This development deployment

Addresses

Public configuration is in config/dev.env (no credentials):

App: https://dev.evebot.app → this server's HTTP port 5173.
Convex browser API/WebSockets: https://dev-convex.evebot.app → this server's HTTP port 3210.
Both Pangolin resources are HTTP resources. WebSocket upgrades do not require a separate TCP resource. Pangolin terminates public TLS; the selected upstream ports serve plain HTTP.
Convex must not have an interactive Pangolin authentication gate; its application JWT/session and server-bridge checks authorize access. The main app may retain the additional Pangolin gate.
The public Convex endpoint must be reachable by the browser. 127.0.0.1 in browser configuration would mean the browser's machine, not this server.
Host-side deployment tools use http://127.0.0.1:3210; the web container uses http://backend:3210.

The operator explicitly selected wildcard binding for web/Convex: 0.0.0.0. Firewall these ports to the intended ingress network/Pangolin connector; do not assume a proxy protects the directly published ports. Port 3211 (Convex HTTP actions, unused here) and the optional dashboard remain loopback-only. If Newt is containerized, a target of 127.0.0.1 normally refers to that container: configure a reachable address for the app server instead. A 302 to Pangolin login is a proxy-authentication problem; a 502 is an upstream-connection/configuration problem.

Infisical

The non-secret .infisical.json pins:

Instance: https://secrets.jb.codes
Project: e176b742-85cd-4af6-96a7-f33ab7c2c709
Environment: dev
Path: /

A read-only Universal Auth identity lives outside the repository in ~/.config/evebot/infisical.env, owned by the operator with mode 0600:

INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=...
INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=...

Do not commit or paste those values into chat. The helper rejects symlinks, non-regular files, files owned by another user, and group/world-accessible credential files. It authenticates only against the approved instance, keeps tokens out of argv, limits CLI output and execution time, suppresses raw errors, disables CLI telemetry, and disables linked-secret imports, expansion, and personal overrides. It injects only allowlisted application secrets and removes the bootstrap identity/token from the child environment. It never writes fetched app secrets to a dotenv file.

bun install --frozen-lockfile
bun run secrets:status
bun run secrets:run -- bun scripts/check-live-config.ts

Expected application keys: EVE_CLIENT_ID, optional EVE_CLIENT_SECRET for confidential SSO, TYPESAFE_API_KEY, TOKEN_ENCRYPTION_KEY, CONVEX_BRIDGE_SECRET, CONVEX_SYNC_WORKER_SECRET, APP_AUTH_PRIVATE_KEY, and APP_AUTH_JWKS. Generate the key material once using bun run keys:generate; import .env.keys into the selected Infisical environment without replacing existing API keys. Configure both distinct bridge secrets in Convex with bun run secrets:run --deployment --configure -- bun run convex:configure; the sync worker receives only CONVEX_SYNC_WORKER_SECRET, while web receives only CONVEX_BRIDGE_SECRET. Use bun run secrets:run --worker -- ... for worker commands so session/JEV signing and general bridge secrets are not injected. The generator refuses to overwrite an existing file. After verifying the import and key pairing, remove the temporary copy. Back up the vault: changing/loss of the encryption key makes stored EVE credentials unreadable. Do not regenerate keys casually during deployment.

The helper is an operator launcher, not a sandbox. Commands it launches can read injected secrets: never run env, printenv, shell tracing, or unrestricted docker compose config through it. Use docker compose config --quiet for validation. Docker administrators can inspect container environments; Infisical startup injection does not conceal secrets from host administrators. Updating a vault value requires recreating the affected container with fresh injected values. Encryption/signing-key rotation needs a separate migration plan.

Deploy the local backend

Run from the repository root:

bun run secrets:run -- docker compose up -d backend
bun run secrets:run --deployment --configure -- bun run convex:configure
bun run secrets:run --deployment -- bun node_modules/convex/bin/main.js dev --once --typecheck disable

--deployment allows the CLI-only Convex admin key. If it is not stored in the vault, the helper derives it from the local backend container's persistent random instance secret. This requires existing Docker-host administrative access and is restricted to the local deployment URL. The key is captured without being displayed or saved to another file. Compose never passes it to the web container. Preserve/back up the convex-data volume, including its instance credentials.

config/dev.env is authoritative for the public settings, even if the Convex CLI generates a local environment file. Keep all generated .env* files out of version control.

Reference data and web service

Use the production import procedure in reference operations; never seed this deployment with --fixture. A successful production artifact must be installed in the Compose reference volume before enabling asset reports. The immutable artifact and manifest stay pinned to a complete validated generation, and failed imports cannot replace it.

bun run secrets:run -- docker compose up -d --build web
bun run secrets:run --worker -- docker compose --profile worker up -d --build sync-worker

The web container listens on 3000 internally but publishes 5173 on the host. This is the production SvelteKit/Bun server, not the Vite development server. The web mounts reference data read-only. The dedicated sync-worker is a separate long-running service: its image starts the bundled build/sync-worker.js through the restricted launcher and receives only worker-safe secrets. The one-shot reference worker has the writable volume mount.

First live verification

Check https://dev-convex.evebot.app/version returns a backend version, not a proxy login or 502. Verify a real WSS upgrade using the app Origin.
Confirm application secret validation and the deployed Convex functions.
Optional paid-provider probe (one generic classification; no character or asset data):
```
LIVE_API_SMOKE=1 bun run secrets:run -- bun scripts/smoke-jev.ts
```
Open the app, pass the optional Pangolin gate, and connect an EVE character. The exact registered EVE callback must be https://dev.evebot.app/auth/eve/callback.
Explicitly synchronize assets. Inspect completeness/freshness, exclusions, and the reference-price label; add further characters through the explicit linking flow.
Compare conventional browsing and chat /value. Live EVE SSO, refresh, and real asset synchronization are not verified merely by validating the client ID/secret or testing the JEV key.

Do not run the write-enabled disposable Convex smoke script against this persistent deployment: its synthetic identities belong only in isolated test backends.

7.1 KiB Raw Permalink Blame History