The pull agent

The pull agent is hotdog-cms running on the web server, fetching your site from git and publishing it into the web server's folder whenever the branch moves. It's the simplest way to keep a site you host yourself up to date, and the safest: there are no server keys anywhere else.

What you need

• A web server you can log in to, with HotDog CMS and git installed.
• Your site's repository address. A private repository needs a read-only access token (below).

Try it once

hotdog-cms pull -repo https://github.com/you/mysite.git -out /var/www/mysite

It clones the repository, builds and checks the site, and publishes it into /var/www/mysite in one swap. If the build fails or the checks find errors, the live site is left as it was.

Keep it running

-every 1m keeps it checking once a minute. Run it as a service, so it starts with the server. Make a user for it first (sudo useradd --system site-publish), give that user the web folder's parent, then /etc/systemd/system/site-publish.service:

[Unit]
Description=Publish example.org from git
After=network-online.target
Wants=network-online.target

[Service]
User=site-publish
ExecStart=/usr/local/bin/hotdog-cms pull -repo https://github.com/you/mysite.git -out /var/www/example.org -every 1m
Restart=on-failure
NoNewPrivileges=yes
ProtectSystem=strict
ReadWritePaths=/var/www /var/cache/hotdog-cms
Environment=XDG_CACHE_HOME=/var/cache/hotdog-cms

[Install]
WantedBy=multi-user.target

sudo mkdir -p /var/cache/hotdog-cms
sudo chown site-publish /var/cache/hotdog-cms
sudo systemctl daemon-reload
sudo systemctl enable --now site-publish

Check on it any time with journalctl -u site-publish.

Private repositories

Make a read-only access token on your platform (on GitHub, a fine-grained token with Contents: Read on that one repository), and give it to the agent in its environment, never on the command line:

Environment=HOTDOG_GIT_TOKEN=the-token

Better, put it in a file only root can read and use EnvironmentFile=.

Publishing the moment you merge

Checking every minute is usually plenty. For instant updates, the agent can also listen for your platform's webhook: add -hook 127.0.0.1:8170, pass that address on from your web server, set HOTDOG_HOOK_SECRET, and point a push webhook at it with the same secret. A missed webhook only delays an update until the next check.

Options

Option	Meaning
-repo	The site's repository. Required.
-out	The web server's folder to publish into. Required.
-branch	The branch to publish (default main).
-every	Keep checking at this interval, like 1m. Without it, it checks once and exits.
-subdir	The site's folder, if it isn't at the top of the repository.
-hook	Also listen for push webhooks here.
-indexnow	Tell search engines which pages changed (see Search engines).