sakshamandClaude Sonnet 5
086ca1f13f
Sets up everything needed to deploy behind Cloudflare with a self-hosted git server: multi-stage prod Dockerfiles (non-root), docker-compose.prod.yml (Postgres/Redis with no host ports, Nginx reverse proxy, Gitea with public-read/admin-write access control), scripts/bootstrap-env.sh to auto-generate required secrets on first clone, and DEPLOYMENT.md covering the full runbook. Provider API keys (Anthropic/Brave/NinjaPear/USPTO/ Turnstile) are deliberately kept out of .env in favor of the existing DB-backed Settings UI, so the public repo stays safe to expose. Also fixes two bugs only surfaced by live-testing the prod stack: Celery beat couldn't write its schedule file as a non-root user, and Gitea's embedded SSH server conflicted with the base image's own sshd on port 22. Co-Authored-By: Claude Sonnet 5 <[email protected]>
46 lines
859 B
Plaintext
46 lines
859 B
Plaintext
# Docker's ignore-pattern matching is NOT recursive-by-default the way
|
|
# .gitignore's is - a bare `node_modules/` only matches a top-level
|
|
# directory of that name, not apps/web/node_modules. Every pattern below
|
|
# is prefixed with **/ so it matches at any depth (confirmed by testing:
|
|
# without **/, `apps/web/node_modules` alone still uploaded ~600MB of
|
|
# build context that was never actually needed by any Dockerfile).
|
|
|
|
**/.git/
|
|
**/.env
|
|
**/.env.local
|
|
**/*.pem
|
|
**/*.key
|
|
|
|
**/__pycache__/
|
|
**/*.py[cod]
|
|
**/*.egg-info/
|
|
**/.venv/
|
|
**/venv/
|
|
**/.pytest_cache/
|
|
**/.ruff_cache/
|
|
**/.mypy_cache/
|
|
**/htmlcov/
|
|
**/.coverage
|
|
**/*.db
|
|
**/*.sqlite3
|
|
|
|
**/node_modules/
|
|
**/.next/
|
|
**/out/
|
|
**/dist/
|
|
**/build/
|
|
**/.turbo/
|
|
**/coverage/
|
|
**/*.tsbuildinfo
|
|
**/.eslintcache
|
|
|
|
**/test-results/
|
|
**/playwright-report/
|
|
**/playwright/.cache/
|
|
|
|
**/.claude/
|
|
**/.vscode/
|
|
**/.idea/
|
|
**/*.log
|
|
**/logs/
|