From 77be096338e3f8e624d24061fc63f414f88917a7 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Mon, 19 Oct 2026 13:22:51 +0000
Subject: [PATCH] dev2: deploy three at a time with @profullstack/deploy's
 deploy-gate

- templates/deploy-app.sh: take a deploy slot before building (no-op when no gate is
  installed, on --status, or when already gated). The same preamble is in all 93 live
  /home/anthony/www/*/deploy-app.sh copies (backups *.bak-deploy-gate).
- memory-guard.sh step 4: install /usr/local/bin/deploy-gate (0.1.0, sha256-pinned)
  so root's OpenInstall deploys share the same three slots.
- templates/deploy-dev2.yml: timeout 120 min, room to queue behind a wave of merges.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 dev2/memory-guard.sh           | 18 ++++++++++++++++++
 dev2/templates/deploy-app.sh   |  8 ++++++++
 dev2/templates/deploy-dev2.yml |  3 ++-
 3 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/dev2/memory-guard.sh b/dev2/memory-guard.sh
index cfe1720..16d9744 100755
--- a/dev2/memory-guard.sh
+++ b/dev2/memory-guard.sh
@@ -19,6 +19,9 @@
 #     every process of supabase-db and the other *-db / *postgres* containers, now
 #     and every 5 minutes (a systemd timer), so restarts and recreates stay covered.
 #  3. fixes earlyoom's avoid list to match ".postgres-wrapp" (and postgrest, pgbouncer).
+#  4. installs /usr/local/bin/deploy-gate (@profullstack/deploy, pinned and checksummed):
+#     every deploy on the box (deploy-app.sh, OpenInstall bin/install.sh) then takes one
+#     of 3 slots, so a wave of merges builds three at a time instead of all at once.
 set -euo pipefail
 [ "$(id -u)" = 0 ] || { echo "run as root: sudo bash $0"; exit 1; }
 
@@ -70,9 +73,24 @@ if [ -f /etc/default/earlyoom ] && ! grep -q 'postgres\.\*' /etc/default/earlyoo
 fi
 grep EARLYOOM_ARGS /etc/default/earlyoom | sed 's/^/  /'
 
+echo "== 4. deploy gate: three deploys at a time"
+GATE_VERSION=0.1.0
+GATE_SHA256=c4e3b64144f186f97b5e0f7fe1f20021282bb9547c2b13d55c2c0312d9ef7b52
+tmp=$(mktemp -d)
+if curl -fsSL "https://registry.npmjs.org/@profullstack/deploy/-/deploy-$GATE_VERSION.tgz" -o "$tmp/d.tgz" \
+  && tar -xzf "$tmp/d.tgz" -C "$tmp" package/bin/deploy-gate \
+  && echo "$GATE_SHA256  $tmp/package/bin/deploy-gate" | sha256sum -c --quiet -; then
+  install -m 0755 -o root -g root "$tmp/package/bin/deploy-gate" /usr/local/bin/deploy-gate
+  /usr/local/bin/deploy-gate status | sed 's/^/  /'
+else
+  echo "  could not fetch or verify @profullstack/deploy $GATE_VERSION; deploys stay ungated for root (anthony's use ~/.local/bin/deploy-gate)"
+fi
+rm -rf "$tmp"
+
 echo
 echo "Done. Check: free -g; systemctl show -p MemoryCurrent,MemoryMax user-1001.slice cron.service"
 echo "Undo: systemctl set-property user-1001.slice MemoryHigh=infinity MemoryMax=infinity"
 echo "      systemctl set-property cron.service MemoryHigh=infinity MemoryMax=infinity"
 echo "      systemctl disable --now protect-db-oom.timer"
 echo "      mv /etc/default/earlyoom.bak-memory-guard /etc/default/earlyoom && systemctl restart earlyoom"
+echo "      rm /usr/local/bin/deploy-gate   # deploys run ungated again"
diff --git a/dev2/templates/deploy-app.sh b/dev2/templates/deploy-app.sh
index 507195b..743a1ef 100755
--- a/dev2/templates/deploy-app.sh
+++ b/dev2/templates/deploy-app.sh
@@ -18,6 +18,14 @@
 # next deploy, never by editing this box. See sync_env_from_vault below.
 #
 set -euo pipefail
+# Three deploys at a time on this box (@profullstack/deploy deploy-gate): a merge
+# that lands with many others queues for a slot instead of building with all of them.
+# No gate installed, a --status call, or already inside the gate: carry on as before.
+if [ -z "${DEPLOY_GATED:-}" ] && [ "${1:-}" != --status ]; then
+  for gate in /usr/local/bin/deploy-gate "$HOME/.local/bin/deploy-gate"; do
+    [ -x "$gate" ] && exec "$gate" --name "$(basename "$(dirname "$(readlink -f "$0")")")" -- "$0" "$@"
+  done
+fi
 
 ROOT=${ROOT:-$(cd "$(dirname "$(readlink -f "$0")")" && pwd)}
 APP_DIR="$ROOT/app"
diff --git a/dev2/templates/deploy-dev2.yml b/dev2/templates/deploy-dev2.yml
index 1b19d01..b2d1448 100644
--- a/dev2/templates/deploy-dev2.yml
+++ b/dev2/templates/deploy-dev2.yml
@@ -21,7 +21,8 @@ concurrency:
 jobs:
   deploy:
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    # Room to queue: deploys build 3 at a time on dev2 (@profullstack/deploy), so a wave of merges waits its turn.
+    timeout-minutes: 120
     steps:
       # ${{ }} values go through env, never straight into a run: body.
       - name: Resolve target revision