Skip to content

Commit f6f2e0e

Browse files
dargmueslidargmuesli
committed
feat(maevsi)!: upgrade to v7
Several changes to environment variables are made alongside the update.
1 parent 8ca5326 commit f6f2e0e

File tree

7 files changed

+68
-41
lines changed

7 files changed

+68
-41
lines changed

‎README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,10 +46,18 @@ This project is deployed in accordance to the [DargStack template](https://githu
4646

4747
The job scheduler's SMTP client configuration.
4848

49+
- ### `maevsi_api-notification-secret`
50+
51+
The notification endpoint's secret.
52+
4953
- ### `maevsi_aws-credentials`
5054

5155
The cloud computing provider's user credentials.
5256

57+
- ### `maevsi_openai-api-key`
58+
59+
The AI provider's API key.
60+
5361
- ### `maevsi_turnstile-key`
5462

5563
The captcha provider's application key.

‎src/development/secrets/maevsi/api-notification.secret‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
maevsi

‎src/development/secrets/maevsi/api-notification.secret.template‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<string>

‎src/development/stack.env.template‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
GTAG_ID=G-WMQ1JY99XH
1+
MAEVSI_AWS_REGION=eu-central-1
22
MAEVSI_FIREBASE_SERVICE_ACCOUNT_CREDENTIALS=
3-
MAEVSI_NUXT_PRIVATE_API_NOTIFICATION_SECRET=
4-
MAEVSI_NUXT_PRIVATE_OPENAI_API_KEY=
3+
MAEVSI_NUXT_PUBLIC_GTAG_ID=G-WMQ1JY99XH
4+
MAEVSI_NUXT_PUBLIC_MAEVSI_EMAIL_LIMIT24H=100
5+
MAEVSI_NUXT_PUBLIC_TURNSTILE_SITE_KEY=1x00000000000000000000AA
6+
MAEVSI_PGHOST=postgres
57
PNPM_STORE_DIR=
6-
S3_TUSD_BUCKET=maevsi-images
7-
S3_TUSD_ENDPOINT=http://minio:9000
8-
S3_TUSD_REGION=eu-central-1
9-
TURNSTILE_SECRET_KEY=1x0000000000000000000000000000000AA
10-
TURNSTILE_SITE_KEY=1x00000000000000000000AA
8+
TUSD_BUCKET=maevsi-images
9+
TUSD_ENDPOINT=http://minio:9000
1110
TUSD_MAX_SIZE=1048576
11+
TUSD_REGION=eu-central-1

