Docker deployment (2 images, 3 composes, Tailscale funnels) + committed security suite

Test suite (the manual audit harness, now a real test):
- backend/apps/core/tests/test_security.py: 20 transactional tests across
  guest visibility, object ownership, staged-upload/similarity privacy,
  staff role boundaries, deletion rules, encrypted credentials, throttling
  and the download allowlist. Uses temp media folders and clears cache.
  Needs a one-time GRANT on test_j621 (documented in the module + README).

Images (deploy/J621-Frontend, deploy/J621-Backend, repo root as context):
- Frontend: node build -> static nginx with SPA fallback, asset caching and
  an internal health endpoint.
- Backend: gunicorn + whitenoise (admin static collected at build), ffmpeg
  for video thumbnails, migrations applied on start, GIT_HASH build arg so
  the shell's version pill shows the commit.

Composes (distinct project names so they coexist with the dev stack):
- compose.yml (both), compose.frontend.yml, compose.backend.yml.
- A shared nginx proxy service is the only entry point (no host nginx, no
  published host ports): /api,/admin,/static,/health -> backend, everything
  else -> SPA; both upstreams resolve at request time so one config serves
  all variants.
- A Tailscale sidecar per compose shares the nginx network namespace;
  serve.default/frontend/backend.json use funnel ports 443 and 8443 only
  (10000 is the remaining allowance) with ${TS_CERT_DOMAIN} substitution.

Registry: push_frontend.sh / push_backend.sh / push_all.sh build multi-arch
images and push :latest + :<sha> to the Gitea registry, following the
existing Packs-site pattern.

Docs: deploy/README.md + .env.example, ROADMAP section 6 updated,
AGENTS.md deployment and test notes.

Verified: all three composes validate, both nginx configs pass nginx -t,
both images build, the combined stack boots against real MariaDB/Redis
(migrations applied, /health ok, whitenoise serving admin static, env=prod,
git hash baked in), the proxy serves the SPA and routes /api, and
manage.py test apps.core.tests passes 20/20.

deploy/.env.example

@@ -0,0 +1,67 @@
+# J621 deployment environment — copy to deploy/.env and fill in.
+#
+# Compose reads this file for variable substitution AND passes it to the
+# backend container (env_file), so everything here is visible to Django.
+
+# ---------------------------------------------------------------------------
+# Tailscale
+# ---------------------------------------------------------------------------
+# Reusable, untagged auth key (Settings -> Keys -> Generate auth key,
+# Reusable = on, Tags = none). Auto-approves the device.
+TS_AUTHKEY=
+
+# Hostname this deployment gets on the tailnet; the funnel URL becomes
+# https://<TS_HOSTNAME>.<tailnet>.ts.net. Use distinct names per compose.
+TS_HOSTNAME=j621
+
+# ---------------------------------------------------------------------------
+# Django
+# ---------------------------------------------------------------------------
+# Long random string. Signs media URLs and encrypts stored e621 API keys —
+# rotating it invalidates both, so users re-enter their e621 key.
+SECRET_KEY=change-me-to-a-long-random-string
+DEBUG=False
+
+# Hosts Django may be reached on, comma separated, no scheme. Add the tailnet
+# hostname of every compose that talks to this backend (and keep localhost /
+# 127.0.0.1 for container health checks).
+ALLOWED_HOSTS=j621.rainbow-herring.ts.net,localhost,127.0.0.1
+
+# ---------------------------------------------------------------------------
+# Cross-origin access (needed for the separate frontend + backend deploys)
+# ---------------------------------------------------------------------------
+# The origin the SPA is served from, e.g. https://j621-frontend.<tailnet>.ts.net
+# CORS_ALLOWED_ORIGINS=
+# CSRF_TRUSTED_ORIGINS=
+
+# ---------------------------------------------------------------------------
+# Database (created by the compose files; change the password)
+# ---------------------------------------------------------------------------
+DB_NAME=j621
+DB_USER=j621
+DB_PASSWORD=j621
+DB_ROOT_PASSWORD=j621root
+
+# ---------------------------------------------------------------------------
+# Optional overrides
+# ---------------------------------------------------------------------------
+# GUNICORN_WORKERS=2
+# GUNICORN_THREADS=4
+# GUNICORN_TIMEOUT=120
+
+# Rate limits (per IP anonymous, per account signed in)
+# THROTTLE_ANON=120/min
+# THROTTLE_USER=600/min
+# THROTTLE_LOGIN=5/min
+# THROTTLE_REGISTER=20/hour
+# THROTTLE_E621_PROXY=60/hour
+
+# e621 media hosts the backend may fetch from (downloads, proxies)
+# E621_MEDIA_HOSTS=static1.e621.net,static2.e621.net,static3.e621.net
+
+# Ephemeral similarity-check lifetime in minutes
+# SIMILARITY_TTL_MINUTES=30
+
+# Registry/tag used by the compose files and push scripts
+# J621_REGISTRY=gitea.rainbow-herring.ts.net/jakebreath
+# J621_TAG=latest

