ekklesiaandClaude Opus 5.5
a4966dd0dd
CI / verify (pull_request) Successful in 50s
CI / infrastructure-smoke (pull_request) Successful in 21s
CI / migration-smoke (pull_request) Failing after 25s
CI / image-build (pull_request) Successful in 18s
CI / deploy-smoke (same-origin) (pull_request) Successful in 49s
CI / deploy-smoke (split) (pull_request) Successful in 1m17s
An installation can now serve the Dashboard and the API on sibling hostnames (dash./api.) beside the default same-origin topology, from one image and with configuration alone. - The Dashboard learns its API origin at run time: the built page carries one empty <meta name="ekklesia-api-origin">, which the API fills with its identity base URL's origin at startup, before computing the page's ETag. The shell accepts only a canonical http(s) origin and otherwise fails closed without making a request. The build-time EKKLESIA_API_BASE_URL is gone from the bundle; the development server injects the same element. - The display host stays on the API's origin, so its device cookies, requests, and offline cache are unchanged. - The API trusts its own origin (trusted origins plus the identity base URL), as Better Auth already does, so the display page's mutations pass the origin check without operators listing it. - Doctor validates EKKLESIA_DASHBOARD_ORIGIN exactly as the API's startup does (it previously skipped it), reports the topology without printing hostnames, and warns when split hostnames are not siblings. - The module UI contract states the CORS header limit (safelisted headers plus Content-Type, safelisted response headers only). - Reference deployment: Caddyfile.split.example (Dashboard hostname serves / and its script; API hostname serves /api/*, /display/*, and the display script; each refuses the other's paths) and EKKLESIA_DASHBOARD_HOSTNAME in the proxy overlay and env examples. - The deploy smoke test runs either topology (CI runs both). The split run installs the module template as a test-only module, checks per-hostname routing and exact CORS, then drives a digest-pinned headless Chromium over the DevTools protocol, with no added dependency: sign-in on the Dashboard hostname, the session cookie host-only on the API hostname, the module UI imported cross-origin and its credentialed request succeeding, the display and its service worker on the API hostname, and sign-out. ADR 0045 is marked Accepted. Co-Authored-By: Claude Opus 5.5 <[email protected]>
76 lines
4.0 KiB
Bash
76 lines
4.0 KiB
Bash
# Ekklesia API and operator commands (`api` and `migrate`). Reference deployment, ADR 0044.
|
|
#
|
|
# Install as EKKLESIA_ENV_DIR/ekklesia.env (default /etc/ekklesia/ekklesia.env), owned by root with
|
|
# mode 600:
|
|
# install -o root -g root -m 600 env/ekklesia.env.example /etc/ekklesia/ekklesia.env
|
|
# Never commit the filled-in file. Generate secrets with scripts/gen-secrets.sh, and the database CA
|
|
# line with scripts/init-tls.sh.
|
|
#
|
|
# The image already sets NODE_ENV=production, EKKLESIA_API_HOST=0.0.0.0, and EKKLESIA_API_PORT=3000.
|
|
# Compose sets NODE_EXTRA_CA_CERTS. The proxy overlay sets the three EKKLESIA_CLIENT_ADDRESS_*
|
|
# variables. None of those belong here.
|
|
#
|
|
# Values that are part of the reference topology are filled in; everything installation-specific is
|
|
# blank. Full reference: docs/development/api.md#required-configuration.
|
|
|
|
# --- Database (ADR 0018) ------------------------------------------------------------------------
|
|
# The host must be exactly `postgres`: the server certificate is issued for that name and
|
|
# verify-full checks it. User, password, and database must match postgres.env. Percent-encode any
|
|
# reserved character in the password. Never add sslmode or another TLS parameter to this URL.
|
|
DATABASE_URL=postgresql://<user>:<password>@postgres:5432/<database>
|
|
EKKLESIA_DATABASE_TLS_MODE=verify-full
|
|
# The installation-private CA as PEM text (not a path), on one double-quoted line with \n escapes.
|
|
# scripts/init-tls.sh prints this exact line. It is the only CA the database connection trusts.
|
|
EKKLESIA_DATABASE_CA=
|
|
|
|
# --- Identity (ADR 0011, ADR 0018, ADR 0034, ADR 0045) -----------------------------------------
|
|
# The public https origin of the API, with no path: the Ekklesia hostname in the same-origin
|
|
# topology, the API's hostname in the split one. Production rejects http and loopback origins.
|
|
EKKLESIA_IDENTITY_BASE_URL=
|
|
# Comma-separated exact origins allowed to make credentialed requests. The API's own origin is
|
|
# always trusted and need not be listed. Same-origin topology: the base URL. Split topology: the
|
|
# Dashboard's origin.
|
|
EKKLESIA_IDENTITY_TRUSTED_ORIGINS=
|
|
# At least 32 random characters. Rotating it signs every user out.
|
|
EKKLESIA_IDENTITY_SECRET=
|
|
# Same-origin topology: leave unset; the Dashboard is served from the base URL (ADR 0044).
|
|
# Split topology: the Dashboard's https origin, which must also be in the trusted origins. Emailed
|
|
# verification and reset links land here (ADR 0045).
|
|
# EKKLESIA_DASHBOARD_ORIGIN=
|
|
# Production refuses public sign-up. Leave unset.
|
|
# EKKLESIA_PUBLIC_SIGNUP_ENABLED=
|
|
|
|
# --- Client address (ADR 0017) ------------------------------------------------------------------
|
|
# Set by compose.proxy.yaml. Only a base-only deployment behind its own proxy sets these here, with
|
|
# that proxy's fixed address as the only trusted entry (deploy/README.md):
|
|
# EKKLESIA_CLIENT_ADDRESS_MODE=trusted-proxy
|
|
# EKKLESIA_CLIENT_ADDRESS_HEADER=x-forwarded-for
|
|
# EKKLESIA_CLIENT_ADDRESS_TRUSTED_PROXIES=<proxy address>/32
|
|
|
|
# --- Object storage (ADR 0030, ADR 0031) --------------------------------------------------------
|
|
# The API reaches SeaweedFS over HTTPS on the private network; production storage must be https.
|
|
S3_ENDPOINT=https://object-storage:8443
|
|
# The https origin browsers fetch signed object URLs from: the storage hostname on the proxy.
|
|
S3_DELIVERY_ENDPOINT=
|
|
# Must match object-storage.env.
|
|
S3_ACCESS_KEY=
|
|
S3_SECRET_KEY=
|
|
S3_REGION=us-east-1
|
|
S3_FORCE_PATH_STYLE=true
|
|
S3_BUCKET_PREFIX=ekklesia
|
|
|
|
# --- Outbound email (ADR 0037), optional --------------------------------------------------------
|
|
# Without a relay, email verification and password recovery cannot deliver. See
|
|
# docs/development/email.md.
|
|
# EKKLESIA_SMTP_HOST=
|
|
# EKKLESIA_SMTP_PORT=587
|
|
# EKKLESIA_SMTP_SECURITY=starttls
|
|
# EKKLESIA_SMTP_USERNAME=
|
|
# EKKLESIA_SMTP_PASSWORD=
|
|
# EKKLESIA_SMTP_FROM_ADDRESS=
|
|
# EKKLESIA_SMTP_FROM_NAME=Ekklesia
|
|
# EKKLESIA_SMTP_HELO_NAME=
|
|
|
|
# --- Module secrets (ADR 0029), as installed modules declare them --------------------------------
|
|
# EKKLESIA_MODULE_SECRET__<MODULE_ID>__<KEY>=
|