overseerandClaude Opus 5.5
13e3796d26
Make the live admin PWA deployment reproducible from the repository: - deploy/pwa/Dockerfile: multi-stage build (node:22-alpine builds admin/ with the VITE_* build args, failing fast if any is empty; nginx:alpine pinned to the digest running on the API box serves dist/). - deploy/pwa/Dockerfile.dockerignore: limits the repo-root context to admin/ sources and nginx.conf (the root .dockerignore excludes deploy/). - deploy/pwa/nginx.conf: SPA fallback to index.html, root-served /sw.js and /manifest.webmanifest, allow-list 10.60.1.33 and 10.60.1.14 only. - deploy/compose.yaml: pwa service on NESTQUEST_BIND_ADDRESS:8081 with the build args from deploy/.env; api and litestream unchanged. - deploy/.env.example: the three public PWA build values. - deploy/RUNBOOK.md: section 10 (PWA build/serve, nestquest-app Traefik router, verification) and the router priorities in section 3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
35 lines
1.5 KiB
Bash
35 lines
1.5 KiB
Bash
# Example environment for the NestQuest API container deployment.
|
|
#
|
|
# Copy to ``deploy/.env`` (git-ignored) and fill in REAL values there;
|
|
# this example carries placeholder names only and is never a source of
|
|
# secrets. Compose loads ``deploy/.env`` into the api service; the
|
|
# API fails fast on startup when any of these is unset or empty
|
|
# (api/config.py — there are no silent defaults).
|
|
|
|
# The static panel-plane service token the HA integration presents as
|
|
# a Bearer credential on /api/v1/panel/* routes. Generate one, e.g.:
|
|
# python -c "import secrets; print(secrets.token_urlsafe(32))"
|
|
NESTQUEST_PANEL_TOKEN=
|
|
|
|
# The Authentik OIDC settings the admin plane verifies JWTs against.
|
|
NESTQUEST_OIDC_ISSUER=
|
|
NESTQUEST_OIDC_AUDIENCE=
|
|
NESTQUEST_OIDC_JWKS_URL=
|
|
|
|
# The host interface the API's port 8080 is published on (compose
|
|
# interpolation, not read by the API). Defaults to 127.0.0.1 when
|
|
# unset; on the API box set the LAN address the reverse proxy
|
|
# forwards to, e.g. 10.60.1.14.
|
|
NESTQUEST_BIND_ADDRESS=
|
|
|
|
# Admin PWA build args (compose interpolation into the pwa service's
|
|
# VITE_* build args; baked into the bundle, so rebuild after changing).
|
|
# PUBLIC values, not secrets: the Authentik application is a PKCE client
|
|
# with no client secret. All three are required — the pwa image build
|
|
# fails when any is empty.
|
|
# NESTQUEST_AUTHENTIK_ISSUER=https://auth.cubecraftlabs.com/application/o/nestquest/
|
|
# NESTQUEST_API_BASE_URL=https://nestquest.cubecraftlabs.com
|
|
NESTQUEST_AUTHENTIK_CLIENT_ID=
|
|
NESTQUEST_AUTHENTIK_ISSUER=
|
|
NESTQUEST_API_BASE_URL=
|