Harden immutable release deployment

deploy/unraid/README.md

@@ -72,11 +72,19 @@ cd /mnt/user/appdata/geointel
 cp deploy/unraid/geointel.env.example .env
 nano .env
 docker compose -f docker-compose.unraid.yml config
-docker build --build-arg GEOINTEL_INSTALL_AI=${GEOINTEL_INSTALL_AI:-false} -f deploy/unraid/Dockerfile.all-in-one -t geointel-all-in-one:latest .
-bash deploy/unraid/run-dockerman-container.sh
+bash deploy/unraid/deploy-release.sh
 ```
 
-The repository deploy scripts run the same flow automatically. They validate the Compose reference, build the image with the `GEOINTEL_INSTALL_AI` build arg, install the DockerMan template/icon, remove any old Compose-owned `geointel` container, preserve/migrate the PostGIS data path and start the final container with DockerMan labels.
+Set `GEOINTEL_POSTGRES_PASSWORD` to a unique value before that first start.
+Production startup fails before replacing the active container when the
+password is empty or one of the documented defaults.
+
+The repository deploy scripts run the same flow automatically. They validate
+the Compose reference, preserve the current image as
+`geointel-all-in-one:previous`, build an immutable commit-SHA tag plus `latest`,
+install the DockerMan metadata and start the SHA-tagged image. A failed start,
+live migration smoke or browser/API smoke automatically attempts the previous
+image without changing the configured PostGIS or storage paths.
 
 `scripts/deploy_tower.sh` and `scripts/deploy_tower.ps1` source the remote
 `.env` before building the image. That means `GEOINTEL_INSTALL_AI=true` in
@@ -99,8 +107,9 @@ libraries needed for Ultralytics imports; it still never downloads model weights
 The documented CPU runtime installs pinned `torch==2.13.0` and
 `torchvision==0.28.0` from `https://download.pytorch.org/whl/cpu`, avoiding the
 unused CUDA runtime wheels included by the general Linux package index. The
-Dockerfile copies dependency metadata before backend source, so normal code-only
-redeploys can reuse the expensive dependency layer.
+Dockerfile copies dependency metadata before backend source and applies
+commit/build metadata only after the heavy file layers. Normal code-only
+redeploys therefore reuse the apt, GIS and optional PyTorch dependency layers.
 `YOLO_CONFIG_DIR` defaults to `/app/storage/ultralytics`, a writable persistent
 path, so Ultralytics settings do not fall back to root user config directories.
 
@@ -173,8 +182,7 @@ GEOINTEL_CORS_ORIGINS=http://localhost:1203,http://127.0.0.1:1203,http://192.168
 Apply:
 
 ```bash
-docker build --build-arg GEOINTEL_INSTALL_AI=${GEOINTEL_INSTALL_AI:-false} -f deploy/unraid/Dockerfile.all-in-one -t geointel-all-in-one:latest .
-bash deploy/unraid/run-dockerman-container.sh
+bash deploy/unraid/deploy-release.sh
 ```
 
 ## Persistent paths
@@ -226,10 +234,55 @@ curl http://127.0.0.1:1202/api/v1/assistant/models
 cd /mnt/user/appdata/geointel
 git fetch origin main
 git reset --hard origin/main
+bash deploy/unraid/deploy-release.sh
+```
+
+The equivalent low-level build remains available for debugging:
+
+```bash
 docker build --build-arg GEOINTEL_INSTALL_AI=${GEOINTEL_INSTALL_AI:-false} -f deploy/unraid/Dockerfile.all-in-one -t geointel-all-in-one:latest .
 bash deploy/unraid/run-dockerman-container.sh
 ```
 
+## Release identity, fresh install and rollback
+
+Inspect the running immutable revision and retained images:
+
+```bash
+docker inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' geointel
+docker image ls geointel-all-in-one
+```
+
+Run a fresh install in isolated temporary PostGIS, storage and model paths. The
+script binds only a random loopback port and removes its own container and
+temporary directory:
+
+```bash
+bash scripts/verify_release_fresh_install.sh geointel-all-in-one:latest
+```
+
+Return to the image that was active immediately before the latest deployment:
+
+```bash
+bash deploy/unraid/rollback-dockerman-container.sh
+```
+
+For an older retained commit, select its immutable tag explicitly:
+
+```bash
+GEOINTEL_ROLLBACK_IMAGE=geointel-all-in-one:<commit-sha> \
+  bash deploy/unraid/rollback-dockerman-container.sh
+```
+
+Rollback reuses the configured PostGIS and storage mounts and never runs an
+Alembic downgrade. If a future release has a backward-incompatible migration,
+restore its verified pre-release backup instead of forcing an older app
+against a newer schema.
+
+The configured upload limit is shared by FastAPI and the generated nginx
+runtime configuration. Values outside `1..2048` MiB are rejected before the
+active application is replaced.
+
 ## Safe cleanup
 
 Safe cache cleanup if Docker build cache fills the Unraid Docker image: