sakshamandClaude Sonnet 5
086ca1f13f
Sets up everything needed to deploy behind Cloudflare with a self-hosted git server: multi-stage prod Dockerfiles (non-root), docker-compose.prod.yml (Postgres/Redis with no host ports, Nginx reverse proxy, Gitea with public-read/admin-write access control), scripts/bootstrap-env.sh to auto-generate required secrets on first clone, and DEPLOYMENT.md covering the full runbook. Provider API keys (Anthropic/Brave/NinjaPear/USPTO/ Turnstile) are deliberately kept out of .env in favor of the existing DB-backed Settings UI, so the public repo stays safe to expose. Also fixes two bugs only surfaced by live-testing the prod stack: Celery beat couldn't write its schedule file as a non-root user, and Gitea's embedded SSH server conflicted with the base image's own sshd on port 22. Co-Authored-By: Claude Sonnet 5 <[email protected]>
114 lines
3.0 KiB
YAML
114 lines
3.0 KiB
YAML
name: ci-agent
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: ciagent
|
|
POSTGRES_PASSWORD: ciagent
|
|
POSTGRES_DB: ciagent
|
|
ports:
|
|
- "5432:5432"
|
|
volumes:
|
|
- postgres-data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ciagent -d ciagent"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
redis:
|
|
image: redis:7-alpine
|
|
restart: unless-stopped
|
|
ports:
|
|
- "6379:6379"
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
api:
|
|
build:
|
|
context: .
|
|
dockerfile: infrastructure/docker/api.Dockerfile
|
|
restart: unless-stopped
|
|
env_file: .env
|
|
environment:
|
|
DATABASE_URL: postgresql+psycopg://ciagent:ciagent@postgres:5432/ciagent
|
|
REDIS_URL: redis://redis:6379/0
|
|
ports:
|
|
- "8000:8000"
|
|
volumes:
|
|
- ./apps/api:/app
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
command: >
|
|
sh -c "alembic upgrade head &&
|
|
uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload"
|
|
|
|
worker:
|
|
build:
|
|
context: .
|
|
dockerfile: infrastructure/docker/api.Dockerfile
|
|
restart: unless-stopped
|
|
env_file: .env
|
|
environment:
|
|
DATABASE_URL: postgresql+psycopg://ciagent:ciagent@postgres:5432/ciagent
|
|
REDIS_URL: redis://redis:6379/0
|
|
volumes:
|
|
- ./apps/api:/app
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
command: celery -A app.tasks.celery_app worker --loglevel=INFO -Q default,collection,analysis,notifications,maintenance,enrichment
|
|
|
|
beat:
|
|
build:
|
|
context: .
|
|
dockerfile: infrastructure/docker/api.Dockerfile
|
|
restart: unless-stopped
|
|
env_file: .env
|
|
environment:
|
|
DATABASE_URL: postgresql+psycopg://ciagent:ciagent@postgres:5432/ciagent
|
|
REDIS_URL: redis://redis:6379/0
|
|
volumes:
|
|
- ./apps/api:/app
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
command: celery -A app.tasks.celery_app beat --loglevel=INFO
|
|
|
|
web:
|
|
build:
|
|
context: .
|
|
dockerfile: infrastructure/docker/web.Dockerfile
|
|
restart: unless-stopped
|
|
environment:
|
|
# Baked into the browser bundle - must be an address the *browser*
|
|
# (not the container) can reach, so a LAN client needs this set to
|
|
# the host machine's LAN IP, not localhost. See .env.example.
|
|
NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:8000}
|
|
# "Git Repository" landing-page link - blank by default so it's
|
|
# hidden unless you actually run a git server for this deployment.
|
|
NEXT_PUBLIC_GIT_REPO_URL: ${NEXT_PUBLIC_GIT_REPO_URL:-}
|
|
ports:
|
|
- "3000:3000"
|
|
volumes:
|
|
- ./apps/web:/app
|
|
- /app/node_modules
|
|
- /app/.next
|
|
depends_on:
|
|
- api
|
|
|
|
volumes:
|
|
postgres-data:
|