Nex Zip Scp Deploy Flow

What it does

• Builds locally, then ships the build to the server over SCP and places it with one command.
• Takes a timestamped backup of the target directory before touching anything, into a fixed backup directory rather than someone's home folder.
• Aborts before it touches the live directory if the uploaded build is empty, so a failed build cannot empty a running site.
• Keeps your .env, data/ and uploads/ through both a deploy and a rollback.
• Prints a summary of what changed and the exact rollback command.
• Reloads nginx rather than restarting it, so live visitors are not dropped.

Privileges

Least privilege by design. One setup script prepares the server once, as root: it creates a deploy group, makes the target and backup directories group-writable, and grants permission for exactly one command, the reload. It validates that grant and removes it again if the check fails, and it prints the two commands that undo everything it did.

Every deploy after that runs as your normal user. The deploy, rollback and prune scripts all refuse to run as root. The single elevated action per deploy is the reload, through that one grant. Nothing in the flow contacts the network except your own SSH connection to your own server: no telemetry, no downloads, no third-party endpoints, no API keys.

Deletions are bounded and documented. The pruner is a dry run unless you pass --yes, validates every path against the fixed backup root, and never uses a wildcard.

Use cases

• Deploying static client sites to a Raspberry Pi or VPS
• Shipping a single-file HTML demo to a server
• Updating an app that runs as a systemd service
• A safe update path when you cannot afford a broken production
• Handing a repeatable deploy to someone else

Known limitations

SSH and SCP based, so no container registry or blue-green deploys. The one-time setup needs root on the server; nothing after it does. Needs unzip and rsync on the server, which Raspberry Pi OS Lite does not ship. Assumes key-based SSH access is already working.