spencermandClaude Fable 5.1
591fe90076
Migration 0004 (VISUAL and drawing caches, go-live ignored list, resource map, job tables, order-derived columns with provenance; work order key includes the operation sequence). The real worker on APScheduler with settings re-read each fire, pause, run now, advisory locks, job_runs and a heartbeat. The visual-feed job (five VisualKit reads, COPY and MERGE cache, suspect-batch guard, the apply in one transaction: drafts, change orders, retire-moved, work order gone, closed and cancelled observed, projects and units from order links, auto-release) and the fingerprint. The drawing-lookup job (queue, budget, download on version change, sha256 into assets, decision table, staging for rev approval, drawing-origin change orders). Clerical From VISUAL panel, flags, rev approval, hand uploads, change-order review; Admin Feed settings and resource map. Synthetic fixture generator and a fixture-driven worker in CI with a Playwright scenario. Docs updated. Verified: 3249 server tests and 13 Playwright scenarios on the docker-1 CI stack, 76 frontend tests, doctor at 0004; one feed and one drawing run against VISUAL DEV and the vault from the developer machine (counts in the changelog). Co-Authored-By: Claude Fable 5.1 <[email protected]>
129 lines
5.0 KiB
Bash
129 lines
5.0 KiB
Bash
# CI stack settings. Committed on purpose: it holds no secret.
|
|
# Secrets come from ci/ci-secrets/, made fresh by ci/make-secrets.sh on every run.
|
|
# Relative paths resolve against deploy/, the compose project directory.
|
|
# CI never reaches VISUAL, M-Files, PESCO's AD or the mail relay. LDAP goes to the throwaway
|
|
# Samba DC in compose.ci.yaml.
|
|
|
|
# ---- Compose (read by docker compose; also passed to the containers, which ignore them) ----
|
|
# Compose project name. Keeps prod and test volumes apart.
|
|
PROJECT_NAME=packetstation-ci
|
|
# This file's own path. Compose hands it to the containers as env_file.
|
|
ENV_FILE=./ci/ci.env
|
|
# Image to run. Always a tested release tag, never latest.
|
|
IMAGE=packetstation:ci
|
|
# Host folder of secret files, root:10001 mode 0440.
|
|
SECRETS_DIR=./ci/ci-secrets
|
|
# Host PEM file with the PESCO CA chain. Mounted at /etc/ssl/pesco/ca.pem.
|
|
CA_BUNDLE_FILE=./ci/ci-secrets/ca.pem
|
|
# Host backup folder, mounted read-only in the worker. Compose sets BACKUP_DIR=/backups inside.
|
|
BACKUP_DIR=./ci/ci-backups
|
|
|
|
# ---- Stack and site ----
|
|
# prod, test, ci or dev. Guards against crossing stacks.
|
|
STACK=ci
|
|
# Site key.
|
|
SITE_ID=PESCO
|
|
# Site time zone for schedules and display. Containers run in UTC.
|
|
SITE_TZ=America/Denver
|
|
# Public URL, used in links and mail.
|
|
PUBLIC_URL=http://ps-app:8000
|
|
# Only this container may set X-Forwarded-*. The app re-resolves it. Empty trusts nobody.
|
|
TRUSTED_PROXY_HOST=
|
|
# DEBUG, INFO, WARNING or ERROR. Logs go to stdout.
|
|
LOG_LEVEL=DEBUG
|
|
# Worker heartbeat file read by its healthcheck. /tmp is a tmpfs.
|
|
WORKER_BEAT_FILE=/tmp/packetstation-worker.beat
|
|
|
|
# ---- PostgreSQL (roles made by deploy/postgres/initdb/01-roles.sh) ----
|
|
# postgres alias on the internal backend network.
|
|
PG_HOST=packetstation-postgres
|
|
# PostgreSQL port.
|
|
PG_PORT=5432
|
|
# Database name.
|
|
PG_DATABASE=packetstation
|
|
# Runtime role for the app and worker.
|
|
PG_APP_USER=ps_app
|
|
# Its password, from the compose secret.
|
|
PG_APP_PASSWORD_FILE=/run/secrets/postgres_app_password
|
|
