Tizian 「ティツィアーン」
f635b0816a
A person with an identity and a public profile publishes a studyset with
everything inside it as its next release (ADR 0005, rule 3): the server
reads their synced rows and writes them through the git command as a
commit on main and the annotated tag vN, in a bare repository of the
studyset's own, named by a random public id made at the first publish.
A release is a directory per studyset with a file per card, note, path,
step and PDF (its id, position, tag names and payload as synced, keys
sorted and indented) and the files the content names, without what is
only the author's (a card's report, a PDF's deadline). Publishing is
refused without a licence allowing passing it on in every studyset ("no
derivatives" allowed), with revisions to settle, with files not uploaded
yet, when nothing changed, or for a name that won't do; the name is
fixed from the first release, as is the person's handle.
In the app, Share in a studyset's action row opens the Publish sheet;
publishing syncs first, and settles by itself the revisions that merge
cleanly, listing only real conflicts. The server's image gets git, the
repositories a volume of their own, and the hourly backup a git bundle of
each.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MMm7usAo6q9ZZRoPkWjoxi
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
68 lines
3.5 KiB
Docker
68 lines
3.5 KiB
Docker
# The server image. Built from the repository root (the build context), because the
|
|
# workspace's root pubspec and lockfile live there:
|
|
#
|
|
# docker build -f halkyon_learn_server/Dockerfile .
|
|
#
|
|
# Based on Serverpod's template, with three changes: Dart 3.13 (our SDK floor), an
|
|
# Ubuntu 24.04 runtime instead of alpine + Dart's minimal glibc runtime (same
|
|
# distribution as our servers; complete glibc, which Serverpod 4's bundled SQLite
|
|
# libraries need), and a start command that passes Docker's stop signal on.
|
|
|
|
# ── Build stage: compile the server to a native executable ────────────────────────
|
|
FROM dart:3.13.4 AS build
|
|
WORKDIR /app
|
|
COPY pubspec.yaml pubspec.lock ./
|
|
COPY halkyon_learn_server halkyon_learn_server
|
|
|
|
# The workspace root with only the server package: neither the client package nor the
|
|
# curator is needed to build the server, and the Flutter app would need Flutter.
|
|
# Everything else stays as the repository has it, above all the dependency overrides,
|
|
# without which the offline sync package's exact Serverpod pin can't be resolved. The
|
|
# check fails the build loudly if the root's member list changes shape.
|
|
RUN sed -i -e '/^ - halkyon_learn_client$/d' -e '/^ - halkyon_learn_flutter$/d' \
|
|
-e '/^ - halkyon_learn_curator$/d' pubspec.yaml \
|
|
&& grep -q '^ - halkyon_learn_server$' pubspec.yaml \
|
|
&& ! grep -q -e 'halkyon_learn_client' -e 'halkyon_learn_flutter' \
|
|
-e 'halkyon_learn_curator' pubspec.yaml
|
|
RUN dart pub get
|
|
WORKDIR /app/halkyon_learn_server
|
|
RUN dart build cli --target bin/main.dart --output build
|
|
RUN mv build/bundle/bin/main build/bundle/bin/server
|
|
RUN mkdir -p config migrations
|
|
|
|
# ── Runtime stage ─────────────────────────────────────────────────────────────────
|
|
# Ubuntu 24.04: glibc 2.39 (the bundled binaries need at most 2.34, measured) and
|
|
# libgcc_s (needed by libsqlite3_connection_pool, a Rust library; a server running
|
|
# against Postgres never loads it, but a future code path might). CA certificates
|
|
# for outgoing TLS, e.g. GitHub sign-in. git for the published studysets' releases
|
|
# (ADR 0005, rule 3), which the server writes through the git command.
|
|
FROM ubuntu:24.04
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates git \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
WORKDIR /app
|
|
|
|
ENV runmode=production
|
|
ENV serverid=default
|
|
ENV logging=normal
|
|
ENV role=monolith
|
|
|
|
COPY --from=build /app/halkyon_learn_server/build/bundle/ ./
|
|
COPY --from=build /app/halkyon_learn_server/config/ config/
|
|
COPY --from=build /app/halkyon_learn_server/migrations/ migrations/
|
|
COPY --from=build /app/halkyon_learn_server/lib/src/generated/protocol.yaml lib/src/generated/protocol.yaml
|
|
|
|
# The server needs no root rights (it listens on 8080 and writes only into the
|
|
# repositories folder), so it runs as an unprivileged system user. The folder is the
|
|
# app user's, and a new volume mounted on it takes that over.
|
|
RUN useradd --system --no-create-home --shell /usr/sbin/nologin app \
|
|
&& mkdir repositories && chown app:app repositories
|
|
USER app
|
|
|
|
# Only the API server runs in production (no Insights, no web server).
|
|
EXPOSE 8080
|
|
|
|
# `exec` makes the server PID 1, so it receives Docker's SIGTERM and shuts down
|
|
# cleanly; extra arguments (e.g. --apply-migrations) come from the container command.
|
|
ENTRYPOINT ["/bin/sh", "-c", "exec ./bin/server --mode=$runmode --server-id=$serverid --logging=$logging --role=$role \"$@\"", "--"]
|
|
CMD []
|