deploy/.gitignore

@@ -0,0 +1,4 @@
+# Runtime data and state — never commit these.
+.env
+data/
+tailscale-state/

deploy/J621-Backend

@@ -0,0 +1,40 @@
+# J621-Backend — Django + gunicorn, with migrations applied on start.
+#
+# Build context is the repository root, e.g.:
+#   docker build -f deploy/J621-Backend -t j621-backend .
+#
+# Needs MariaDB and Redis (see the compose files). ffmpeg is used for video
+# thumbnails; media/logs live under the mounted volumes.
+
+# syntax=docker/dockerfile:1
+
+FROM python:3.14-slim
+
+# Baked in by the push scripts so the shell's version pill shows the commit
+# even though the image has no .git directory.
+ARG GIT_HASH=unknown
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    GIT_COMMIT_HASH=$GIT_HASH
+
+WORKDIR /app
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ffmpeg \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY backend/requirements.txt ./
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY backend/ ./
+COPY deploy/backend-entrypoint.sh /usr/local/bin/j621-entrypoint
+
+RUN chmod +x /usr/local/bin/j621-entrypoint \
+    && mkdir -p /app/media /app/logs \
+    && python manage.py collectstatic --noinput
+
+EXPOSE 8000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health')" || exit 1
+
+ENTRYPOINT ["j621-entrypoint"]

deploy/J621-Frontend

@@ -0,0 +1,24 @@
+# J621-Frontend — builds the SPA and serves it as static files.
+#
+# Build context is the repository root, e.g.:
+#   docker build -f deploy/J621-Frontend -t j621-frontend .
+#
+# This container only serves the SPA (with the index fallback). The public
+# entry point is the separate "nginx" reverse-proxy service in the compose
+# files, so API routing stays in one place.
+
+# syntax=docker/dockerfile:1
+
+FROM node:22-alpine AS build
+WORKDIR /app
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci --no-audit --no-fund
+COPY frontend/ ./
+RUN npm run build
+
+FROM nginx:1.29-alpine
+COPY deploy/nginx-frontend.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /app/dist /usr/share/nginx/html
+EXPOSE 80
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
+    CMD wget -q --spider http://127.0.0.1/nginx-health || exit 1