# Schema owner. Used by migrate only.
|
|
PG_MIGRATE_USER=ps_migrate
|
|
# Its password, from the compose secret.
|
|
PG_MIGRATE_PASSWORD_FILE=/run/secrets/postgres_migrate_password
|
|
|
|
# ---- Keys and paths inside the container ----
|
|
# Session signing key.
|
|
SESSION_KEY_FILE=/run/secrets/session_key
|
|
# HMAC key for record seals.
|
|
SEAL_KEY_FILE=/run/secrets/seal_key
|
|
# Assets volume. Compose sets it too.
|
|
ASSETS_DIR=/data/assets
|
|
# Built frontend. Compose sets it too.
|
|
STATIC_DIR=/app/static
|
|
|
|
# ---- LDAP (the throwaway Samba DC from deploy/samba, domain PSTEST.LOCAL; never PESCO's AD) ----
|
|
# The DC's alias on the backend network. LDAPS with the CA it generates on first start.
|
|
LDAP_URL=ldaps://dc1.pstest.local:636
|
|
# Search base for users.
|
|
LDAP_BASE_DN=DC=pstest,DC=local
|
|
# Service account for searches. seed.sh sets its password from the ldap_bind_password secret.
|
|
LDAP_BIND_DN=CN=svc-packetstation,OU=System_Accounts,OU=Admin,DC=pstest,DC=local
|
|
# Service account password, from the compose secret.
|
|
LDAP_PASSWORD_FILE=/run/secrets/ldap_bind_password
|
|
# User search filter. {0} is the escaped sign-in name.
|
|
LDAP_USER_FILTER="(|(sAMAccountName={0})(userPrincipalName={0}))"
|
|
# OU that holds the PS-* groups (49 of the 50 plus one extra, on purpose).
|
|
LDAP_GROUP_BASE_DN=OU=PacketStation,OU=Groups,OU=PESCO_FARMINGTON,DC=pstest,DC=local
|
|
# The DC's CA, from the ci-dc-export volume mounted at /etc/ssl/pstest.
|
|
LDAP_CA_BUNDLE=/etc/ssl/pstest/ca.pem
|
|
# false with ldaps://. true only with ldap:// on 389.
|
|
LDAP_STARTTLS=false
|
|
# Never true outside local development. The DC refuses plain LDAP simple binds anyway.
|
|
LDAP_ALLOW_INSECURE=false
|
|
|
|
# ---- Mail (relay app-03, no auth) ----
|
|
# Relay host. Empty disables mail.
|
|
SMTP_HOST=
|
|
# Relay port.
|
|
SMTP_PORT=25
|
|
# Sender address.
|
|
SMTP_FROM=[email protected]
|
|
# Require STARTTLS.
|
|
SMTP_STARTTLS=true
|
|
# CA chain used to verify the relay.
|
|
SMTP_CA_BUNDLE=/etc/ssl/pesco/ca.pem
|
|
# true logs notifications and sends nothing.
|
|
NOTIFY_DRY_RUN=true
|
|
|
|
# ---- Worker sources ----
|
|
# CI reads the synthetic fixtures, never VISUAL or M-Files. The e2e job generates them into
|
|
# tests/fixtures/generated, which compose.ci.yaml mounts at /fixtures.
|
|
FEED_SOURCE=fixture
|
|
# fixture: drawings.<state>.json and the PDFs it names, under FIXTURE_DIR.
|
|
DRAWING_SOURCE=fixture
|
|
# Fixture folder inside the containers. The scenario writes /fixtures/state to switch states.
|
|
FIXTURE_DIR=/fixtures
|
|
|
|
# ---- VisualKit (VISUAL ERP, read only) ----
|
|
# SQL Server instance. Full name: containers have no search domain.
|
|
VISUAL_SERVER=
|
|
# VISUAL database.
|
|
VISUAL_DATABASE=
|
|
# Read-only SQL login.
|
|
VISUAL_USER=visualkit_ro
|
|
# Its password, from the compose secret.
|
|
VISUAL_PASSWORD_FILE=/run/secrets/visualkit_password
|
|
# no until vsql has a trusted certificate (open question 6).
|
|
VISUAL_ENCRYPT=no
|
|
# ODBC driver name installed in the image.
|
|
VISUAL_DRIVER="ODBC Driver 18 for SQL Server"
|
|
|
|
# ---- MFilesKit (M-Files, read only; there is no test vault, so test reads production) ----
|
|
# M-Files REST endpoint.
|
|
MFILES_URL=
|
|
# Vault GUID.
|
|
MFILES_VAULT_GUID=
|
|
# Read-only user. The entrypoint exports MFILES_PASSWORD from its secret file.
|
|
MFILES_USERNAME=
|
|
# CA chain used to verify M-Files.
|
|
MFILES_CA_BUNDLE=/etc/ssl/pesco/ca.pem
|