JakeBreath
8ebda6ab20
Test suite (the manual audit harness, now a real test):
- backend/apps/core/tests/test_security.py: 20 transactional tests across
guest visibility, object ownership, staged-upload/similarity privacy,
staff role boundaries, deletion rules, encrypted credentials, throttling
and the download allowlist. Uses temp media folders and clears cache.
Needs a one-time GRANT on test_j621 (documented in the module + README).
Images (deploy/J621-Frontend, deploy/J621-Backend, repo root as context):
- Frontend: node build -> static nginx with SPA fallback, asset caching and
an internal health endpoint.
- Backend: gunicorn + whitenoise (admin static collected at build), ffmpeg
for video thumbnails, migrations applied on start, GIT_HASH build arg so
the shell's version pill shows the commit.
Composes (distinct project names so they coexist with the dev stack):
- compose.yml (both), compose.frontend.yml, compose.backend.yml.
- A shared nginx proxy service is the only entry point (no host nginx, no
published host ports): /api,/admin,/static,/health -> backend, everything
else -> SPA; both upstreams resolve at request time so one config serves
all variants.
- A Tailscale sidecar per compose shares the nginx network namespace;
serve.default/frontend/backend.json use funnel ports 443 and 8443 only
(10000 is the remaining allowance) with ${TS_CERT_DOMAIN} substitution.
Registry: push_frontend.sh / push_backend.sh / push_all.sh build multi-arch
images and push :latest + :<sha> to the Gitea registry, following the
existing Packs-site pattern.
Docs: deploy/README.md + .env.example, ROADMAP section 6 updated,
AGENTS.md deployment and test notes.
Verified: all three composes validate, both nginx configs pass nginx -t,
both images build, the combined stack boots against real MariaDB/Redis
(migrations applied, /health ok, whitenoise serving admin static, env=prod,
git hash baked in), the proxy serves the SPA and routes /api, and
manage.py test apps.core.tests passes 20/20.
41 lines
1.2 KiB
Plaintext
41 lines
1.2 KiB
Plaintext
# J621-Backend — Django + gunicorn, with migrations applied on start.
|
|
#
|
|
# Build context is the repository root, e.g.:
|
|
# docker build -f deploy/J621-Backend -t j621-backend .
|
|
#
|
|
# Needs MariaDB and Redis (see the compose files). ffmpeg is used for video
|
|
# thumbnails; media/logs live under the mounted volumes.
|
|
|
|
# syntax=docker/dockerfile:1
|
|
|
|
FROM python:3.14-slim
|
|
|
|
# Baked in by the push scripts so the shell's version pill shows the commit
|
|
# even though the image has no .git directory.
|
|
ARG GIT_HASH=unknown
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
GIT_COMMIT_HASH=$GIT_HASH
|
|
|
|
WORKDIR /app
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ffmpeg \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY backend/requirements.txt ./
|
|
RUN pip install --no-cache-dir -r requirements.txt
|
|
|
|
COPY backend/ ./
|
|
COPY deploy/backend-entrypoint.sh /usr/local/bin/j621-entrypoint
|
|
|
|
RUN chmod +x /usr/local/bin/j621-entrypoint \
|
|
&& mkdir -p /app/media /app/logs \
|
|
&& python manage.py collectstatic --noinput
|
|
|
|
EXPOSE 8000
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s \
|
|
CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health')" || exit 1
|
|
|
|
ENTRYPOINT ["j621-entrypoint"]
|