build(todo): Todo deployable beside Learn's server, and released as an APK, on F-Droid and as a snap (ADR 0033, step 5)

deploy/compose.todo.yaml adds Todo's server at todo.halkyon.eu, a member
of Learn's register, its database halkyon_todo in the instance's
PostgreSQL, its image built as Train's. redeploy.sh and backup.sh go over
every app server .env switches on (train, todo). Each compose file names
its server to the register in a variable of its own
(INSTANCE_MEMBER_TRAIN, INSTANCE_MEMBER_TODO), which halkyon_base adds to
INSTANCE_MEMBERS, each address once, as a second compose file's default
would have replaced Train's.

apps/todo/release.dart configures the release tool for Todo's APK and
snap: a key of its own (pinned once made; until then nothing is
released), the F-Droid listing (Time, NonFreeNet), and the snap from
apps/todo/snap/, which the tool builds in a clone of the repository at the
tag with that folder in place of snap/, as snapcraft builds one recipe a
folder and the root's is Learn's. What's new for 0.1.0 in English and
German, now shown. Android's backup and transfer are off, as Train's
(D53): the reminders scheduled keep their tasks' titles unsealed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

apps/todo/halkyon_todo_server/Dockerfile

@@ -0,0 +1,60 @@
+# Todo's server image (ADR 0033, step 5). Built from the repository root (the build
+# context), because the workspace's root pubspec and lockfile live there:
+#
+#   docker build -f apps/todo/halkyon_todo_server/Dockerfile .
+#
+# Train's server image (apps/train/halkyon_train_server/Dockerfile) for Todo, as
+# Learn's: the same Dart, the same Ubuntu runtime and start command; no git, no
+# repositories folder, no data of its own.
+
+# ── Build stage: compile the server to a native executable ────────────────────────
+FROM dart:3.13.4 AS build
+WORKDIR /app
+COPY pubspec.yaml pubspec.lock ./
+COPY tool/workspace_only.sh tool/
+COPY apps/todo/halkyon_todo_server apps/todo/halkyon_todo_server
+COPY packages/halkyon_base_server packages/halkyon_base_server
+COPY packages/halkyon_base_client packages/halkyon_base_client
+COPY packages/halkyon_core packages/halkyon_core
+COPY packages/halkyon_llm packages/halkyon_llm
+COPY packages/halkyon_oidc_server packages/halkyon_oidc_server
+COPY packages/halkyon_oidc_client packages/halkyon_oidc_client
+
+# The workspace root with only the server and the modules it builds on, as Learn's
+# image has it (the reasons there).
+RUN sh tool/workspace_only.sh apps/todo/halkyon_todo_server packages/halkyon_base_server packages/halkyon_base_client packages/halkyon_core packages/halkyon_llm packages/halkyon_oidc_server packages/halkyon_oidc_client
+RUN dart pub get
+WORKDIR /app/apps/todo/halkyon_todo_server
+RUN dart build cli --target bin/main.dart --output build
+RUN mv build/bundle/bin/main build/bundle/bin/server
+RUN mkdir -p config migrations
+
+# ── Runtime stage ─────────────────────────────────────────────────────────────────
+# Ubuntu 24.04 as Learn's; CA certificates for outgoing TLS (the operator's
+# assistants, which the module forwards, ADR 0021).
+FROM ubuntu:24.04
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+
+ENV runmode=production
+ENV serverid=default
+ENV logging=normal
+ENV role=monolith
+
+COPY --from=build /app/apps/todo/halkyon_todo_server/build/bundle/ ./
+COPY --from=build /app/apps/todo/halkyon_todo_server/config/ config/
+COPY --from=build /app/apps/todo/halkyon_todo_server/migrations/ migrations/
+COPY --from=build /app/apps/todo/halkyon_todo_server/lib/src/generated/protocol.yaml lib/src/generated/protocol.yaml
+
+# No root rights needed: it listens on 8080 and 8082 and writes nothing.
+RUN useradd --system --no-create-home --shell /usr/sbin/nologin app
+USER app
+
+# The API server, and the web server the register tells of accounts gone (ADR
+# 0016), reached on the instance's own network alone.
+EXPOSE 8080 8082
+
+ENTRYPOINT ["/bin/sh", "-c", "exec ./bin/server --mode=$runmode --server-id=$serverid --logging=$logging --role=$role \"$@\"", "--"]
+CMD []

apps/todo/halkyon_todo_server/config/production.yaml

@@ -1,27 +1,20 @@
-# This is the configuration file for your production environment.
-# Typically, you will want to route the traffic through a load balancer
-# which adds SSL security through https. If you use Serverpod's standard
-# Terraform scripts to deploy your server, all you need to change in
-# this file is the examplepod.com domain name.
+# Todo's server on learn.halkyon.eu's server, at todo.halkyon.eu (ADR 0033, step 5),
+# behind the instance's Caddy (deploy/compose.todo.yaml): its API and its web server
+# on the one domain, as Learn's and Train's; its database in the instance's PostgreSQL.
 
 # Configuration for the main API server.
 apiServer:
   port: 8080
-  publicHost: api.examplepod.com
+  publicHost: todo.halkyon.eu
   publicPort: 443
   publicScheme: https
 
-# Configuration for the Insights server.
-insightsServer:
-  port: 8081
-  publicHost: insights.examplepod.com
-  publicPort: 443
-  publicScheme: https
+# No insightsServer, as Learn's: without the block Serverpod doesn't start Insights.
 
 # Configuration for the web server.
 webServer:
   port: 8082
-  publicHost: app.examplepod.com
+  publicHost: todo.halkyon.eu
   publicPort: 443
   publicScheme: https
 
@@ -30,11 +23,12 @@ webServer:
 # If you are connecting on a public IP (e.g. on AWS or Google Cloud Run), you
 # connect on the public IP of the database e.g. database.examplepod.com.
 database:
-  host: database.private-production.examplepod.com
+  host: postgres
   port: 5432
-  name: serverpod
-  user: postgres
-  requireSsl: true
+  name: halkyon_todo
+  user: halkyon_todo
+  # On the instance's own network, never leaving the server.
+  requireSsl: false
   #isUnixSocket: true # defaults to false
   #maxConnectionCount: 10 # Defaults to 10, a negative or null value removes the limit