wtclaude
f2e59a2426
All checks were successful
PR checks / checks (pull_request) Successful in 9m46s
PLAN.md §13 phase 12, the last one. Four decisions of record, D54–D57, taking the count to fifty-seven; recorded in §6, "How phase 12 delivered it". A two-stage Dockerfile, a pull-only docker-compose.yml carrying both bind mounts, .env.example, the workflow that publishes and deploys, CONTRIBUTING.md, the community-health files this was the only repository of the ten to lack, and DEPLOY.md. D54 — a merge deploys, amending D6. build-image.yml pushes runicgateway-site:latest and :sha-<7>, then rolls the container over on the `rgcom` runner out of /opt/runicgateway.com, and waits for the container's own healthcheck rather than for `up -d` to return. D55 — the site runs on its own host behind a generic reverse proxy, so DEPLOY.md states the four requirements rather than one worked example, and the container binds 127.0.0.1 so the safe configuration is the default. D56 — @astrojs/node derives the request protocol from req.socket.encrypted and never reads x-forwarded-proto, so behind a TLS-terminating proxy the browser sends Origin: https://… while the container computes http://… and Astro's CSRF check compares them for equality. Every beta signup, from every visitor, was answered 403. serve.mjs now normalises both forwarded headers, unconditionally — the image should deploy and work. Two assertions in test/headers.test.mjs hold both halves. D57 — DEPLOY.md rather than a README section; SECURITY.md and CODE_OF_CONDUCT.md are pointers to the org's copies rather than copies, because a copy would hard-code the contact address D13 confines to brand.json. Verified: npm run verify green (eleven checks, 36 unit tests, 7 served tests, astro check 0 errors). The image was built and run with both mounts — a mounted brand reached 51 files and all 50 search pages, /brand/* fell back per file, a proxy-shaped signup reached the store, and the export CLI wrote both Play files to the host mount. docker compose config caught a YAML trap in the healthcheck: a block sequence reads the `: ` in `r.ok ? 0 : 1` as a mapping. Co-Authored-By: Claude <noreply@anthropic.com>
62 lines
2.6 KiB
Plaintext
62 lines
2.6 KiB
Plaintext
# runicgateway.com — production environment.
|
|
#
|
|
# Copy to `.env` beside docker-compose.yml on the host and fill in the two
|
|
# secrets. Everything else has a working default; this file exists so the
|
|
# defaults are visible rather than discovered.
|
|
#
|
|
# cp .env.example .env
|
|
#
|
|
# Nothing here is a credential for another service. The site talks to no API,
|
|
# sends no mail (D7) and has no database server — the only state it keeps is a
|
|
# SQLite file on the ./data mount.
|
|
|
|
# ---------------------------------------------------------------------------------------
|
|
# Deployment
|
|
# ---------------------------------------------------------------------------------------
|
|
|
|
# Which published build runs. `latest` follows main; pin `sha-<7>` for a
|
|
# reproducible deploy or to roll back — every merge publishes both tags.
|
|
IMAGE_TAG=latest
|
|
|
|
# Host port the container is published on, bound to 127.0.0.1 (see the note in
|
|
# docker-compose.yml if your reverse proxy cannot reach the host's loopback).
|
|
SITE_HOST_PORT=4321
|
|
|
|
# ---------------------------------------------------------------------------------------
|
|
# The closed-beta signup (PLAN.md §8)
|
|
# ---------------------------------------------------------------------------------------
|
|
#
|
|
# THE TWO BELOW ARE THE ONLY VALUES THAT REALLY WANT SETTING. Both default to a
|
|
# random value generated per process, which is safe but forgetful: every restart
|
|
# invalidates every rate-limit window and every rendered form. That is the right
|
|
# default — a hard-coded salt shipped in a public repository would make every
|
|
# deployment's ip_hash values identical and therefore reversible by anyone who
|
|
# can read it — but it is not what you want on a host that restarts.
|
|
#
|
|
# Generate both once, keep them, and do not rotate them casually: changing the
|
|
# salt orphans the rate-limit history of everyone already counted.
|
|
#
|
|
# openssl rand -hex 32
|
|
|
|
# Salts the ip_hash column. The raw IP address is never stored — /privacy says
|
|
# so, and this is the mechanism that makes it true while still allowing a
|
|
# per-connection limit.
|
|
BETA_IP_SALT=
|
|
|
|
# Signs the hidden form token, so a script has to fetch the page before it can
|
|
# post. Rotating this only invalidates forms currently open in a browser.
|
|
BETA_FORM_KEY=
|
|
|
|
# Rows, across all time, above which the form closes and says so on the page.
|
|
BETA_TOTAL_CAP=500
|
|
|
|
# What one connection may do, in a rolling hour and a rolling day.
|
|
BETA_PER_HOUR=3
|
|
BETA_PER_DAY=24
|
|
|
|
# Seconds between the page rendering and the form posting. Below the minimum is
|
|
# treated as a script; above the maximum the form is stale and re-rendered.
|
|
# Twelve hours is the default maximum.
|
|
BETA_MIN_SECONDS=2
|
|
BETA_MAX_SECONDS=43200
|