Phase 0: repo skeleton, image, compose stacks, doctor, migration runner, frontend shell
New repo for the Packet Station rebuild (Python 3.12, FastAPI, PostgreSQL 16, React, VisualKit, MFilesKit, Docker Compose on docker-1). Nothing is migrated from the M: install. - CLAUDE.md with the safety rules, README, CHANGELOG, docs (BRIEF, PLAN, SECURITY rewritten for the server with the requirement ID table, DEPLOY, stubs for FEED, POLICY, SCHEMA, GO-LIVE, PAPER-FALLBACK). - packetstation CLI: app, worker (heartbeat stub), migrate, doctor, version, healthcheck. Settings from the environment with secret files. Stack guard (test never points at VISUAL production). Security headers and CSP. Trusted proxy resolved by name. JSON logs with redaction. - Migration runner and 0001_base: settings, append-only audit_events with hash chain, ps_notify, grants for ps_app. - Multi-stage Dockerfile (ODBC Driver 18, PESCO libraries from the Gitea index only), compose base, proxy overlay for npm_default, CI overlay, postgres initdb roles, env examples, NPM proxy host notes, Gitea Actions. - Frontend: Vite, React, TypeScript, the PESCO dark theme ported with self-hosted fonts, placeholder sign-in and home. - Verified on docker-1: image builds, CI stack comes up healthy, doctor database checks pass, 77 server tests pass against PostgreSQL. Co-Authored-By: Claude Fable 5.1 <[email protected]>
This commit is contained in:
