Zayin/Ekklesia
3
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Packages Projects Releases 8 Wiki Activity

feat(deploy): add the reference deployment Compose project #49

Merged
Zayin_Admin merged 1 commits from feat/deploy-reference-compose into main 2026-10-02 03:08:08 +00:00
Conversation 0 Commits 1 Files Changed 21
+1902 -116
Zayin_Admin commented 2026-10-02 03:01:32 +00:00
Owner
Copy Link
Copy Source

Implement ADR 0044's reference deployment as a base Compose file plus
overlays, so an installation that already runs a proxy can use the base
alone.

  • compose.yaml: api, postgres, object-storage, and the operator-only
    migrate (profile ops, plan by default). No published port. api and
    migrate run init, read-only, tmpfs /tmp, cap_drop ALL,
    no-new-privileges. postgres is only on the internal data network.
  • TLS everywhere from one installation-private CA: PostgreSQL TLS 1.3
    only, with pg_hba rejecting every non-TLS connection, and the API on
    verify-full via EKKLESIA_DATABASE_CA (PEM text). SeaweedFS serves S3
    over HTTPS (ADR 0030 requires https in production), trusted by the
    API through NODE_EXTRA_CA_CERTS. No Core change.
  • compose.proxy.yaml + Caddyfile.example: Caddy pinned by digest, ACME
    HTTP-01 (DNS-01 documented), routes /, /api/, /display/, /assets/*
    to api and refuses everything else; the storage hostname preserves
    Host. The API trusts exactly the proxy's fixed /32 on an edge network
    whose dynamic range excludes the fixed addresses; Caddy overwrites
    X-Forwarded-For and strips caller-supplied forwarding headers.
  • compose.tunnel.yaml: cloudflared pinned by digest, token from its own
    env file; Caddy honors CF-Connecting-IP only from its fixed address.
  • Four per-service root-owned env files, examples with no values;
    scripts/init-tls.sh (idempotent, never overwrites a key) and
    scripts/gen-secrets.sh (prints only).
  • CI: pnpm deploy:config in ci:verify for all three combinations, and a
    deploy-smoke job (scripts/smoke-deploy.sh) proving readiness, the
    Dashboard, signed storage delivery, the client-address chain, initial
    owner sign-in/out, verify-full database TLS, and Doctor through the
    proxy, against disposable services. tests/deploy.test.ts pins the
    structural guarantees.
  • ADR 0044 (still Proposed) amended to match: API-to-storage HTTPS,
    DNS-01 needs a custom Caddy build and tunnel-only needs DNS-01, the
    tunnel's origin TLS settings live in the Cloudflare dashboard, port
    80 serves HTTP-01, and secrets are one env file per service.

Co-Authored-By: Claude Opus 5.5 [email protected]

