Admin
cf8ac706b6
Removes every wrapper script under deploy/ (up.ps1, up.sh, scripts/*,
zitadel/provision.*) and folds their logic into three one-shot services
in compose.yml, following the pattern already used by seaweedfs-init:
keys-init generates the RS256 stream-ticket key pair
migrate applies the EF Core migrations (backend/Musify.Migrator.Dockerfile)
zitadel-init creates the Musify project + OIDC apps, writes the client
ids back into the active env file
Deploying is now two plain `docker compose` commands, no scripts to run
or chmod:
docker compose -f deploy/compose.yml -f deploy/compose.dev.yml up -d
docker compose -f deploy/compose.yml -f deploy/compose.dev.yml --profile apps up -d --build
(swap compose.dev.yml for compose.prod.yml + --env-file deploy/.env.prod
for production). The first command brings up infra and lets the bootstrap
jobs run to completion; the second builds and starts the apps, which by
then read real OIDC values instead of empty ones — compose interpolates
${VAR} once per invocation, so this can't collapse into a single command
without the apps reading their own config file at container start instead
of via compose env (out of scope here).
Also:
- DatabaseDesignTimeFactory now also reads Database__ConnectionString
from the environment, and DesignSettings.json is optional, so the new
migrate container works without user-secrets or a config file excluded
from the Docker build context by .dockerignore.
- nginx's depends_on no longer lists the apps-profile services: it does
not need them at its own startup (every vhost resolves its upstream at
request time via the embedded Docker resolver), and requiring them made
`compose.prod.yml up -d` (without --profile apps) an invalid project.
- env_get/env_set in zitadel-init strip \r: the mounted env file can have
CRLF line endings on Windows, which otherwise makes an empty-looking
value non-empty to `[ -z ... ]`. .env.example/.env.prod.example are
pinned to LF via .gitattributes for the same reason. Also fixed:
rewriting the bind-mounted env file in place instead of renaming a temp
file over it (rename onto a bind-mounted inode fails with "Resource
busy").
- Removed compose.share.yml and zitadel/.output-share/ — a "temporary"
personal overlay that had leaked a real Zitadel service-account PAT
into git history (committed in 70968b3). That token should be rotated.
- Removed deploy/.tmp/ from .gitignore: nothing mounts or creates it
anymore (it never actually did, either — no compose service referenced
it, only the now-removed up.ps1 did).
Verified end-to-end with Docker: a clean `down -v` + fresh `up -d` +
`--profile apps up -d --build` on the dev stack brings up all four one-shot
jobs successfully and all four apps healthy (api/gateway return 200,
worker starts its consumers with no errors, web-player responds). Also
verified compose.prod.yml starts nginx cleanly with dummy certs and no
apps running, confirming the depends_on fix.
44 lines
1.8 KiB
Bash
44 lines
1.8 KiB
Bash
# Local configuration for `npm run dev`. Copy the WEB_CLIENT_ID /
|
|
# WEB_CLIENT_SECRET that deploy/compose.yml's zitadel-init service writes to
|
|
# deploy/.env; in Docker the same variables come from deploy/compose.yml.
|
|
|
|
# Zitadel OIDC (server-side auth)
|
|
ZITADEL_ISSUER=http://host.docker.internal:8080
|
|
ZITADEL_CLIENT_ID=your-web-app-client-id
|
|
ZITADEL_CLIENT_SECRET=your-web-app-client-secret
|
|
|
|
# Where Zitadel redirects back after login (must be registered in the app)
|
|
AUTH_REDIRECT_URI=http://localhost:5173/auth/callback
|
|
AUTH_POST_LOGOUT_URI=http://localhost:5173/
|
|
|
|
# Secret used to derive the session cookie encryption key (any long random string)
|
|
SESSION_SECRET=change-me-to-a-long-random-string
|
|
|
|
# Backend API base URL
|
|
API_BASE_URL=http://localhost:5111
|
|
|
|
# Optional session tuning (defaults shown)
|
|
# OIDC_SCOPE=openid profile email offline_access
|
|
# SESSION_TTL_SECONDS=604800
|
|
# SESSION_REFRESH_THRESHOLD_SECONDS=30
|
|
# AUTH_FLOW_TTL_SECONDS=600
|
|
|
|
# Dev already allows a plain-HTTP issuer. Set this only to allow it in a production build (never with a public issuer).
|
|
# AUTH_ALLOW_INSECURE_HTTP=true
|
|
|
|
# Optional tuning for the YouTube artwork proxy (/api/youtube/thumbnail),
|
|
# which caches the covers in memory so the browser never hits Google directly.
|
|
# THUMBNAIL_CACHE_MAX_AGE_SECONDS=2592000
|
|
# THUMBNAIL_FAILURE_CACHE_SECONDS=300
|
|
# THUMBNAIL_CACHE_BYTES=134217728
|
|
# THUMBNAIL_MAX_CONCURRENT_FETCHES=4
|
|
# THUMBNAIL_FETCH_TIMEOUT_MS=8000
|
|
# THUMBNAIL_COOLDOWN_SECONDS=30
|
|
# THUMBNAIL_MAX_COOLDOWN_SECONDS=300
|
|
# THUMBNAIL_MAX_SIZE=720
|
|
|
|
# Where to send presigned S3 PUTs when the public S3 host is not reachable from
|
|
# the server (in Docker: http://seaweedfs:8333). The signed Host header is kept
|
|
# either way. Defaults to the host in the presigned URL.
|
|
# S3_UPLOAD_ENDPOINT=http://localhost:8333
|