rock-n-code/ccn
1
0 Fork 0
Code Issues Pull Requests Actions Projects Releases Activity

Wired up the Website deployment for the POC prototype.

Browse Source
This commit is contained in:
javier committed 2026-09-21 16:43:54 +02:00
1 parent f2f445827b
commit 359fe0d6ac
5 files changed
+77 -34
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Services/Website/.env.local
+39 -33
View File
@@ -51,36 +51,11 @@ ANALYTICS_DOMAINS=
# Whether the pages also embed the session recorder script: true | false
ANALYTICS_RECORDER=false
# --- Security ----------------------------------------------------------------
# --- Passkeys ----------------------------------------------------------------
# `Content-Security-Policy`. Must allow `String.Analytics.origin` in `script-src` and
# `connect-src`, or the tracker is blocked; drop those two once analytics is off.
SECURITY_CONTENT_SECURITY_POLICY=default-src 'self'; script-src 'self' https://analytics.rock-n-code.com; connect-src 'self' https://analytics.rock-n-code.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'
# `X-Content-Type-Options`: disables MIME sniffing.
SECURITY_CONTENT_TYPE_OPTIONS=nosniff
# `X-Frame-Options`: DENY | SAMEORIGIN
SECURITY_FRAME_OPTIONS=DENY
# `Referrer-Policy`.
SECURITY_REFERRER_POLICY=strict-origin-when-cross-origin
# `Permissions-Policy`: denies browser features the site does not use.
SECURITY_PERMISSIONS_POLICY=accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
# `Strict-Transport-Security`. Left unset: browsers ignore it over plain HTTP but
# remember it stickily once seen, so it stays off in local development.
# SECURITY_STRICT_TRANSPORT_SECURITY=max-age=31536000; includeSubDomains
# --- Reverse proxy -----------------------------------------------------------
# Both assert a TLS-terminating reverse proxy that sets the forwarded headers, so
# set them together; off for a directly reachable server, where clients can forge
# the headers. The former drives the HTTPS redirect, the latter keys the rate-limit
# buckets by the first `X-Forwarded-For` entry.
HTTPS_TRUST_FORWARDED_PROTO=false
RATE_LIMIT_TRUST_FORWARDED_FOR=false
# Origin the sign-in screen is served at; browsers bind passkeys to it.
# WebAuthn only runs on HTTPS or on localhost (not 127.0.0.1). In production it follows SITE_ORIGIN.
PASSKEYS_ORIGIN=http://localhost:8080
# --- Persistence -------------------------------------------------------------
@@ -110,8 +85,39 @@ DATABASE_TLS=off
# Username of the database to connect as.
DATABASE_USERNAME=ccn
# --- Passkeys ----------------------------------------------------------------
# --- Reverse proxy -----------------------------------------------------------
# Origin the sign-in screen is served at; browsers bind passkeys to it.
# WebAuthn only runs on HTTPS or on localhost (not 127.0.0.1).
PASSKEYS_ORIGIN=http://localhost:8080
# Both assert a TLS-terminating reverse proxy that sets the forwarded headers, so
# set them together; off for a directly reachable server, where clients can forge
# the headers. The former drives the HTTPS redirect, the latter keys the rate-limit
# buckets by the first `X-Forwarded-For` entry.
HTTPS_TRUST_FORWARDED_PROTO=false
RATE_LIMIT_TRUST_FORWARDED_FOR=false
# --- Security ----------------------------------------------------------------
# `Content-Security-Policy`. Must allow `String.Analytics.origin` in `script-src` and
# `connect-src`, or the tracker is blocked; drop those two once analytics is off.
SECURITY_CONTENT_SECURITY_POLICY=default-src 'self'; script-src 'self' https://analytics.rock-n-code.com; connect-src 'self' https://analytics.rock-n-code.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'