Implement ADR 0044's reference deployment as a base Compose file plus overlays, so an installation that already runs a proxy can use the base alone. - compose.yaml: api, postgres, object-storage, and the operator-only migrate (profile ops, plan by default). No published port. api and migrate run init, read-only, tmpfs /tmp, cap_drop ALL, no-new-privileges. postgres is only on the internal data network. - TLS everywhere from one installation-private CA: PostgreSQL TLS 1.3 only, with pg_hba rejecting every non-TLS connection, and the API on verify-full via EKKLESIA_DATABASE_CA (PEM text). SeaweedFS serves S3 over HTTPS (ADR 0030 requires https in production), trusted by the API through NODE_EXTRA_CA_CERTS. No Core change. - compose.proxy.yaml + Caddyfile.example: Caddy pinned by digest, ACME HTTP-01 (DNS-01 documented), routes /, /api/*, /display/*, /assets/* to api and refuses everything else; the storage hostname preserves Host. The API trusts exactly the proxy's fixed /32 on an edge network whose dynamic range excludes the fixed addresses; Caddy overwrites X-Forwarded-For and strips caller-supplied forwarding headers. - compose.tunnel.yaml: cloudflared pinned by digest, token from its own env file; Caddy honors CF-Connecting-IP only from its fixed address. - Four per-service root-owned env files, examples with no values; scripts/init-tls.sh (idempotent, never overwrites a key) and scripts/gen-secrets.sh (prints only). - CI: pnpm deploy:config in ci:verify for all three combinations, and a deploy-smoke job (scripts/smoke-deploy.sh) proving readiness, the Dashboard, signed storage delivery, the client-address chain, initial owner sign-in/out, verify-full database TLS, and Doctor through the proxy, against disposable services. tests/deploy.test.ts pins the structural guarantees. - ADR 0044 (still Proposed) amended to match: API-to-storage HTTPS, DNS-01 needs a custom Caddy build and tunnel-only needs DNS-01, the tunnel's origin TLS settings live in the Cloudflare dashboard, port 80 serves HTTP-01, and secrets are one env file per service. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Zayin_Admin added 1 commit 2026-10-02 03:01:33 +00:00
feat(deploy): add the reference deployment Compose project
CI / verify (pull_request) Successful in 54s
Details
CI / infrastructure-smoke (pull_request) Successful in 21s
Details
CI / migration-smoke (pull_request) Successful in 1m48s
Details
CI / image-build (pull_request) Successful in 27s
Details
CI / deploy-smoke (pull_request) Successful in 42s
Details
167b4c4f14 
Implement ADR 0044's reference deployment as a base Compose file plus
overlays, so an installation that already runs a proxy can use the base
alone.

- compose.yaml: api, postgres, object-storage, and the operator-only
  migrate (profile ops, plan by default). No published port. api and
  migrate run init, read-only, tmpfs /tmp, cap_drop ALL,
  no-new-privileges. postgres is only on the internal data network.
- TLS everywhere from one installation-private CA: PostgreSQL TLS 1.3
  only, with pg_hba rejecting every non-TLS connection, and the API on
  verify-full via EKKLESIA_DATABASE_CA (PEM text). SeaweedFS serves S3
  over HTTPS (ADR 0030 requires https in production), trusted by the
  API through NODE_EXTRA_CA_CERTS. No Core change.
- compose.proxy.yaml + Caddyfile.example: Caddy pinned by digest, ACME
  HTTP-01 (DNS-01 documented), routes /, /api/*, /display/*, /assets/*
  to api and refuses everything else; the storage hostname preserves
  Host. The API trusts exactly the proxy's fixed /32 on an edge network
  whose dynamic range excludes the fixed addresses; Caddy overwrites
  X-Forwarded-For and strips caller-supplied forwarding headers.
- compose.tunnel.yaml: cloudflared pinned by digest, token from its own
  env file; Caddy honors CF-Connecting-IP only from its fixed address.
- Four per-service root-owned env files, examples with no values;
  scripts/init-tls.sh (idempotent, never overwrites a key) and
  scripts/gen-secrets.sh (prints only).
- CI: pnpm deploy:config in ci:verify for all three combinations, and a
  deploy-smoke job (scripts/smoke-deploy.sh) proving readiness, the
  Dashboard, signed storage delivery, the client-address chain, initial
  owner sign-in/out, verify-full database TLS, and Doctor through the
  proxy, against disposable services. tests/deploy.test.ts pins the
  structural guarantees.
- ADR 0044 (still Proposed) amended to match: API-to-storage HTTPS,
  DNS-01 needs a custom Caddy build and tunnel-only needs DNS-01, the
  tunnel's origin TLS settings live in the Cloudflare dashboard, port
  80 serves HTTP-01, and secrets are one env file per service.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Zayin_Admin merged commit 481e80118b into main 2026-10-02 03:08:08 +00:00
Zayin_Admin deleted branch feat/deploy-reference-compose 2026-10-02 03:08:08 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Joey Zayin_Admin ekklesia-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Zayin/Ekklesia#49