Add Settings -> Database viewer (Adminer) for local devs and any admin
Local dev gets an unauthenticated Adminer instance bound to loopback only. In production, any account with is_admin=true can open it - the app mints a short-lived token from a live admin session, which Nginx's new db.ciagent.org block exchanges for a session cookie that re-checks admin status on every request, instead of a shared static password that wouldn't scale to multiple admins or revoke live. Co-Authored-By: Claude Sonnet 5 <[email protected]>
This commit is contained in:
Claude Sonnet 5
+18
-6
@@ -13,6 +13,7 @@ One Docker host runs everything via `docker-compose.prod.yml`: Postgres, Redis,
|
||||
| `ciagent.org` | `web:3000` | Next.js frontend |
|
||||
| `api.ciagent.org` | `api:8000` | FastAPI backend |
|
||||
| `git.ciagent.org` | `gitea:3000` | Self-hosted git (public read, admin-only write) |
|
||||
| `db.ciagent.org` | `adminer:8080` | Database viewer (any admin account, no separate password - see §7) |
|
||||
|
||||
Cloudflare's proxy (orange-cloud DNS) hides the origin's real IP and absorbs generic bot/volumetric traffic; the app's own IP-based throttle/ban system (`app/services/ip_throttle_service.py`) handles the business-logic-specific abuse cases Cloudflare can't know about. Both need `TRUSTED_PROXY_IP_HEADER=CF-Connecting-IP` set correctly or IP-based logic breaks — see `KNOWN_LIMITATIONS.md`.
|
||||
|
||||
@@ -24,8 +25,8 @@ Cloudflare's proxy (orange-cloud DNS) hides the origin's real IP and absorbs gen
|
||||
|
||||
## 2. Cloudflare DNS + Origin CA certificate
|
||||
|
||||
1. Add three DNS **A records**, all proxied (orange cloud): `ciagent.org`, `api.ciagent.org`, `git.ciagent.org` → the server's public IP.
|
||||
2. Cloudflare dashboard → SSL/TLS → **Origin Server** → Create Certificate. Cover `ciagent.org` and `*.ciagent.org` (one cert for all three subdomains), leave the default 15-year validity. Save the cert and private key.
|
||||
1. Add four DNS **A records**, all proxied (orange cloud): `ciagent.org`, `api.ciagent.org`, `git.ciagent.org`, `db.ciagent.org` → the server's public IP.
|
||||
2. Cloudflare dashboard → SSL/TLS → **Origin Server** → Create Certificate. Cover `ciagent.org` and `*.ciagent.org` (one cert for all four subdomains, including any added later), leave the default 15-year validity. Save the cert and private key.
|
||||
3. On the server, create `/etc/ci-agent/certs/` (outside the repo, never committed) and place the two files there as `cloudflare-origin.pem` and `cloudflare-origin.key` — this is exactly what `docker-compose.prod.yml`'s `nginx` service mounts.
|
||||
4. Cloudflare dashboard → SSL/TLS → set the encryption mode to **Full (strict)**. Anything less either skips origin verification or falls back to plaintext HTTP to the origin.
|
||||
|
||||
@@ -59,6 +60,7 @@ FRONTEND_URL=https://ciagent.org
|
||||
BACKEND_URL=https://api.ciagent.org
|
||||
NEXT_PUBLIC_API_URL=https://api.ciagent.org
|
||||
NEXT_PUBLIC_GIT_REPO_URL=https://git.ciagent.org/<your-admin-username>/ci-agent
|
||||
NEXT_PUBLIC_DB_VIEWER_URL=https://db.ciagent.org
|
||||
TRUSTED_PROXY_IP_HEADER=CF-Connecting-IP
|
||||
RESEND_API_KEY=<real Resend key> # no admin-UI equivalent for this one
|
||||
```
|
||||
@@ -97,7 +99,17 @@ Two ways to push, since Cloudflare's proxy only speaks HTTP(S) — raw SSH can't
|
||||
|
||||
Read-only clone/browse works for anyone, no account: `https://git.ciagent.org/<you>/ci-agent.git` or the web UI directly.
|
||||
|
||||
## 7. Post-boot: configure provider API keys via the Settings UI, not `.env`
|
||||
## 7. Database viewer (Adminer at db.ciagent.org)
|
||||
|
||||
Unlike Gitea's admin account, there's no manual credential-handoff step for this one — any account with `is_admin=true` on the app itself can use it immediately, once `NEXT_PUBLIC_DB_VIEWER_URL` is set (§4) and the site is redeployed. Settings → Database → "Open database viewer" mints a short-lived token from the admin's real, live-checked login, which `db.ciagent.org`'s Nginx block (`infrastructure/nginx/nginx.conf`) exchanges for a signed session cookie via `apps/api/app/api/v1/db_viewer.py` — no separate password to generate, distribute, or rotate.
|
||||
|
||||
A couple of things worth knowing:
|
||||
|
||||
- Sessions last 60 minutes. Revoking someone's `is_admin` flag takes effect on their very next request through Nginx's `auth_request` check (it re-loads the user from the database each time), but an already-open Adminer tab isn't force-closed — it just stops being able to load anything new once that check runs again.
|
||||
- Adminer's own Postgres login (username/password) is a second, independent layer past this gate — real DB credentials are still required to actually view or edit anything.
|
||||
- An optional, commented-out IP-allowlist snippet is included in the `db.ciagent.org` Nginx block for admins with a static IP who want to require both the session *and* a matching source address — not enabled by default, since most admin connections don't have a stable IP to pin to.
|
||||
|
||||
## 8. Post-boot: configure provider API keys via the Settings UI, not `.env`
|
||||
|
||||
`scripts/bootstrap-env.sh` deliberately leaves these six blank. Sign in as the admin account and set them from the app itself:
|
||||
|
||||
@@ -106,7 +118,7 @@ Read-only clone/browse works for anyone, no account: `https://git.ciagent.org/<y
|
||||
|
||||
Also set `LLM_PROVIDER=anthropic` and `SEARCH_PROVIDER=brave` in `.env` (restart `api`/`worker`/`beat` after) once you've configured the corresponding keys above — provider *selection* is still a deployment-level `.env` setting, only the key *values* moved to the UI.
|
||||
|
||||
## 8. Updating the deployment
|
||||
## 9. Updating the deployment
|
||||
|
||||
Manually:
|
||||
|
||||
@@ -128,7 +140,7 @@ systemctl enable --now ci-agent-deploy.timer
|
||||
|
||||
Once running, pushing to `master` on Gitea is enough — the server picks it up within ~2 minutes, no manual SSH step needed. Check `journalctl -u ci-agent-deploy.service` to see deploy runs.
|
||||
|
||||
## 9. Backups
|
||||
## 10. Backups
|
||||
|
||||
Nothing backs itself up by default. At minimum, a nightly cron job on the host:
|
||||
|
||||
@@ -142,7 +154,7 @@ docker run --rm -v ci-agent-prod_gitea-data:/data -v /backups:/backup alpine \
|
||||
|
||||
Copy `/backups` off-box (a Hetzner Storage Box via `rclone`, or any object storage) — local-only backups don't survive a lost disk. Retain a sane number of days and prune older ones.
|
||||
|
||||
## 10. Operational notes
|
||||
## 11. Operational notes
|
||||
|
||||
- `beat` must stay exactly one instance, always — duplicate scheduled monitoring runs otherwise. Don't `--scale beat=2`.
|
||||
- Docker's log driver is capped per-service (`max-size: 10m`, `max-file: 3` in `docker-compose.prod.yml`) — nothing else bounds log growth on the host.
|
||||
|
||||
Reference in New Issue
Block a user