# `X-Content-Type-Options`: disables MIME sniffing.
SECURITY_CONTENT_TYPE_OPTIONS=nosniff
# `X-Frame-Options`: DENY | SAMEORIGIN
SECURITY_FRAME_OPTIONS=DENY
# `Referrer-Policy`.
SECURITY_REFERRER_POLICY=strict-origin-when-cross-origin
# `Permissions-Policy`: denies browser features the site does not use.
SECURITY_PERMISSIONS_POLICY=accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
# `Strict-Transport-Security`. Left unset: browsers ignore it over plain HTTP but
# remember it stickily once seen, so it stays off in local development.
# SECURITY_STRICT_TRANSPORT_SECURITY=max-age=31536000; includeSubDomains
# --- Site --------------------------------------------------------------------
# Public origin of the site (scheme and host, no trailing slash). Leave unset locally: the app's default applies, and
# the local Compose override points it at http://localhost.
# SITE_ORIGIN=https://ccn.rock-n-co.de
Services/Website/Dockerfile
+6
View File
@@ -128,6 +128,12 @@ COPY --from=build --chown=hummingbird:hummingbird /staging /app
# Provide configuration needed by the built-in crash reporter and some sensible default behaviors.
ENV SWIFT_BACKTRACE=enable=yes,sanitize=yes,threads=all,images=all,interactive=no,swift-backtrace=./swift-backtrace-static
# The photos sellers upload are the one thing written at runtime: their folder alone is writable, and it is where the
# Compose file mounts a volume. A named volume takes the ownership of the folder it is first mounted over.
RUN mkdir -p /app/Resources/Static/uploads \
&& chown hummingbird:hummingbird /app/Resources/Static/uploads \
&& chmod 750 /app/Resources/Static/uploads
# Ensure all further commands run as the hummingbird user
USER hummingbird:hummingbird
Services/Website/README.md
+10 -1
View File
@@ -478,10 +478,19 @@ The Makefile and Compose files read these from `.env` (or the environment). Prov
| `LOG_LEVEL` | Runtime log level (default `info`). |
| `HTTP_SERVER_NAME` | Runtime server name (default `CCNWebsite`). |
| `SECURITY_STRICT_TRANSPORT_SECURITY` | HSTS header value (default `max-age=31536000; includeSubDomains`). |
| `SITE_ORIGIN` | The public origin: scheme and host, no trailing slash. The local override points it at `http://localhost`. |
| `PASSKEYS_ORIGIN` | The origin browsers bind passkeys to: exactly where the sign-in screen is served, over HTTPS. Follows `SITE_ORIGIN` unless set apart. Left at the app's default (`http://localhost:8080`) every ceremony fails; changed later, it strands every passkey already registered. |
| `ANALYTICS_WEBSITE_ID`, `ANALYTICS_DOMAINS`, `ANALYTICS_RECORDER` | Passed through to the tracker; an empty identifier leaves it off. |
| `DATABASE_DRIVER` | `inMemory` or `postgres`. The production Compose file defaults it to `postgres`; the local override defaults back to the in-memory backend. |
| `DATABASE_HOST`, `DATABASE_PASSWORD` | **Mandatory** — the production Compose file carries no default for either, since none can be correct: `localhost` inside the container is the container itself, and a blank password authenticates as nobody. It refuses to start without them rather than booting a website that serves 503s. Both come from `.env`, which is git-ignored — never commit the password. Compose interpolates each file before merging, so both must be set for a local `docker compose up` too, even though the override pins the host. |
| `DATABASE_PORT`, `DATABASE_NAME`, `DATABASE_USERNAME` | The rest of the PostgreSQL connection (when `DATABASE_DRIVER=postgres`); these do default (`5432`, `ccn`, `ccn`). |
| `DATABASE_POOL_MAX_PER_EVENT_LOOP` | Pooled connections per event loop (default `4`) — see the [connection budget](#persistence) before scaling out. |
| `DATABASE_TLS` | TLS posture: `off`, `prefer`, or `require`. The production Compose file defaults it to `require`, which refuses a server offering no TLS; the local override defaults it to `off` for the plaintext development container. `prefer` continues in plaintext when the upgrade is stripped, handing over the password — so it is not a safe production posture. |
Run the migrations against the production database once before (or during) rollout: `docker compose -f docker-compose.yml run --rm website --database-migrate`.
Run the migrations against the production database once before (or during) rollout: `docker compose -f docker-compose.yml run --rm website --database-migrate`. They seed the prototype's demo shops, listings, and accounts too.