deploy/README.md

@@ -0,0 +1,100 @@
+# J621 deployment (Docker + Tailscale)
+
+Three compose variants, all behind an **nginx** service and a **Tailscale**
+sidecar. Nothing is published on the host's ports and no system nginx or
+reverse proxy is involved: the sidecar shares the nginx service's network
+namespace and Tailscale Serve/Funnel exposes it.
+
+| Compose | Services | Funnel | Serve config |
+| --- | --- | --- | --- |
+| `compose.yml` (default) | mariadb, redis, backend, frontend, nginx, tailscale | `https://<host>.<tailnet>.ts.net` → nginx → backend + SPA | `serve.default.json` |
+| `compose.frontend.yml` | frontend, nginx, tailscale | `https://<host>.<tailnet>.ts.net` → nginx → SPA only | `serve.frontend.json` |
+| `compose.backend.yml` | mariadb, redis, backend, nginx, tailscale | `https://<host>.<tailnet>.ts.net:8443` → nginx → API | `serve.backend.json` |
+
+Funnel can only expose ports **443**, **8443** and **10000**, so the separate
+backend uses 8443. Change it in `serve.backend.json` (and `.env`) if you
+prefer 10000.
+
+## Usage
+
+```bash
+cd deploy
+cp .env.example .env          # fill in TS_AUTHKEY, SECRET_KEY, ALLOWED_HOSTS, ...
+docker compose up -d          # default: everything on one host
+# or
+docker compose -f compose.frontend.yml up -d
+docker compose -f compose.backend.yml up -d
+```
+
+The images are pulled from the Gitea registry; append `--build` (or run the
+push scripts) if you build locally. Data lives in `deploy/data/`
+(`media/`, `logs/`, `mariadb/`, `redis/`) and the Tailscale node state in
+`deploy/tailscale-state/`; both are git-ignored.
+
+## First start
+
+The SPA asks where the backend is (`/setup`) in production builds:
+
+- **Default compose** — leave the field blank (same origin) and everything
+  works through nginx.
+- **Frontend-only + backend-only** — point the (cross-origin) SPA at the
+  backend's funnel URL, e.g. `https://j621-backend.<tailnet>.ts.net:8443`,
+  and give the backend `CORS_ALLOWED_ORIGINS=https://<frontend-host>.<tailnet>.ts.net`
+  (plus `CSRF_TRUSTED_ORIGINS` for the admin).
+- Without a backend at all, choose **"Continue without a backend"** to run in
+  local mode (e621 browsing only).
+
+Any origin and port is fine — the backend builds its media URLs from the
+forwarded host/proto (`TRUST_PROXY_HEADERS=true` is set in all composes).
+
+## Images
+
+Two Dockerfiles, both built from the repository root:
+
+```bash
+docker build -f deploy/J621-Frontend -t j621-frontend .
+docker build --build-arg "GIT_HASH=$(git rev-parse --short HEAD)" \
+    -f deploy/J621-Backend -t j621-backend .
+```
+
+`J621-Frontend` builds the SPA and serves it as static files.
+`J621-Backend` is Django + gunicorn (migrations run on start) and includes
+ffmpeg for video thumbnails. The `GIT_HASH` build arg is baked into the
+backend image so the shell's version pill shows the commit (images have no
+`.git` directory); the push scripts pass it automatically.
+
+Push multi-arch images to the Gitea registry:
+
+```bash
+./push_all.sh              # or push_frontend.sh / push_backend.sh [sha]
+```
+
+They tag `:latest` and `:<commit-sha>` and expect `docker login
+gitea.rainbow-herring.ts.net` to succeed.
+
+## Tests
+
+The security/permission suite lives in `backend/apps/core/tests/`:
+
+```bash
+cd ../backend
+./venv/bin/python manage.py test apps.core.tests
+```
+
+It needs a one-time grant on the database user (test databases are created
+from scratch):
+
+```sql
+GRANT ALL ON `test_j621`.* TO 'j621'@'%';
+```
+
+## Notes
+
+- The nginx service is the only entry point: `/api`, `/admin`, `/static` and
+  `/health` go to the backend, everything else to the SPA. Both upstreams are
+  resolved at request time, so the same config works in all three variants.
+- The compose healthchecks use `/nginx-health` (nginx itself), `/health`
+  (Django + database) and the frontend's static server, so `depends_on:
+  condition: service_healthy` gates the sidecar on a working stack.
+- `deploy/data/media/library` is the watched folder; drop files there (or use
+  uploads) and run `manage.py scan_files` inside the backend container.

deploy/backend-entrypoint.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+# Apply migrations, then hand over to gunicorn.
+#
+# Workers/threads are modest on purpose: background jobs (downloads, scans)
+# live in daemon threads inside the worker and are reaped if a worker dies.
+set -e
+
+python manage.py migrate --noinput
+
+exec gunicorn config.wsgi:application \
+    --bind 0.0.0.0:8000 \
+    --workers "${GUNICORN_WORKERS:-2}" \
+    --threads "${GUNICORN_THREADS:-4}" \
+    --timeout "${GUNICORN_TIMEOUT:-120}" \
+    --access-logfile - \
+    --error-logfile -

