LATEST), requires a clean build whose commit is origin/master, uploads iw4l-windows.zip to a draft pre-release on that commit, compares GitHub's asset digest with the local file, then makes it public. Rerunning resumes a draft.

Public releases are pre-releases tagged v0.1.0-demo.N. Notes identify the commit, actually exercised platforms, scenario and limitations. Player archives carry the executable, whose legal notices are embedded; never game data or private keys.

The player starts the single iw4l.exe; its HTTPS check precedes QUIC, so a breaking protocol update remains downloadable. See WINDOWS.md.