Tizian 「ティツィアーン」
fd9c2dfe76
Meditate's deploy step (ADR 0038, step 7; ADR 0039, D14), as Todo's: the server's Dockerfile with the library's check compiled beside it, its production config on its own database and role, compose.meditate.yaml as a member of the register, its site sending /library/* to the web server and the rest to the API server, the operator's library read-only in a compose file of its own, and redeploy.sh, backup.sh and the image replay taking it in. Every server's public address now comes from .env (Serverpod's SERVERPOD_API_SERVER_PUBLIC_HOST and _WEB_SERVER_, which win over the config file): Train, Todo and Meditate from their domains, Learn from LEARN_PUBLIC_HOST, unset learn.halkyon.eu as before. Without it a server on halkyon.li would name halkyon.eu in its SimpleLogin callback, profile pages and privacy page. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
69 lines
3.5 KiB
Docker
69 lines
3.5 KiB
Docker
# Meditate's server image (ADR 0038, step 7). Built from the repository root (the build
|
|
# context), because the workspace's root pubspec and lockfile live there:
|
|
#
|
|
# docker build -f apps/meditate/halkyon_meditate_server/Dockerfile .
|
|
#
|
|
# Todo's server image (apps/todo/halkyon_todo_server/Dockerfile) for Meditate: the same
|
|
# Dart, the same Ubuntu runtime and start command, and beside the server the library's
|
|
# check (bin/check_library.dart, D16), so an operator checks a folder on the host with
|
|
# the image the server runs:
|
|
#
|
|
# docker compose run --rm --no-deps -v /path/to/library:/check:ro \
|
|
# --entrypoint ./bin/check_library meditate-server /check
|
|
|
|
# ── Build stage: compile the server and the check to native executables ───────────
|
|
FROM dart:3.13.4 AS build
|
|
WORKDIR /app
|
|
COPY pubspec.yaml pubspec.lock ./
|
|
COPY tool/workspace_only.sh tool/
|
|
COPY apps/meditate/halkyon_meditate_server apps/meditate/halkyon_meditate_server
|
|
COPY packages/halkyon_base_server packages/halkyon_base_server
|
|
COPY packages/halkyon_base_client packages/halkyon_base_client
|
|
COPY packages/halkyon_core packages/halkyon_core
|
|
COPY packages/halkyon_llm packages/halkyon_llm
|
|
COPY packages/halkyon_oidc_server packages/halkyon_oidc_server
|
|
COPY packages/halkyon_oidc_client packages/halkyon_oidc_client
|
|
|
|
# The workspace root with only the server and the modules it builds on, as Learn's
|
|
# image has it (the reasons there).
|
|
RUN sh tool/workspace_only.sh apps/meditate/halkyon_meditate_server packages/halkyon_base_server packages/halkyon_base_client packages/halkyon_core packages/halkyon_llm packages/halkyon_oidc_server packages/halkyon_oidc_client
|
|
RUN dart pub get
|
|
WORKDIR /app/apps/meditate/halkyon_meditate_server
|
|
RUN dart build cli --target bin/main.dart --output build
|
|
RUN mv build/bundle/bin/main build/bundle/bin/server
|
|
# The check, built on its own and put beside the server: it reads a folder as the
|
|
# server does, with the same code.
|
|
RUN dart build cli --target bin/check_library.dart --output build-check
|
|
RUN mv build-check/bundle/bin/check_library build/bundle/bin/check_library
|
|
RUN mkdir -p config migrations
|
|
|
|
# ── Runtime stage ─────────────────────────────────────────────────────────────────
|
|
# Ubuntu 24.04 as Learn's; CA certificates for outgoing TLS (the operator's
|
|
# assistants, which the module forwards, ADR 0021).
|
|
FROM ubuntu:24.04
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
WORKDIR /app
|
|
|
|
ENV runmode=production
|
|
ENV serverid=default
|
|
ENV logging=normal
|
|
ENV role=monolith
|
|
|
|
COPY --from=build /app/apps/meditate/halkyon_meditate_server/build/bundle/ ./
|
|
COPY --from=build /app/apps/meditate/halkyon_meditate_server/config/ config/
|
|
COPY --from=build /app/apps/meditate/halkyon_meditate_server/migrations/ migrations/
|
|
COPY --from=build /app/apps/meditate/halkyon_meditate_server/lib/src/generated/protocol.yaml lib/src/generated/protocol.yaml
|
|
|
|
# No root rights needed: it listens on 8080 and 8082 and writes nothing; the library is
|
|
# read-only (compose.meditate-library.yaml).
|
|
RUN useradd --system --no-create-home --shell /usr/sbin/nologin app
|
|
USER app
|
|
|
|
# The API server, and the web server with the library's files (D16) and the register's
|
|
# calls about accounts gone (ADR 0016), the latter on the instance's own network alone.
|
|
EXPOSE 8080 8082
|
|
|
|
ENTRYPOINT ["/bin/sh", "-c", "exec ./bin/server --mode=$runmode --server-id=$serverid --logging=$logging --role=$role \"$@\"", "--"]
|
|
CMD []
|