deploy/compose.backend.yml

@@ -0,0 +1,109 @@
+# J621 — backend-only deployment: API + database + nginx proxy + Tailscale.
+#
+#   cd deploy && cp .env.example .env    # TS_AUTHKEY, SECRET_KEY, hosts, CORS
+#   docker compose -f compose.backend.yml up -d
+#
+# Funnel: https://<TS_HOSTNAME>.<tailnet>.ts.net:8443 (an allowed funnel port)
+# reaches the nginx service, which routes /api, /admin, /static and /health to
+# Django. "/" answers a small JSON hint because no frontend is attached.
+#
+# Because the frontend lives elsewhere it is cross-origin — set in .env:
+#   CORS_ALLOWED_ORIGINS=https://<frontend-host>.<tailnet>.ts.net
+#   CSRF_TRUSTED_ORIGINS=...   (same value; only needed for the admin)
+# and add this host to ALLOWED_HOSTS (comma separated list).
+
+name: j621-backend-deploy
+
+services:
+  mariadb:
+    image: mariadb:11.4
+    restart: unless-stopped
+    environment:
+      MARIADB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD:-j621root}
+      MARIADB_DATABASE: ${DB_NAME:-j621}
+      MARIADB_USER: ${DB_USER:-j621}
+      MARIADB_PASSWORD: ${DB_PASSWORD:-j621}
+    volumes:
+      - ./data/mariadb:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    command: ["redis-server", "--appendonly", "yes"]
+    volumes:
+      - ./data/redis:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  backend:
+    image: ${J621_REGISTRY:-gitea.rainbow-herring.ts.net/jakebreath}/j621-backend:${J621_TAG:-latest}
+    build:
+      context: ..
+      dockerfile: deploy/J621-Backend
+      # Bake the commit into the image so the shell's version pill shows it;
+      # the push scripts pass --build-arg themselves.
+      args:
+        GIT_HASH: ${GIT_HASH:-unknown}
+    restart: unless-stopped
+    env_file: [./.env]
+    environment:
+      DB_HOST: mariadb
+      DB_PORT: "3306"
+      REDIS_URL: redis://redis:6379/1
+      TRUST_PROXY_HEADERS: "true"
+    volumes:
+      - ./data/media:/app/media
+      - ./data/logs:/app/logs
+    depends_on:
+      mariadb:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+  nginx:
+    image: nginx:1.29-alpine
+    restart: unless-stopped
+    volumes:
+      - ./nginx-proxy.conf:/etc/nginx/conf.d/default.conf:ro
+    depends_on:
+      backend:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1/nginx-health || exit 1"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
+      start_period: 10s
+
+  tailscale:
+    image: tailscale/tailscale:latest
+    restart: unless-stopped
+    # Shares the nginx service's network namespace: 127.0.0.1:80 is the proxy.
+    network_mode: "service:nginx"
+    environment:
+      TS_AUTHKEY: ${TS_AUTHKEY:?Set TS_AUTHKEY in deploy/.env}
+      TS_HOSTNAME: ${TS_HOSTNAME:-j621-backend}
+      TS_AUTH_ONCE: "true"
+      TS_STATE_DIR: /var/lib/tailscale
+      TS_SERVE_CONFIG: /config/serve.json
+    volumes:
+      - ./tailscale-state:/var/lib/tailscale
+      - ./serve.backend.json:/config/serve.json:ro
+      - /etc/ssl/certs:/etc/ssl/certs:ro
+    depends_on:
+      nginx:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "tailscale", "status"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s

