Admin
cf8ac706b6
Removes every wrapper script under deploy/ (up.ps1, up.sh, scripts/*,
zitadel/provision.*) and folds their logic into three one-shot services
in compose.yml, following the pattern already used by seaweedfs-init:
keys-init generates the RS256 stream-ticket key pair
migrate applies the EF Core migrations (backend/Musify.Migrator.Dockerfile)
zitadel-init creates the Musify project + OIDC apps, writes the client
ids back into the active env file
Deploying is now two plain `docker compose` commands, no scripts to run
or chmod:
docker compose -f deploy/compose.yml -f deploy/compose.dev.yml up -d
docker compose -f deploy/compose.yml -f deploy/compose.dev.yml --profile apps up -d --build
(swap compose.dev.yml for compose.prod.yml + --env-file deploy/.env.prod
for production). The first command brings up infra and lets the bootstrap
jobs run to completion; the second builds and starts the apps, which by
then read real OIDC values instead of empty ones — compose interpolates
${VAR} once per invocation, so this can't collapse into a single command
without the apps reading their own config file at container start instead
of via compose env (out of scope here).
Also:
- DatabaseDesignTimeFactory now also reads Database__ConnectionString
from the environment, and DesignSettings.json is optional, so the new
migrate container works without user-secrets or a config file excluded
from the Docker build context by .dockerignore.
- nginx's depends_on no longer lists the apps-profile services: it does
not need them at its own startup (every vhost resolves its upstream at
request time via the embedded Docker resolver), and requiring them made
`compose.prod.yml up -d` (without --profile apps) an invalid project.
- env_get/env_set in zitadel-init strip \r: the mounted env file can have
CRLF line endings on Windows, which otherwise makes an empty-looking
value non-empty to `[ -z ... ]`. .env.example/.env.prod.example are
pinned to LF via .gitattributes for the same reason. Also fixed:
rewriting the bind-mounted env file in place instead of renaming a temp
file over it (rename onto a bind-mounted inode fails with "Resource
busy").
- Removed compose.share.yml and zitadel/.output-share/ — a "temporary"
personal overlay that had leaked a real Zitadel service-account PAT
into git history (committed in 70968b3). That token should be rotated.
- Removed deploy/.tmp/ from .gitignore: nothing mounts or creates it
anymore (it never actually did, either — no compose service referenced
it, only the now-removed up.ps1 did).
Verified end-to-end with Docker: a clean `down -v` + fresh `up -d` +
`--profile apps up -d --build` on the dev stack brings up all four one-shot
jobs successfully and all four apps healthy (api/gateway return 200,
worker starts its consumers with no errors, web-player responds). Also
verified compose.prod.yml starts nginx cleanly with dummy certs and no
apps running, confirming the depends_on fix.
Musify — Documentación
Musify es un backend de streaming de música: subir pistas, procesarlas (transcodificar el audio a .m4a y generar miniaturas), organizarlas en playlists y reproducirlas en streaming sin que los bytes pasen por la API.
Esta carpeta explica qué hace cada pieza, su propósito y por qué está diseñada así.
Índice
- architecture.md — Visión global: componentes, cómo encajan y los flujos principales.
- projects.md — Qué es y para qué sirve cada proyecto/solución.
- authentication.md — Zitadel (OIDC), validación de JWT, provisioning/sync de usuarios.
- storage.md — SeaweedFS (S3), estructura de claves, URLs prefirmadas, qué es público y qué privado.
- streaming.md — Streaming del audio (
.m4apor HTTP range) con stream-ticket (RS256) y el reverse proxy (StreamingGateway). - media-processing.md — El worker y los workflows de MassTransit (transcode de audio, miniaturas).
- development.md — Cómo levantar todo en local: contenedores, puertos y comandos.
- ../deploy/README.md — El deploy en detalle: compose, scripts y producción.
Mapa de componentes (alto nivel)
┌─────────────────────────────────────────────┐
Cliente ───► │ Musify.Api (:5111) API REST + emite tickets │
└─────────────────────────────────────────────┘
│ EF Core │ presigned (subidas) │ MassTransit (eventos)
▼ ▼ ▼
PostgreSQL SeaweedFS S3 (:8333) RabbitMQ ──► Worker (procesa)
(metadatos) (objetos) audio→.m4a, imágenes
▲
Cliente ───► StreamingGateway (:8081) ┘ sirve audio .m4a (valida ticket, proxy al filer)
Login: Cliente ◄──► Zitadel (:8080, OIDC) → Musify.Api valida el JWT
Stack
- .NET 10, C#. Minimal APIs (
Musify.Api), Worker Service (Musify.Worker), ASP.NET + YARP (Musify.StreamingGateway). - CQRS con [Mediator] (source-generator) y resultados con ErrorOr.
- EF Core 10 + PostgreSQL (metadatos).
- MassTransit 8 + RabbitMQ (procesado asíncrono con routing slips/sagas).
- SeaweedFS (almacenamiento de objetos compatible con S3, vía AWSSDK.S3).
- ffmpeg (transcode de audio a AAC/
.m4a), SixLabors.ImageSharp (miniaturas). - Zitadel (OIDC/OAuth2) para identidad.
Estructura del repositorio
Un solo repo: backend/ (los seis proyectos .NET), web-player/ (cliente web
SvelteKit), deploy/ (stacks de Docker Compose y scripts) y docs/.