‎src/development/stack.yml‎

Lines changed: 25 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,15 @@ secrets:
1616
jobber_msmtprc:
1717
# The job scheduler's SMTP client configuration.
1818
file: ./secrets/jobber/msmtprc.secret
19+
maevsi_api-notification-secret:
20+
# The notification endpoint's secret.
21+
file: ./secrets/maevsi/api-notification.secret
1922
maevsi_aws-credentials:
2023
# The cloud computing provider's user credentials.
2124
file: ./secrets/maevsi/aws-credentials.secret
25+
maevsi_openai-api-key:
26+
# The AI provider's API key.
27+
file: ../production/secrets/maevsi/openai-api-key.secret
2228
maevsi_turnstile-key:
2329
# The captcha provider's application key.
2430
file: ./secrets/maevsi/turnstile-key.secret
@@ -184,31 +190,34 @@ services:
184190
CONSOLA_LEVEL: 4 # debug #DARGSTACK-REMOVE
185191
FIREBASE_SERVICE_ACCOUNT_CREDENTIALS: ${MAEVSI_FIREBASE_SERVICE_ACCOUNT_CREDENTIALS}
186192
NUXT_PRIVATE_API_NOTIFICATION_SECRET: ${MAEVSI_NUXT_PRIVATE_API_NOTIFICATION_SECRET}
187-
NUXT_PRIVATE_OPENAI_API_KEY: ${MAEVSI_NUXT_PRIVATE_OPENAI_API_KEY}
188-
NUXT_PUBLIC_GTAG_ID: ${GTAG_ID}
193+
NUXT_PUBLIC_GTAG_ID: ${MAEVSI_NUXT_PUBLIC_GTAG_ID}
189194
NUXT_PUBLIC_I18N_BASE_URL: https://${STACK_DOMAIN}
190-
NUXT_PUBLIC_MAEVSI_EMAIL_LIMIT24H: 15
195+
NUXT_PUBLIC_MAEVSI_EMAIL_LIMIT24H: ${MAEVSI_NUXT_PUBLIC_MAEVSI_EMAIL_LIMIT24H}
191196
NUXT_PUBLIC_SITE_URL: https://${STACK_DOMAIN}
192-
NUXT_PUBLIC_TURNSTILE_SITE_KEY: ${TURNSTILE_SITE_KEY}
193-
NUXT_TURNSTILE_SECRET_KEY: ${TURNSTILE_SECRET_KEY} # TODO: move to file (https://github.com/nuxt-modules/turnstile/pull/298)
194-
POSTGRAPHILE_JWT_PUBLIC_KEY_FILE: /run/config/postgraphile_jwt-public-key
195-
POSTGRES_DB_FILE: /run/secrets/postgres_db
196-
POSTGRES_ROLE_MAEVSI_TUSD_PASSWORD_FILE: /run/secrets/postgres_role_maevsi-tusd_password
197-
POSTGRES_ROLE_MAEVSI_TUSD_USERNAME_FILE: /run/secrets/postgres_role_maevsi-tusd_username
197+
NUXT_PUBLIC_TURNSTILE_SITE_KEY: ${MAEVSI_NUXT_PUBLIC_TURNSTILE_SITE_KEY}
198+
PGHOST: ${MAEVSI_PGHOST}
198199
image: maevsi/maevsi:dev
199200
secrets:
201+
- source: maevsi_api-notification-secret
202+
target: /run/environment-variables/NUXT_PRIVATE_API_NOTIFICATION_SECRET
200203
- source: maevsi_aws-credentials
201204
target: /home/node/.aws/credentials # TODO: switch to user `node`
202-
- maevsi_turnstile-key
203-
- postgres_db
204-
- postgres_role_maevsi-tusd_password
205-
- postgres_role_maevsi-tusd_username
205+
- source: maevsi_openai-api-key
206+
target: /run/environment-variables/NUXT_PRIVATE_OPENAI_API_KEY
207+
- source: maevsi_turnstile-key
208+
target: /run/environment-variables/NUXT_TURNSTILE_SECRET_KEY
209+
- source: postgres_db
210+
target: /run/environment-variables/PGDATABASE
211+
- source: postgres_role_maevsi-tusd_password
212+
target: /run/environment-variables/PGPASSWORD
213+
- source: postgres_role_maevsi-tusd_username
214+
target: /run/environment-variables/PGUSER
206215
user: node:node # files created inside a docker container, like node_modules by pnpm, gain correct permissions by setting the user to `node`
207216
volumes:
208217
- ${PNPM_STORE_DIR}:/srv/.pnpm-store/ #DARGSTACK-REMOVE
209218
- ./certificates/:/srv/certificates/ #DARGSTACK-REMOVE
210219
- ../../../maevsi/:/srv/app/ #DARGSTACK-REMOVE
211-
- ./configurations/postgraphile/jwtRS256.key.pub:/run/config/postgraphile_jwt-public-key:ro
220+
- ./configurations/postgraphile/jwtRS256.key.pub:/run/environment-variables/NUXT_PUBLIC_VIO_AUTH_JWT_PUBLIC_KEY:ro
212221
minio: #DARGSTACK-REMOVE
213222
# You can access the s3 console at [minio.localhost](https://minio.localhost/).
214223
# You can access the s3 api service at [s3.localhost](https://s3.localhost/) if you want to access via cli from outside the stack.
@@ -436,7 +445,7 @@ services:
436445
- ./configurations/traefik/dynamic.yml:/dynamic.yml:ro #DARGSTACK-REMOVE
437446
tusd:
438447
# You can access the upload service at [tusd.localhost](https://tusd.localhost/).
439-
command: -behind-proxy --hooks-enabled-events pre-create,pre-finish,post-terminate --hooks-http http://maevsi:3000/api/tusd -max-size ${TUSD_MAX_SIZE} -s3-bucket ${S3_TUSD_BUCKET} -s3-endpoint ${S3_TUSD_ENDPOINT}
448+
command: -behind-proxy --hooks-enabled-events pre-create,pre-finish,post-terminate --hooks-http http://maevsi:3000/api/tusd -max-size ${TUSD_MAX_SIZE} -s3-bucket ${TUSD_BUCKET} -s3-endpoint ${TUSD_ENDPOINT}
440449
deploy:
441450
labels:
442451
- traefik.enable=true
@@ -448,7 +457,7 @@ services:
448457
- traefik.http.routers.tusd_secure.tls.options=mintls13@file #DARGSTACK-REMOVE
449458
- traefik.http.services.tusd.loadbalancer.server.port=8080
450459
environment:
451-
AWS_REGION: ${S3_TUSD_REGION}
460+
AWS_REGION: ${TUSD_REGION}
452461
image: tusproject/tusd:v2.6.0
453462
secrets:
454463
- source: tusd_aws