deploy/compose.frontend.yml

@@ -0,0 +1,62 @@
+# J621 — frontend-only deployment: SPA + nginx proxy + Tailscale sidecar.
+#
+#   cd deploy && cp .env.example .env    # TS_AUTHKEY at minimum
+#   docker compose -f compose.frontend.yml up -d
+#
+# Funnel: https://<TS_HOSTNAME>.<tailnet>.ts.net (443) serves the SPA.
+# On first start the SPA asks for a backend (/setup): point it at a
+# backend-only deployment (e.g. https://j621-backend.<tailnet>.ts.net:8443),
+# leave it blank to serve one yourself, or stay in local mode.
+#
+# There is no backend in this compose, so /api answers 502 here until the SPA
+# is configured to call one elsewhere.
+
+name: j621-frontend-deploy
+
+services:
+  frontend:
+    image: ${J621_REGISTRY:-gitea.rainbow-herring.ts.net/jakebreath}/j621-frontend:${J621_TAG:-latest}
+    build:
+      context: ..
+      dockerfile: deploy/J621-Frontend
+    restart: unless-stopped
+
+  nginx:
+    image: nginx:1.29-alpine
+    restart: unless-stopped
+    volumes:
+      - ./nginx-proxy.conf:/etc/nginx/conf.d/default.conf:ro
+    depends_on:
+      frontend:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1/nginx-health || exit 1"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
+      start_period: 10s
+
+  tailscale:
+    image: tailscale/tailscale:latest
+    restart: unless-stopped
+    # Shares the nginx service's network namespace: 127.0.0.1:80 is the proxy.
+    network_mode: "service:nginx"
+    environment:
+      TS_AUTHKEY: ${TS_AUTHKEY:?Set TS_AUTHKEY in deploy/.env}
+      TS_HOSTNAME: ${TS_HOSTNAME:-j621-frontend}
+      TS_AUTH_ONCE: "true"
+      TS_STATE_DIR: /var/lib/tailscale
+      TS_SERVE_CONFIG: /config/serve.json
+    volumes:
+      - ./tailscale-state:/var/lib/tailscale
+      - ./serve.frontend.json:/config/serve.json:ro
+      - /etc/ssl/certs:/etc/ssl/certs:ro
+    depends_on:
+      nginx:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "tailscale", "status"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s

deploy/compose.yml

@@ -0,0 +1,116 @@
+# J621 — default deployment: frontend + backend + database on one Tailscale
+# host, behind the nginx proxy service (no host nginx, nothing published on
+# the host's ports).
+#
+#   cd deploy && cp .env.example .env    # fill in TS_AUTHKEY, SECRET_KEY, ...
+#   docker compose up -d                 # or: docker compose -f compose.yml up -d
+#
+# The funnel serves https://<TS_HOSTNAME>.<tailnet>.ts.net (port 443) to the
+# nginx service, which routes /api, /admin, /static and /health to the
+# backend and everything else to the SPA. Same origin, so no CORS needed.
+
+name: j621-deploy
+
+services:
+  mariadb:
+    image: mariadb:11.4
+    restart: unless-stopped
+    environment:
+      MARIADB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD:-j621root}
+      MARIADB_DATABASE: ${DB_NAME:-j621}
+      MARIADB_USER: ${DB_USER:-j621}
+      MARIADB_PASSWORD: ${DB_PASSWORD:-j621}
+    volumes:
+      - ./data/mariadb:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    command: ["redis-server", "--appendonly", "yes"]
+    volumes:
+      - ./data/redis:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  backend:
+    image: ${J621_REGISTRY:-gitea.rainbow-herring.ts.net/jakebreath}/j621-backend:${J621_TAG:-latest}
+    build:
+      context: ..
+      dockerfile: deploy/J621-Backend
+      # Bake the commit into the image so the shell's version pill shows it;
+      # the push scripts pass --build-arg themselves.
+      args:
+        GIT_HASH: ${GIT_HASH:-unknown}
+    restart: unless-stopped
+    env_file: [./.env]
+    environment:
+      DB_HOST: mariadb
+      DB_PORT: "3306"
+      REDIS_URL: redis://redis:6379/1
+      # The tailnet funnel terminates TLS and forwards the original host/proto.
+      TRUST_PROXY_HEADERS: "true"
+    volumes:
+      - ./data/media:/app/media
+      - ./data/logs:/app/logs
+    depends_on:
+      mariadb:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+  frontend:
+    image: ${J621_REGISTRY:-gitea.rainbow-herring.ts.net/jakebreath}/j621-frontend:${J621_TAG:-latest}
+    build:
+      context: ..
+      dockerfile: deploy/J621-Frontend
+    restart: unless-stopped
+
+  nginx:
+    image: nginx:1.29-alpine
+    restart: unless-stopped
+    volumes:
+      - ./nginx-proxy.conf:/etc/nginx/conf.d/default.conf:ro
+    depends_on:
+      backend:
+        condition: service_healthy
+      frontend:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1/nginx-health || exit 1"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
+      start_period: 10s
+
+  tailscale:
+    image: tailscale/tailscale:latest
+    restart: unless-stopped
+    # Shares the nginx service's network namespace: 127.0.0.1:80 is the proxy.
+    network_mode: "service:nginx"
+    environment:
+      TS_AUTHKEY: ${TS_AUTHKEY:?Set TS_AUTHKEY in deploy/.env}
+      TS_HOSTNAME: ${TS_HOSTNAME:-j621}
+      TS_AUTH_ONCE: "true"
+      TS_STATE_DIR: /var/lib/tailscale
+      TS_SERVE_CONFIG: /config/serve.json
+    volumes:
+      - ./tailscale-state:/var/lib/tailscale
+      - ./serve.default.json:/config/serve.json:ro
+      - /etc/ssl/certs:/etc/ssl/certs:ro
+    depends_on:
+      nginx:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "tailscale", "status"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s

