Production had no orchestrator at all and its provisioning script required
PowerShell 7 on the server. up.sh now does the whole thing in POSIX shell:
it refuses to start until .env.prod and the origin certificate are in place,
generates the stream keys, brings up the infrastructure and the edge,
provisions Zitadel, applies the migrations and finally builds and starts the
applications. It is idempotent, so the same command deploys a new version.
provision.sh replaces provision.prod.ps1 (curl + jq) and also creates the web
player client, and migrate.prod.sh moves to scripts/migrate.sh reading the env
file with a parser instead of sourcing it as a shell script.
ikerdemo.cat was hardcoded in six server blocks, so the stack could only be
deployed under that one domain. The vhosts are now a template rendered by the
nginx entrypoint from MUSIFY_ROOT_DOMAIN, with the envsubst filter set so it
does not eat nginx's own variables. The repeated proxy headers move to a
shared snippet, the web player vhost gets the upload body limit it was missing
(audio is posted to its form actions), and the streaming vhost turns off proxy
buffering so range requests stay responsive.
The dev and prod stacks each declared the same nine services, which is how the
S3 credentials and the gateway configuration ended up diverging. compose.yml
now holds every service with no published port and no domain in it, and the
overlays only add what is specific: host ports and pgAdmin for development,
the nginx edge and the mounted secrets for production. The applications sit
behind the `apps` profile, so a plain `up` still starts infrastructure only.
Everything environment-specific moves to the env files: the public URLs, the
credentials and the environment name. The SeaweedFS identity file is rendered
inside the container from S3_ACCESS_KEY and S3_SECRET_KEY, so the store and
the applications can no longer be given different keys.
Matches the folder rename: compose service frontend -> web-player,
container musify-frontend -> musify-web-player, and the nginx upstream
now points at http://web-player:3000.
Deploying this needs --remove-orphans, or the old musify-frontend
container is left behind.
Updates the compose build context, the Dockerfile header, the package
name and the docs. The compose service and container keep the name
frontend/musify-frontend, since nginx routes to http://frontend:3000.
The source files also carry the first prettier pass, so the rename and
the reformat land together for them.
Compose file for ikerdemo.cat with nginx as TLS terminator, the three
.NET services, Zitadel and the storage stack. Values come from
deploy/.env.prod (untracked). Adds the frontend image, the migration
script and the Zitadel provisioning for production.
The 'latest' Zitadel image requires the Login UI v2, which runs as a separate
'login' container this stack doesn't deploy, so OIDC redirected to /ui/v2/login
and returned {code:5, Not Found}. provision.ps1 now disables the loginV2
requirement via the feature API so OIDC uses the built-in /ui/login. Also
applied to the running instance.
Single docker-compose stack for local development (Postgres, Zitadel,
RabbitMQ, SeaweedFS + bucket init, Jaeger) plus an optional overlay to run
the .NET apps in Docker. up.ps1 orchestrates the full bootstrap: stack up,
stream-ticket keys, EF Core migrations and Zitadel provisioning.
- Zitadel is provisioned automatically (service-account PAT -> project +
OIDC app with JWT access token); the generated ClientId is wired into
Musify.Api user-secrets and .env. No manual console steps.
- ZITADEL_EXTERNAL_DOMAIN=host.docker.internal so token validation works
both with local apps and full-docker.
- App Dockerfiles copy AppSettings*.json to lowercase so config loads on
case-sensitive Linux; Worker image ships ffmpeg.
- Scripts split by responsibility (common/stream-keys/migrate/provision);
apps overlay de-duped via YAML anchors.
- Remove the superseded standalone seaweedfs compose; point docs/development
at the unified stack.
Admin