Claude Fable 5.1
@@ -0,0 +1,118 @@
|
||||
# CI stack settings. Committed on purpose: it holds no secret.
|
||||
# Secrets come from ci/ci-secrets/, made fresh by ci/make-secrets.sh on every run.
|
||||
# Relative paths resolve against deploy/, the compose project directory.
|
||||
# CI never reaches VISUAL, M-Files, AD or the mail relay. Phase 1 adds the Samba DC and fixtures.
|
||||
|
||||
# ---- Compose (read by docker compose; also passed to the containers, which ignore them) ----
|
||||
# Compose project name. Keeps prod and test volumes apart.
|
||||
PROJECT_NAME=packetstation-ci
|
||||
# This file's own path. Compose hands it to the containers as env_file.
|
||||
ENV_FILE=./ci/ci.env
|
||||
# Image to run. Always a tested release tag, never latest.
|
||||
IMAGE=packetstation:ci
|
||||
# Host folder of secret files, root:10001 mode 0440.
|
||||
SECRETS_DIR=./ci/ci-secrets
|
||||
# Host PEM file with the PESCO CA chain. Mounted at /etc/ssl/pesco/ca.pem.
|
||||
CA_BUNDLE_FILE=./ci/ci-secrets/ca.pem
|
||||
# Host backup folder, mounted read-only in the worker. Compose sets BACKUP_DIR=/backups inside.
|
||||
BACKUP_DIR=./ci/ci-backups
|
||||
|
||||
# ---- Stack and site ----
|
||||
# prod, test, ci or dev. Guards against crossing stacks.
|
||||
STACK=ci
|
||||
# Site key.
|
||||
SITE_ID=PESCO
|
||||
# Site time zone for schedules and display. Containers run in UTC.
|
||||
SITE_TZ=America/Denver
|
||||
# Public URL, used in links and mail.
|
||||
PUBLIC_URL=http://app:8000
|
||||
# Only this container may set X-Forwarded-*. The app re-resolves it. Empty trusts nobody.
|
||||
TRUSTED_PROXY_HOST=
|
||||
# DEBUG, INFO, WARNING or ERROR. Logs go to stdout.
|
||||
LOG_LEVEL=DEBUG
|
||||
# Worker heartbeat file read by its healthcheck. /tmp is a tmpfs.
|
||||
WORKER_BEAT_FILE=/tmp/packetstation-worker.beat
|
||||
|
||||
# ---- PostgreSQL (roles made by deploy/postgres/initdb/01-roles.sh) ----
|
||||
# postgres alias on the internal backend network.
|
||||
PG_HOST=packetstation-postgres
|
||||
# PostgreSQL port.
|
||||
PG_PORT=5432
|
||||
# Database name.
|
||||
PG_DATABASE=packetstation
|
||||
# Runtime role for the app and worker.
|
||||
PG_APP_USER=ps_app
|
||||
# Its password, from the compose secret.
|
||||
PG_APP_PASSWORD_FILE=/run/secrets/postgres_app_password
|
||||
# Schema owner. Used by migrate only.
|
||||
PG_MIGRATE_USER=ps_migrate
|
||||
# Its password, from the compose secret.
|
||||
PG_MIGRATE_PASSWORD_FILE=/run/secrets/postgres_migrate_password
|
||||
|
||||
# ---- Keys and paths inside the container ----
|
||||
# Session signing key.
|
||||
SESSION_KEY_FILE=/run/secrets/session_key
|
||||
# HMAC key for record seals.
|
||||
SEAL_KEY_FILE=/run/secrets/seal_key
|
||||
# Assets volume. Compose sets it too.
|
||||
ASSETS_DIR=/data/assets
|
||||
# Built frontend. Compose sets it too.
|
||||
STATIC_DIR=/app/static
|
||||
|
||||
# ---- LDAP (PESCO Active Directory; CI gets the Samba DC in phase 1) ----
|
||||
# Both domain controllers, tried in order.
|
||||
LDAP_URL=
|
||||
# Search base for users.
|
||||
LDAP_BASE_DN=
|
||||
# Service account for searches.
|
||||
LDAP_BIND_DN=
|
||||
# Service account password, from the compose secret.
|
||||
LDAP_PASSWORD_FILE=/run/secrets/ldap_bind_password
|
||||
# User search filter. {0} is the escaped sign-in name.
|
||||
LDAP_USER_FILTER="(|(sAMAccountName={0})(userPrincipalName={0}))"
|
||||
# OU that holds the 50 PS-* groups.
|
||||
LDAP_GROUP_BASE_DN=
|
||||
# CA chain used to verify the controllers.
|
||||
LDAP_CA_BUNDLE=/etc/ssl/pesco/ca.pem
|
||||
# false with ldaps://. true only with ldap:// on 389.
|
||||
LDAP_STARTTLS=false
|
||||
# Never true outside local development.
|
||||
LDAP_ALLOW_INSECURE=false
|
||||
|
||||
# ---- Mail (relay app-03, no auth) ----
|
||||
# Relay host. Empty disables mail.
|
||||
SMTP_HOST=
|
||||
# Relay port.
|
||||
SMTP_PORT=25
|
||||
# Sender address.
|
||||
SMTP_FROM=[email protected]
|
||||
# Require STARTTLS.
|
||||
SMTP_STARTTLS=true
|
||||
# CA chain used to verify the relay.
|
||||
SMTP_CA_BUNDLE=/etc/ssl/pesco/ca.pem
|
||||
# true logs notifications and sends nothing.
|
||||
NOTIFY_DRY_RUN=true
|
||||
|
||||
# ---- VisualKit (VISUAL ERP, read only) ----
|
||||
# SQL Server instance. Full name: containers have no search domain.
|
||||
VISUAL_SERVER=
|
||||
# VISUAL database.
|
||||
VISUAL_DATABASE=
|
||||
# Read-only SQL login.
|
||||
VISUAL_USER=visualkit_ro
|
||||
# Its password, from the compose secret.
|
||||
VISUAL_PASSWORD_FILE=/run/secrets/visualkit_password
|
||||
# no until vsql has a trusted certificate (open question 6).
|
||||
VISUAL_ENCRYPT=no
|
||||
# ODBC driver name installed in the image.
|
||||
VISUAL_DRIVER="ODBC Driver 18 for SQL Server"
|
||||
|
||||
# ---- MFilesKit (M-Files, read only; there is no test vault, so test reads production) ----
|
||||
# M-Files REST endpoint.
|
||||
MFILES_URL=
|
||||
# Vault GUID.
|
||||
MFILES_VAULT_GUID=
|
||||
# Read-only user. The entrypoint exports MFILES_PASSWORD from its secret file.
|
||||
MFILES_USERNAME=
|
||||
# CA chain used to verify M-Files.
|
||||
MFILES_CA_BUNDLE=/etc/ssl/pesco/ca.pem
|
||||
Reference in New Issue
Block a user