deploy/nginx-frontend.conf

@@ -0,0 +1,30 @@
+# Static file server for the built SPA (inside the frontend image).
+# Routing / API proxying is done by the separate nginx service.
+
+server {
+    listen 80;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    gzip on;
+    gzip_types text/css application/javascript application/json image/svg+xml;
+    gzip_min_length 1024;
+
+    location = /nginx-health {
+        access_log off;
+        return 200 "ok\n";
+    }
+
+    # Client-side routes: everything that is not a real file gets index.html.
+    location / {
+        try_files $uri /index.html;
+    }
+
+    # Hashed build assets can be cached hard.
+    location /assets/ {
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+    }
+}

deploy/nginx-proxy.conf

@@ -0,0 +1,65 @@
+# J621 public entry point (the "nginx" service in the compose files).
+#
+# Routes:
+#   /api, /admin, /static, /health  -> backend:8000  (Django / gunicorn)
+#   everything else                 -> frontend:80   (SPA static files)
+#
+# Both upstreams are variables so the same file works in all three compose
+# variants: with no frontend on the network "/" answers a small JSON hint,
+# with no backend the API paths answer 502 until one is configured via /setup.
+# Nothing is published to the host; the Tailscale sidecar shares this
+# container's network namespace and funnels to 127.0.0.1:80.
+
+resolver 127.0.0.11 valid=10s ipv6=off;
+
+map $http_x_forwarded_proto $j621_forwarded_proto {
+    default $http_x_forwarded_proto;
+    ""      $scheme;
+}
+
+server {
+    listen 80;
+    server_name _;
+
+    location = /nginx-health {
+        access_log off;
+        return 200 "ok\n";
+    }
+
+    location ~ ^/(api|admin|static|health)(/|$) {
+        set $j621_backend http://backend:8000;
+        proxy_pass $j621_backend$request_uri;
+
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Proto $j621_forwarded_proto;
+
+        # Uploads and client-processed files can be large; stream them.
+        client_max_body_size 2048m;
+        proxy_request_buffering off;
+        proxy_read_timeout 600s;
+        proxy_send_timeout 600s;
+    }
+
+    location / {
+        set $j621_frontend http://frontend:80;
+        proxy_pass $j621_frontend$request_uri;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Proto $j621_forwarded_proto;
+
+        # Backend-only deployments have no frontend: say so instead of 502.
+        error_page 502 503 504 = @j621_no_frontend;
+    }
+
+    location @j621_no_frontend {
+        default_type application/json;
+        return 200 '{"detail":"J621 API - no frontend is attached to this deployment."}';
+    }
+}

deploy/push_all.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+# Build and push both J621 images (frontend + backend) to the Gitea registry.
+#
+# Usage: ./push_all.sh [commit-sha]
+set -euo pipefail
+cd "$(dirname "$0")"
+
+SHA="${1:-$(git rev-parse --short HEAD)}"
+
+./push_frontend.sh "$SHA"
+./push_backend.sh "$SHA"
+
+echo "==> Both images pushed with tag '$SHA' (and :latest)."

