Skip to content

feat: docker compose for full hosting set up#2569

Open
sidpalas wants to merge 6 commits intodevelopfrom
sp/full-docker-compose
Open

feat: docker compose for full hosting set up#2569
sidpalas wants to merge 6 commits intodevelopfrom
sp/full-docker-compose

Conversation

@sidpalas
Copy link
Collaborator

@sidpalas sidpalas commented Feb 9, 2026

🧠 Ai UsageDetails (if applicable):

IMPORTANT: Please disclose any usage of ai tooling while making this change. If you did not use any AI write "NA" below

Example: Used ChatGPT to help with doc phrasing.
Example: Code generated by Copilot; reviewed and verified manually.

Initial implementation pass performed via opencode + codex. Review + testing + refactoring performed both manually and via opencode.


  • Adds full-stack docker-compose (orchestrator, statesman, drift, UI, sidecar, token-service, MinIO, Postgres)
  • Updates GitHub App flows to support public path prefix + forwarded host/proto
  • Adds UI proxy routes for GitHub setup/exchange/callback/webhook
  • Fixes sidecar healthcheck path (/healthz)
  • Adds login-time WorkOS org/user sync to reduce post-login org-missing errors

@sidpalas sidpalas requested a review from motatoes February 9, 2026 21:27

// Canonical GitHub App webhook endpoint.
r.POST("/github/webhook", diggerController.GithubAppWebHook)
// Legacy webhook path kept for backward compatibility.
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could leave this as is, but I figured we might want to standardize on /github/.

// - "" or "/" -> ""
// - "orchestrator" -> "/orchestrator"
// - "/orchestrator/" -> "/orchestrator"
func NormalizePublicPathPrefix(raw string) string {
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This isn't strictly necessary, but helps fix common issues people may encounter with leading and trailing slashes.


await saveSession({ accessToken, refreshToken, user, impersonator });

// Ensure the signed-in WorkOS organization exists in dependent services.
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could also leave this out for now and add in a separate PR cleaning up the callback/webhook logic

}
| Response

export async function requireUiAuth(request: Request): Promise<AuthResult> {
Copy link
Collaborator Author

@sidpalas sidpalas Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we wanted to keep things simpler, we could just return a 401.

Or this could be moved to a separate PR to keep this one more focused.

@sidpalas sidpalas marked this pull request as ready for review February 13, 2026 15:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant