ekklesiaandClaude Opus 5.5
167b4c4f14
CI / verify (pull_request) Successful in 54s
CI / infrastructure-smoke (pull_request) Successful in 21s
CI / migration-smoke (pull_request) Successful in 1m48s
CI / image-build (pull_request) Successful in 27s
CI / deploy-smoke (pull_request) Successful in 42s
Implement ADR 0044's reference deployment as a base Compose file plus overlays, so an installation that already runs a proxy can use the base alone. - compose.yaml: api, postgres, object-storage, and the operator-only migrate (profile ops, plan by default). No published port. api and migrate run init, read-only, tmpfs /tmp, cap_drop ALL, no-new-privileges. postgres is only on the internal data network. - TLS everywhere from one installation-private CA: PostgreSQL TLS 1.3 only, with pg_hba rejecting every non-TLS connection, and the API on verify-full via EKKLESIA_DATABASE_CA (PEM text). SeaweedFS serves S3 over HTTPS (ADR 0030 requires https in production), trusted by the API through NODE_EXTRA_CA_CERTS. No Core change. - compose.proxy.yaml + Caddyfile.example: Caddy pinned by digest, ACME HTTP-01 (DNS-01 documented), routes /, /api/*, /display/*, /assets/* to api and refuses everything else; the storage hostname preserves Host. The API trusts exactly the proxy's fixed /32 on an edge network whose dynamic range excludes the fixed addresses; Caddy overwrites X-Forwarded-For and strips caller-supplied forwarding headers. - compose.tunnel.yaml: cloudflared pinned by digest, token from its own env file; Caddy honors CF-Connecting-IP only from its fixed address. - Four per-service root-owned env files, examples with no values; scripts/init-tls.sh (idempotent, never overwrites a key) and scripts/gen-secrets.sh (prints only). - CI: pnpm deploy:config in ci:verify for all three combinations, and a deploy-smoke job (scripts/smoke-deploy.sh) proving readiness, the Dashboard, signed storage delivery, the client-address chain, initial owner sign-in/out, verify-full database TLS, and Doctor through the proxy, against disposable services. tests/deploy.test.ts pins the structural guarantees. - ADR 0044 (still Proposed) amended to match: API-to-storage HTTPS, DNS-01 needs a custom Caddy build and tunnel-only needs DNS-01, the tunnel's origin TLS settings live in the Cloudflare dashboard, port 80 serves HTTP-01, and secrets are one env file per service. Co-Authored-By: Claude Opus 5.5 <[email protected]>
42 lines
1.3 KiB
Bash
Executable File
42 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Validates the reference deployment's Compose files (ADR 0044) in each supported combination:
|
|
# base, base + proxy, and base + proxy + tunnel. Uses only the committed example env files, copied
|
|
# to a temporary directory, so it needs no secret and starts nothing.
|
|
|
|
set -Eeuo pipefail
|
|
|
|
repository_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$repository_root/deploy"
|
|
|
|
work="$(mktemp -d)"
|
|
trap 'rm -rf "$work"' EXIT
|
|
|
|
for name in ekklesia postgres object-storage tunnel; do
|
|
cp "env/${name}.env.example" "$work/${name}.env"
|
|
done
|
|
cp env/compose.env.example "$work/compose.env"
|
|
cat >>"$work/compose.env" <<EOF_ENV
|
|
EKKLESIA_IMAGE=registry.example.org/ekklesia:0.0.0
|
|
EKKLESIA_ENV_DIR=${work}
|
|
EKKLESIA_HOSTNAME=ekklesia.example.org
|
|
EKKLESIA_STORAGE_HOSTNAME=storage.ekklesia.example.org
|
|
[email protected]
|
|
EOF_ENV
|
|
|
|
combinations=(
|
|
"compose.yaml"
|
|
"compose.yaml compose.proxy.yaml"
|
|
"compose.yaml compose.proxy.yaml compose.tunnel.yaml"
|
|
)
|
|
for combination in "${combinations[@]}"; do
|
|
arguments=()
|
|
for file in $combination; do
|
|
arguments+=(--file "$file")
|
|
done
|
|
if ! docker compose --env-file "$work/compose.env" "${arguments[@]}" --profile ops config --quiet; then
|
|
echo "Reference deployment Compose configuration is invalid: ${combination}" >&2
|
|
exit 1
|
|
fi
|
|
echo "valid: ${combination}"
|
|
done
|