deploy/push_backend.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+# Build and push the J621 backend image (amd64 + arm64) to the private Gitea
+# registry as :latest and :<commit-sha>.
+#
+# Usage: ./push_backend.sh [commit-sha]
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+REGISTRY="gitea.rainbow-herring.ts.net/jakebreath/j621-backend"
+REGISTRY_HOST="$(printf '%s' "$REGISTRY" | cut -d/ -f1)"
+SHA="${1:-$(git rev-parse --short HEAD)}"
+BUILDER=multiarch
+PLATFORMS="linux/amd64,linux/arm64"
+
+echo "==> Logging in to $REGISTRY_HOST ..."
+docker login "$REGISTRY_HOST"
+
+if ! docker buildx inspect "$BUILDER" >/dev/null 2>&1; then
+    echo "==> Creating buildx builder '$BUILDER' ..."
+    docker buildx create --name "$BUILDER" --driver docker-container \
+        --platform "$PLATFORMS" --bootstrap
+else
+    docker buildx inspect --bootstrap "$BUILDER" >/dev/null
+fi
+
+echo "==> Building + pushing $PLATFORMS -> $REGISTRY:{latest,$SHA} ..."
+docker buildx build --builder "$BUILDER" --push \
+    --platform "$PLATFORMS" \
+    --build-arg "GIT_HASH=$SHA" \
+    -f deploy/J621-Backend \
+    -t "$REGISTRY:latest" \
+    -t "$REGISTRY:$SHA" \
+    .
+
+echo "==> Done. On the deploy host:"
+echo "    docker login $REGISTRY_HOST && docker compose pull && docker compose up -d"

deploy/push_frontend.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+# Build and push the J621 frontend image (amd64 + arm64) to the private Gitea
+# registry as :latest and :<commit-sha>.
+#
+# Usage: ./push_frontend.sh [commit-sha]
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+REGISTRY="gitea.rainbow-herring.ts.net/jakebreath/j621-frontend"
+REGISTRY_HOST="$(printf '%s' "$REGISTRY" | cut -d/ -f1)"
+SHA="${1:-$(git rev-parse --short HEAD)}"
+BUILDER=multiarch
+PLATFORMS="linux/amd64,linux/arm64"
+
+echo "==> Logging in to $REGISTRY_HOST ..."
+docker login "$REGISTRY_HOST"
+
+if ! docker buildx inspect "$BUILDER" >/dev/null 2>&1; then
+    echo "==> Creating buildx builder '$BUILDER' ..."
+    docker buildx create --name "$BUILDER" --driver docker-container \
+        --platform "$PLATFORMS" --bootstrap
+else
+    docker buildx inspect --bootstrap "$BUILDER" >/dev/null
+fi
+
+echo "==> Building + pushing $PLATFORMS -> $REGISTRY:{latest,$SHA} ..."
+docker buildx build --builder "$BUILDER" --push \
+    --platform "$PLATFORMS" \
+    -f deploy/J621-Frontend \
+    -t "$REGISTRY:latest" \
+    -t "$REGISTRY:$SHA" \
+    .
+
+echo "==> Done. On the deploy host:"
+echo "    docker login $REGISTRY_HOST && docker compose pull && docker compose up -d"

deploy/serve.backend.json

@@ -0,0 +1,19 @@
+{
+  "TCP": {
+    "8443": {
+      "HTTPS": true
+    }
+  },
+  "Web": {
+    "${TS_CERT_DOMAIN}:8443": {
+      "Handlers": {
+        "/": {
+          "Proxy": "http://127.0.0.1:80"
+        }
+      }
+    }
+  },
+  "AllowFunnel": {
+    "${TS_CERT_DOMAIN}:8443": true
+  }
+}

deploy/serve.default.json

@@ -0,0 +1,19 @@
+{
+  "TCP": {
+    "443": {
+      "HTTPS": true
+    }
+  },
+  "Web": {
+    "${TS_CERT_DOMAIN}:443": {
+      "Handlers": {
+        "/": {
+          "Proxy": "http://127.0.0.1:80"
+        }
+      }
+    }
+  },
+  "AllowFunnel": {
+    "${TS_CERT_DOMAIN}:443": true
+  }
+}

deploy/serve.frontend.json

@@ -0,0 +1,19 @@
+{
+  "TCP": {
+    "443": {
+      "HTTPS": true
+    }
+  },
+  "Web": {
+    "${TS_CERT_DOMAIN}:443": {
+      "Handlers": {
+        "/": {
+          "Proxy": "http://127.0.0.1:80"
+        }
+      }
+    }
+  },
+  "AllowFunnel": {
+    "${TS_CERT_DOMAIN}:443": true
+  }
+}