What else a deployment needs:
- **HTTPS in front**: browsers run WebAuthn nowhere else, and `HTTPS_TRUST_FORWARDED_PROTO` (on by default in the production Compose file) is what marks the session cookie `Secure`.
- **The uploads volume**: the image is read-only but for `Resources/Static/uploads`, where the Compose file mounts `website-uploads` so sellers' photos outlive a redeploy.
- **Room for uploads in the proxy**: a listing form carries up to 13 MB of photos — nginx allows 1 MB by default (`client_max_body_size`).
- **One replica**: sessions, passkey ceremonies, and recovery links live in the process's memory; a restart signs everyone out.
Services/Website/docker-compose.override.yml
+3
View File
@@ -18,6 +18,9 @@ services:
dockerfile: Services/Website/Dockerfile
environment:
LOG_LEVEL: debug
# Served over plain HTTP on localhost — the one place browsers run WebAuthn without HTTPS. Not 127.0.0.1.
SITE_ORIGIN: http://localhost:${HOST_PORT:-8080}
PASSKEYS_ORIGIN: http://localhost:${HOST_PORT:-8080}
HTTPS_TRUST_FORWARDED_PROTO: "false"
RATE_LIMIT_TRUST_FORWARDED_FOR: "false"
DATABASE_DRIVER: ${DATABASE_DRIVER:-inMemory}
Services/Website/docker-compose.yml
+19
View File
@@ -8,6 +8,9 @@ name: ccn-platform
#
# The `-f docker-compose.yml` flag is important in production: it skips the docker-compose.override.yml file, which
# Compose would otherwise merge in automatically for local development.
#
# Run one replica: sessions, passkey ceremonies, and recovery links live in the process's memory, so a second instance
# would not know the first one's sign-ins — and a restart signs everyone out.
services:
website:
image: ${HOST_CONTAINER}/${HOST_OWNER}/${IMAGE_NAME}:${IMAGE_TAG:-latest}
@@ -19,6 +22,17 @@ services:
environment:
LOG_LEVEL: ${LOG_LEVEL:-info}
HTTP_SERVER_NAME: ${HTTP_SERVER_NAME:-CCNWebsite}
# The public origin: scheme and host, no trailing slash. The HTTPS redirect and the canonical links derive from it.
SITE_ORIGIN: ${SITE_ORIGIN:-https://ccn.rock-n-co.de}
# The origin browsers bind passkeys to: exactly where the sign-in screen is served — same scheme, same host, no
# `www.` either way. Left at the app's default (http://localhost:8080) every ceremony fails, so it follows
# SITE_ORIGIN unless set apart. It must be HTTPS: browsers run WebAuthn nowhere else but localhost, and it is
# what marks the session cookie `Secure`.
PASSKEYS_ORIGIN: ${PASSKEYS_ORIGIN:-${SITE_ORIGIN:-https://ccn.rock-n-co.de}}
# Empty leaves the tracker off.
ANALYTICS_WEBSITE_ID: ${ANALYTICS_WEBSITE_ID:-}
ANALYTICS_DOMAINS: ${ANALYTICS_DOMAINS:-}
ANALYTICS_RECORDER: ${ANALYTICS_RECORDER:-false}
# Falls back to the policy the app ships with; set it in `.env` to allow the analytics origin,
# which must match `String.Analytics.origin`.
SECURITY_CONTENT_SECURITY_POLICY: "${SECURITY_CONTENT_SECURITY_POLICY:-default-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'}"
@@ -33,9 +47,14 @@ services:
DATABASE_PASSWORD: ${DATABASE_PASSWORD:?DATABASE_PASSWORD is required}
DATABASE_TLS: ${DATABASE_TLS:-require}
DATABASE_POOL_MAX_PER_EVENT_LOOP: ${DATABASE_POOL_MAX_PER_EVENT_LOOP:-4}
volumes:
# The photos sellers upload. The rest of the image is read-only, and without the volume a redeploy would lose them.
- website-uploads:/app/Resources/Static/uploads
healthcheck:
test: ["CMD", "curl", "--fail", "--silent", "--show-error", "http://127.0.0.1:8080/health"]
interval: 30s
timeout: 5s
retries: 3
start_period: 10s
volumes:
website-uploads: