Deploy from git

What a deploy does

Clone the revision into a fresh release directory, install, build, then activate. The build happens before anything is swapped, so a broken build costs nothing.

./setup.sh --mode deploy

Rollback is the same mechanism

The previous release stays on disk and the old slot stays running until the new one has proven itself. Rolling back is repointing the symlink and flipping the edge, so it is as fast as the deploy was.

Nothing is opened in the firewall

The application port is never exposed. Traffic arrives through a private tunnel bound to a hostname you verified, so there is no public port to forget about.