overseer
f670121489
The API deployable had no packaging of its own: its runtime deps lived only in the integration's dev group, so there was no way to deploy the service without dragging the test venv along. Package the API as a container image (Dockerfile, multi-stage slim build, non-root) with the deployable's own manifest api/requirements.txt, and run it via deploy/compose.yaml with the SQLite file on the named volume nestquest-db so recreating the container keeps household data. Secrets are supplied by the environment (ignored deploy/.env, example with placeholder names only). TLS/reverse proxy, Authentik wiring and network separation are later Feature 17 tasks; the port is bound to localhost until they land.
17 lines
764 B
Bash
17 lines
764 B
Bash
# Example environment for the NestQuest API container deployment.
|
|
#
|
|
# Copy to ``deploy/.env`` (git-ignored) and fill in REAL values there;
|
|
# this example carries placeholder names only and is never a source of
|
|
# secrets. Compose loads ``deploy/.env`` into the api service; the
|
|
# API fails fast on startup when any of these is unset or empty
|
|
# (api/config.py — there are no silent defaults).
|
|
|
|
# The static panel-plane service token the HA integration presents as
|
|
# a Bearer credential on /api/v1/panel/* routes. Generate one, e.g.:
|
|
# python -c "import secrets; print(secrets.token_urlsafe(32))"
|
|
NESTQUEST_PANEL_TOKEN=
|
|
|
|
# The Authentik OIDC settings the admin plane verifies JWTs against.
|
|
NESTQUEST_OIDC_ISSUER=
|
|
NESTQUEST_OIDC_AUDIENCE=
|
|
NESTQUEST_OIDC_JWKS_URL= |