Repository navigation
Prod environment, approval gate and go-live in the Pixelbar server #12
Description
Context
Once dev is proven, Pixel needs a production environment and to join the real Pixelbar Discord server.
Depends on:
- CD: publish images to GHCR, create Sentry releases, deploy to dev #10: CD to dev
- Guarantee a single running instance per environment #11: single instance
- Privacy notice and data retention (GDPR) #7: privacy notice
- Operations runbook #13: runbook
Goal
Pixel runs in a prod environment, with deploys gated by human approval, and is live in the Pixelbar server.
Scope
infra/envs/prod, using the same module as dev:- its own Discord application, Key Vault, Sentry environment
prod, and real access lists
- its own Discord application, Key Vault, Sentry environment
- Approval gate: a GitHub Environment
prodwith required reviewers - Promotion: prod deploys the same image digest already verified in dev, never a rebuild
- Go-live:
- invite the bot to the Pixelbar server with the minimum permissions it needs
- register commands
- load the real admin and member lists
- announce to members
Acceptance criteria
- Prod deploys need an approving review, and nothing deploys to prod automatically
- Prod secrets and access lists live only in the prod Key Vault
- The bot has only the Discord permissions it needs, written down
- Commands work in the Pixelbar server for each tier
- Coding agents can't apply Terraform to prod or change prod secrets (already in AGENTS.md; enforce it where possible)
- The privacy notice (Privacy notice and data retention (GDPR) #7) is live and linked from
/help
Open questions
- Who are the approvers for prod deploys?
- Who are the initial Pixel admins in prod?
- When, and in which channel, do we announce Pixel to members?
Activity
Deploy Azure dev from a local build, not PR CI
CD: local just deploy-dev for Azure dev; main → prod (#67)
CD: keep main off prod; Sentry maps and register on deploy-dev (#68)
NinjaLikesCheez commentedon Oct 9, 2026
Audit follow-up (2026-10-09)
This is still the prod go-live ticket. Extra constraints from live bootstrap /
dev:Do first (separate issues, not this stack)
repo:pixelbar/pixel:environment:prod. Dev already needed the immutable form (repo:pixelbar@1690472/pixel@1402859166:environment:…). Fix that before any prod workflowazure/login(Fix prod GitHub OIDC subject and add Environment reviewers #71).prodexists but has no reviewers, noARM_*, no branch policy. Add reviewers +mainonly before enabling login.cd.ymlmust stay off Azure until those exist (ADR 0010).When
infra/envs/prodexistspixel-dev-kvor the Mini / Pixel Dev Discord tokenpurge_soft_delete_on_destroy(dev is the opposite on purpose)main, never a rebuild for prodpixel-prodRG andpixel-github-prodalready exist (bootstrap). Do not apply a fake prod “to use” them.Limit container image ignore_changes to the dev app
Stop Terraform apply from rolling back just deploy-dev images (#86)
Add prod Azure environment and approved CD (#12) (#93)