JakeBreath
8ebda6ab20
Test suite (the manual audit harness, now a real test):
- backend/apps/core/tests/test_security.py: 20 transactional tests across
guest visibility, object ownership, staged-upload/similarity privacy,
staff role boundaries, deletion rules, encrypted credentials, throttling
and the download allowlist. Uses temp media folders and clears cache.
Needs a one-time GRANT on test_j621 (documented in the module + README).
Images (deploy/J621-Frontend, deploy/J621-Backend, repo root as context):
- Frontend: node build -> static nginx with SPA fallback, asset caching and
an internal health endpoint.
- Backend: gunicorn + whitenoise (admin static collected at build), ffmpeg
for video thumbnails, migrations applied on start, GIT_HASH build arg so
the shell's version pill shows the commit.
Composes (distinct project names so they coexist with the dev stack):
- compose.yml (both), compose.frontend.yml, compose.backend.yml.
- A shared nginx proxy service is the only entry point (no host nginx, no
published host ports): /api,/admin,/static,/health -> backend, everything
else -> SPA; both upstreams resolve at request time so one config serves
all variants.
- A Tailscale sidecar per compose shares the nginx network namespace;
serve.default/frontend/backend.json use funnel ports 443 and 8443 only
(10000 is the remaining allowance) with ${TS_CERT_DOMAIN} substitution.
Registry: push_frontend.sh / push_backend.sh / push_all.sh build multi-arch
images and push :latest + :<sha> to the Gitea registry, following the
existing Packs-site pattern.
Docs: deploy/README.md + .env.example, ROADMAP section 6 updated,
AGENTS.md deployment and test notes.
Verified: all three composes validate, both nginx configs pass nginx -t,
both images build, the combined stack boots against real MariaDB/Redis
(migrations applied, /health ok, whitenoise serving admin static, env=prod,
git hash baked in), the proxy serves the SPA and routes /api, and
manage.py test apps.core.tests passes 20/20.
110 lines
3.3 KiB
YAML
110 lines
3.3 KiB
YAML
# J621 — backend-only deployment: API + database + nginx proxy + Tailscale.
|
|
#
|
|
# cd deploy && cp .env.example .env # TS_AUTHKEY, SECRET_KEY, hosts, CORS
|
|
# docker compose -f compose.backend.yml up -d
|
|
#
|
|
# Funnel: https://<TS_HOSTNAME>.<tailnet>.ts.net:8443 (an allowed funnel port)
|
|
# reaches the nginx service, which routes /api, /admin, /static and /health to
|
|
# Django. "/" answers a small JSON hint because no frontend is attached.
|
|
#
|
|
# Because the frontend lives elsewhere it is cross-origin — set in .env:
|
|
# CORS_ALLOWED_ORIGINS=https://<frontend-host>.<tailnet>.ts.net
|
|
# CSRF_TRUSTED_ORIGINS=... (same value; only needed for the admin)
|
|
# and add this host to ALLOWED_HOSTS (comma separated list).
|
|
|
|
name: j621-backend-deploy
|
|
|
|
services:
|
|
mariadb:
|
|
image: mariadb:11.4
|
|
restart: unless-stopped
|
|
environment:
|
|
MARIADB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD:-j621root}
|
|
MARIADB_DATABASE: ${DB_NAME:-j621}
|
|
MARIADB_USER: ${DB_USER:-j621}
|
|
MARIADB_PASSWORD: ${DB_PASSWORD:-j621}
|
|
volumes:
|
|
- ./data/mariadb:/var/lib/mysql
|
|
healthcheck:
|
|
test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 20
|
|
|
|
redis:
|
|
image: redis:7-alpine
|
|
restart: unless-stopped
|
|
command: ["redis-server", "--appendonly", "yes"]
|
|
volumes:
|
|
- ./data/redis:/data
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 20
|
|
|
|
backend:
|
|
image: ${J621_REGISTRY:-gitea.rainbow-herring.ts.net/jakebreath}/j621-backend:${J621_TAG:-latest}
|
|
build:
|
|
context: ..
|
|
dockerfile: deploy/J621-Backend
|
|
# Bake the commit into the image so the shell's version pill shows it;
|
|
# the push scripts pass --build-arg themselves.
|
|
args:
|
|
GIT_HASH: ${GIT_HASH:-unknown}
|
|
restart: unless-stopped
|
|
env_file: [./.env]
|
|
environment:
|
|
DB_HOST: mariadb
|
|
DB_PORT: "3306"
|
|
REDIS_URL: redis://redis:6379/1
|
|
TRUST_PROXY_HEADERS: "true"
|
|
volumes:
|
|
- ./data/media:/app/media
|
|
- ./data/logs:/app/logs
|
|
depends_on:
|
|
mariadb:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
|
|
nginx:
|
|
image: nginx:1.29-alpine
|
|
restart: unless-stopped
|
|
volumes:
|
|
- ./nginx-proxy.conf:/etc/nginx/conf.d/default.conf:ro
|
|
depends_on:
|
|
backend:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1/nginx-health || exit 1"]
|
|
interval: 30s
|
|
timeout: 3s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
tailscale:
|
|
image: tailscale/tailscale:latest
|
|
restart: unless-stopped
|
|
# Shares the nginx service's network namespace: 127.0.0.1:80 is the proxy.
|
|
network_mode: "service:nginx"
|
|
environment:
|
|
TS_AUTHKEY: ${TS_AUTHKEY:?Set TS_AUTHKEY in deploy/.env}
|
|
TS_HOSTNAME: ${TS_HOSTNAME:-j621-backend}
|
|
TS_AUTH_ONCE: "true"
|
|
TS_STATE_DIR: /var/lib/tailscale
|
|
TS_SERVE_CONFIG: /config/serve.json
|
|
volumes:
|
|
- ./tailscale-state:/var/lib/tailscale
|
|
- ./serve.backend.json:/config/serve.json:ro
|
|
- /etc/ssl/certs:/etc/ssl/certs:ro
|
|
depends_on:
|
|
nginx:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD", "tailscale", "status"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|