bvandeusenandClaude Opus 5.5
787685ac63
CI & Build / Python lint (push) Successful in 3s
CI & Build / Plugin hooks (push) Successful in 16s
CI & Build / TypeScript typecheck (push) Successful in 55s
CI & Build / integration (push) Successful in 1m9s
CI & Build / Python tests (push) Successful in 2m7s
CI & Build / Build & push image (push) Successful in 30s
With no SECRET_KEY set, Grimoire fell back to a fixed placeholder. The quickstart compose substituted change-me-in-production, so the README's own update step (pull, up -d) recreated the container on that placeholder, and every credential sealed under the key the user started with stopped opening. - config: with neither SECRET_KEY nor SECRET_KEY_FILE, the first start writes a random key to DATA_DIR/secret_key (mode 0600, published with a hard link so concurrent starts agree), and later starts read it back. An explicit key wins and leaves the file alone. A missing SECRET_KEY_FILE or an empty key file stops the start instead of switching keys. With no data directory (a run outside the container) the process gets a temporary key and says so. - app: warns on a public placeholder key, on a temporary key, and when /data is not a mounted volume. - Dockerfile creates /data. - docker-compose.yml is now the deploy compose (published image, both volumes, nothing to set). The build-from-source compose is docker-compose.dev.yml, and docker-compose.quickstart.yml is gone. The Swarm stack file gains the /data volume and keeps its explicit key, because a Swarm can move the app away from a node-local volume. - README: a Deploy section with the compose inline, SECRET_KEY optional, "keep both volumes", and updates that keep the key. A test holds the README's copy equal to the file. - Installs that ran on the change-me-in-production placeholder get a key of their own on the new compose; Settings then asks once for saved forge tokens and the backup secret. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
65 lines
2.2 KiB
Docker
65 lines
2.2 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# Stage 1: Build Vue frontend
|
|
FROM node:22-alpine AS build-frontend
|
|
WORKDIR /build
|
|
COPY frontend/package.json frontend/package-lock.json* ./
|
|
RUN npm ci --quiet
|
|
COPY frontend/ .
|
|
RUN npm run build
|
|
|
|
# Stage 2: Python runtime
|
|
# Tracks CI image (ci-python:3.14) so test results stay representative.
|
|
FROM python:3.14-slim AS runtime
|
|
WORKDIR /app
|
|
|
|
# Installed from uv.lock, exactly like CI, so the image runs the dependency
|
|
# versions CI tested.
|
|
RUN --mount=type=cache,target=/root/.cache/pip \
|
|
pip install --no-cache-dir uv
|
|
|
|
# Dependencies before source, so the expensive layer is cached on every build
|
|
# that doesn't change the lock.
|
|
COPY pyproject.toml uv.lock ./
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --locked --no-dev --no-install-project
|
|
|
|
COPY src/ src/
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --locked --no-dev
|
|
|
|
# uv sync installs into a project venv rather than the system interpreter, so
|
|
# alembic and hypercorn in CMD have to be found there.
|
|
ENV PATH="/app/.venv/bin:$PATH"
|
|
|
|
COPY --from=build-frontend /build/dist/ src/grimoire/static/
|
|
COPY alembic.ini .
|
|
COPY alembic/ alembic/
|
|
|
|
# Ensure Python finds the source tree (where static files live) before site-packages
|
|
ENV PYTHONPATH=/app/src
|
|
|
|
# Three values kept separate, plus the commit:
|
|
# BUILD_VERSION is the name (YYYY.MM.DD.HHMM from commit time), the same on
|
|
# every lane for the same source.
|
|
# BUILD_KEY is the ordering key (minutes since 2020-01-01 from build time), the
|
|
# only value compared to decide which build is newer.
|
|
# BUILD_CHANNEL is its own field, never part of the name.
|
|
# BUILD_COMMIT lets the image's self-report be checked against its :<sha> tag.
|
|
# A local build leaves the key and channel empty: it has no place in an update
|
|
# order, and /api/version omits them.
|
|
ARG BUILD_VERSION=dev
|
|
ARG BUILD_KEY=
|
|
ARG BUILD_CHANNEL=
|
|
ARG BUILD_COMMIT=
|
|
ENV APP_VERSION=$BUILD_VERSION
|
|
ENV APP_BUILD_KEY=$BUILD_KEY
|
|
ENV APP_CHANNEL=$BUILD_CHANNEL
|
|
ENV APP_COMMIT=$BUILD_COMMIT
|
|
|
|
# The instance's own SECRET_KEY, the model cache and diagnostics live here.
|
|
# Mount a volume on it so they outlive the container.
|
|
RUN mkdir -p /data
|
|
|
|
EXPOSE 5000
|
|
CMD ["sh", "-c", "alembic upgrade head && hypercorn 'grimoire.app:create_app()' --bind 0.0.0.0:5000 --keep-alive 600"]
|