Initial Commit
This commit is contained in:
@@ -0,0 +1,80 @@
|
||||
# This development deployment
|
||||
|
||||
## Addresses
|
||||
|
||||
Public configuration is in `config/dev.env` (no credentials):
|
||||
|
||||
- App: `https://dev.evebot.app` → this server's **HTTP port 5173**.
|
||||
- Convex browser API/WebSockets: `https://dev-convex.evebot.app` → this server's **HTTP port 3210**.
|
||||
- Both Pangolin resources are **HTTP resources**. WebSocket upgrades do not require a separate TCP resource. Pangolin terminates public TLS; the selected upstream ports serve plain HTTP.
|
||||
- Convex must not have an interactive Pangolin authentication gate; its application JWT/session and server-bridge checks authorize access. The main app may retain the additional Pangolin gate.
|
||||
- The public Convex endpoint must be reachable by the browser. `127.0.0.1` in browser configuration would mean the browser's machine, not this server.
|
||||
- Host-side deployment tools use `http://127.0.0.1:3210`; the web container uses `http://backend:3210`.
|
||||
|
||||
The operator explicitly selected wildcard binding for web/Convex: `0.0.0.0`. Firewall these ports to the intended ingress network/Pangolin connector; do not assume a proxy protects the directly published ports. Port 3211 (Convex HTTP actions, unused here) and the optional dashboard remain loopback-only. If Newt is containerized, a target of `127.0.0.1` normally refers to that container: configure a reachable address for the app server instead. A 302 to Pangolin login is a proxy-authentication problem; a 502 is an upstream-connection/configuration problem.
|
||||
|
||||
## Infisical
|
||||
|
||||
The non-secret `.infisical.json` pins:
|
||||
|
||||
- Instance: `https://secrets.jb.codes`
|
||||
- Project: `e176b742-85cd-4af6-96a7-f33ab7c2c709`
|
||||
- Environment: `dev`
|
||||
- Path: `/`
|
||||
|
||||
A read-only Universal Auth identity lives outside the repository in `~/.config/evebot/infisical.env`, owned by the operator with mode `0600`:
|
||||
|
||||
```dotenv
|
||||
INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=...
|
||||
INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=...
|
||||
```
|
||||
|
||||
Do not commit or paste those values into chat. The helper rejects symlinks, non-regular files, files owned by another user, and group/world-accessible credential files. It authenticates only against the approved instance, keeps tokens out of argv, limits CLI output and execution time, suppresses raw errors, disables CLI telemetry, and disables linked-secret imports, expansion, and personal overrides. It injects only allowlisted application secrets and removes the bootstrap identity/token from the child environment. It never writes fetched app secrets to a dotenv file.
|
||||
|
||||
```sh
|
||||
bun install --frozen-lockfile
|
||||
bun run secrets:status
|
||||
bun run secrets:run -- bun scripts/check-live-config.ts
|
||||
```
|
||||
|
||||
Expected application keys: `EVE_CLIENT_ID`, optional `EVE_CLIENT_SECRET` for confidential SSO, `TYPESAFE_API_KEY`, `TOKEN_ENCRYPTION_KEY`, `CONVEX_BRIDGE_SECRET`, `APP_AUTH_PRIVATE_KEY`, and `APP_AUTH_JWKS`. Generate the last four **once** using `bun run keys:generate`; import `.env.keys` into the selected Infisical environment without replacing existing API keys. The generator refuses to overwrite an existing file. After verifying the import and key pairing, remove the temporary copy. Back up the vault: changing/loss of the encryption key makes stored EVE credentials unreadable. Do not regenerate keys casually during deployment.
|
||||
|
||||
The helper is an operator launcher, not a sandbox. Commands it launches can read injected secrets: never run `env`, `printenv`, shell tracing, or unrestricted `docker compose config` through it. Use `docker compose config --quiet` for validation. Docker administrators can inspect container environments; Infisical startup injection does not conceal secrets from host administrators. Updating a vault value requires recreating the affected container with fresh injected values. Encryption/signing-key rotation needs a separate migration plan.
|
||||
|
||||
## Deploy the local backend
|
||||
|
||||
Run from the repository root:
|
||||
|
||||
```sh
|
||||
bun run secrets:run -- docker compose up -d backend
|
||||
bun run secrets:run --deployment -- bun run convex:configure
|
||||
bun run secrets:run --deployment -- bun node_modules/convex/bin/main.js dev --once --typecheck disable
|
||||
```
|
||||
|
||||
`--deployment` allows the CLI-only Convex admin key. If it is not stored in the vault, the helper derives it from the local backend container's persistent random instance secret. This requires existing Docker-host administrative access and is restricted to the local deployment URL. The key is captured without being displayed or saved to another file. Compose never passes it to the web container. Preserve/back up the `convex-data` volume, including its instance credentials.
|
||||
|
||||
`config/dev.env` is authoritative for the public settings, even if the Convex CLI generates a local environment file. Keep all generated `.env*` files out of version control.
|
||||
|
||||
## Reference data and web service
|
||||
|
||||
Use the production import procedure in [reference operations](reference-operations.md); never seed this deployment with `--fixture`. A successful production artifact must be installed in the Compose reference volume before enabling asset reports. The immutable artifact and manifest stay pinned to a complete validated generation, and failed imports cannot replace it.
|
||||
|
||||
```sh
|
||||
bun run secrets:run -- docker compose up -d --build web
|
||||
```
|
||||
|
||||
The container listens on 3000 internally but publishes **5173** on the host. This is the production SvelteKit/Bun server, not the Vite development server. The web mounts reference data read-only. The one-shot reference worker has the writable volume mount.
|
||||
|
||||
## First live verification
|
||||
|
||||
1. Check `https://dev-convex.evebot.app/version` returns a backend version, not a proxy login or 502. Verify a real WSS upgrade using the app Origin.
|
||||
2. Confirm application secret validation and the deployed Convex functions.
|
||||
3. Optional paid-provider probe (one generic classification; no character or asset data):
|
||||
```sh
|
||||
LIVE_API_SMOKE=1 bun run secrets:run -- bun scripts/smoke-jev.ts
|
||||
```
|
||||
4. Open the app, pass the optional Pangolin gate, and connect an EVE character. The exact registered EVE callback must be `https://dev.evebot.app/auth/eve/callback`.
|
||||
5. Explicitly synchronize assets. Inspect completeness/freshness, exclusions, and the reference-price label; add further characters through the explicit linking flow.
|
||||
6. Compare conventional browsing and chat `/value`. Live EVE SSO, refresh, and real asset synchronization are not verified merely by validating the client ID/secret or testing the JEV key.
|
||||
|
||||
Do not run the write-enabled disposable Convex smoke script against this persistent deployment: its synthetic identities belong only in isolated test backends.
|
||||
Reference in New Issue
Block a user