43d37269b6
The production compose still carried `build:` keys and no `image:` keys, so a
`git clone` onto the CX22 followed by `docker compose up -d` would have started a
fat-LTO release build of 427 crates on a 2-vCPU/4 GB box — the outcome the whole
build-on-the-Mac decision exists to avoid, reached silently because `pull` skips a
service it is told to build rather than failing.
Both services now pull `registry.mc02.dev/eventsnap/*:${EVENTSNAP_VERSION}` with the
`:?` form, so a missing tag fails the command instead of resolving to an empty one.
`docker-compose.build.yml` restores the `build:` keys for the workstation that
produces the images, from the same context paths.
Also here:
- `DOMAIN` gets the same `:?` guard. Blank did not fail — it produced `https://` for
the frontend's ORIGIN and collapsed the Caddyfile's site block into a malformed
global block, so the stack came up with no TLS and no site.
- `stop_grace_period: 20s` on the app. Docker's default stop timeout is 10s, exactly
the app's own drain budget, so a redeploy could SIGKILL the process at the moment it
was finishing — truncating the in-flight upload the graceful shutdown protects.
- `COMMENTS_ENABLED` is pinned "false" alongside MEDIA_PATH. It is a product decision
for this event, and `.env.example` ships the generic `true`; pinning it means an
operator who copies the example and edits only the secrets cannot ship comments on.
- The frontend runtime stage now copies the lockfile and uses `npm ci`. Without it the
three `^`-ranged deps re-resolved at build time, so an image rebuilt days later could
differ from the one that was tested. Image also drops 120 MB -> 65 MB.
- `docker-compose.dev.yml` told the operator that production had the same `$`-eating
bug and to escape the hash as `$$` in `.env`. That is wrong and it breaks a working
deployment: Compose uses single-quoted env_file values literally, and doubling
produces a 74-character string `looks_bcrypt` rejects. Verified with `printenv`.
The runbook's rollback pointed at `v0.12.0`, which has 6 migrations against HEAD's 22
and was never built or pushed — running the emergency card's rollback line would have
crash-looped the app with `VersionMissing` during the event. §9 now has you tag one
build twice so the rollback target is bit-identical, and says plainly what that can and
cannot fix. Every `$DOMAIN` command gained the `set -a; . ./.env` it needs, the
down-migration psql commands are wrapped in `sh -c` so the container expands the
credentials rather than sending `-U ""`, and the advice to lower `max_video_size_mb`
is withdrawn: the client guard it was premised on does exist, but is pinned to a
compile-time constant, so lowering the DB value only moves failures later.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
47 lines
2.9 KiB
YAML
47 lines
2.9 KiB
YAML
# Dev-only overlay. NOT loaded automatically (unlike docker-compose.override.yml).
|
|
# Opt in explicitly for local development when you need host access to Postgres:
|
|
# docker compose -f docker-compose.yml -f docker-compose.dev.yml up
|
|
# Never use this overlay in production — it publishes the database port on the host.
|
|
services:
|
|
db:
|
|
ports:
|
|
- "5432:5432"
|
|
app:
|
|
# Relax the production secret guard for local dev — the dev sentinel JWT_SECRET
|
|
# is tolerated (warned) rather than rejected.
|
|
environment:
|
|
APP_ENV: development
|
|
# `.env` sets DATABASE_URL to @localhost for the run-backend-natively workflow
|
|
# (the db port is published above for that). When the app runs IN a container,
|
|
# localhost is the app itself — point it at the `db` service instead. Creds are
|
|
# interpolated from .env so nothing is hardcoded.
|
|
DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
|
|
# `.env` sets MEDIA_PATH to a HOST path (/home/fabi/EventSnap/media) for the
|
|
# run-backend-natively workflow. In a container that path doesn't exist and the
|
|
# app user can't create it from `/`, so every upload 500s with EACCES. The media
|
|
# volume is mounted at /media (see docker-compose.yml) — point the app there.
|
|
MEDIA_PATH: /media
|
|
# Set here purely so local dev needs no `.env` at all. The `$` are doubled because
|
|
# THIS is a `docker-compose.yml` `environment:` value, where Compose does interpolate.
|
|
#
|
|
# DO NOT COPY THE DOUBLING INTO `.env`. An earlier version of this comment claimed
|
|
# production had "the same bug" and told you to escape the hash as `$$` there — that is
|
|
# wrong and it breaks a working deployment. Compose uses SINGLE-QUOTED `env_file` values
|
|
# literally, which is the form `.env.example` ships, so the `$` segments survive intact;
|
|
# doubling them produces a 74-character string that `looks_bcrypt` rejects and the app
|
|
# refuses to boot on. Verified with `docker compose exec app printenv`.
|
|
ADMIN_PASSWORD_HASH: "$$2b$$12$$PAteqCNpsbm6d0HTJcywfOaUovjAU.iNVlsL7EDYaRC/z4P/xv7ye"
|
|
# Smoke-testing the comment kill-switch: boot-time flag, so it needs a restart
|
|
# (not an admin-UI toggle). Backend rejects new comments (403) and the frontend
|
|
# hides the whole comment UI. Flip back to true (or drop this line) to restore.
|
|
COMMENTS_ENABLED: "false"
|
|
|
|
caddy:
|
|
# The caddy service has no env_file, so the Caddyfile's `{$DOMAIN}` would expand to empty
|
|
# and the site block would collapse into a malformed global block. Supply it for local dev
|
|
# (from .env → localhost, which Caddy serves with a local self-signed cert). Production
|
|
# already wires DOMAIN into caddy's `environment:`, guarded with `:?` so an unset value
|
|
# fails the command instead of silently producing a site with no address.
|
|
environment:
|
|
DOMAIN: ${DOMAIN}
|