‎src/production/production.yml‎

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ services:
5151
- (( append ))
5252
- traefik.http.routers.maevsi.middlewares=maevsi_cors,maevsi_redirectregex
5353
- traefik.http.routers.maevsi_secure.tls.certresolver=default
54-
image: ghcr.io/maevsi/maevsi:6.6.0
54+
image: ghcr.io/maevsi/maevsi:7.0.0
5555
user: (( prune ))
5656
maevsi_beta:
5757
# You can access the main project frontend's beta version at [beta.localhost](https://beta.localhost/).
@@ -67,26 +67,33 @@ services:
6767
- traefik.http.services.maevsi_beta.loadbalancer.server.port=3000
6868
- traefik.http.routers.maevsi_beta_secure.tls.certresolver=default
6969
environment:
70+
AWS_REGION: ${MAEVSI_AWS_REGION}
7071
FIREBASE_SERVICE_ACCOUNT_CREDENTIALS: ${MAEVSI_FIREBASE_SERVICE_ACCOUNT_CREDENTIALS}
7172
NUXT_PRIVATE_API_NOTIFICATION_SECRET: ${MAEVSI_NUXT_PRIVATE_API_NOTIFICATION_SECRET}
72-
NUXT_PRIVATE_OPENAI_API_KEY: ${MAEVSI_NUXT_PRIVATE_OPENAI_API_KEY}
73-
NUXT_PUBLIC_GTAG_ID: ${GTAG_ID}
74-
NUXT_PUBLIC_SITE_URL: https://beta.${STACK_DOMAIN}
75-
NUXT_PUBLIC_TURNSTILE_SITE_KEY: ${TURNSTILE_SITE_KEY}
76-
NUXT_PUBLIC_VIO_ENVIRONMENT: beta
77-
NUXT_TURNSTILE_SECRET_KEY: ${TURNSTILE_SECRET_KEY}
78-
POSTGRAPHILE_JWT_PUBLIC_KEY_FILE: /run/config/postgraphile_jwt-public-key
79-
POSTGRES_DB_FILE: /run/secrets/postgres_db
80-
POSTGRES_ROLE_MAEVSI_TUSD_PASSWORD_FILE: /run/secrets/postgres_role_maevsi-tusd_password
81-
POSTGRES_ROLE_MAEVSI_TUSD_USERNAME_FILE: /run/secrets/postgres_role_maevsi-tusd_username
82-
image: ghcr.io/maevsi/maevsi:6.6.0
73+
NUXT_PUBLIC_GTAG_ID: ${MAEVSI_NUXT_PUBLIC_GTAG_ID}
74+
NUXT_PUBLIC_I18N_BASE_URL: https://${STACK_DOMAIN}
75+
NUXT_PUBLIC_MAEVSI_EMAIL_LIMIT24H: ${MAEVSI_NUXT_PUBLIC_MAEVSI_EMAIL_LIMIT24H}
76+
NUXT_PUBLIC_SITE_URL: https://${STACK_DOMAIN}
77+
NUXT_PUBLIC_TURNSTILE_SITE_KEY: ${MAEVSI_NUXT_PUBLIC_TURNSTILE_SITE_KEY}
78+
PGHOST: ${MAEVSI_PGHOST}
79+
image: ghcr.io/maevsi/maevsi:7.0.0
8380
secrets:
84-
- maevsi_turnstile-key
85-
- postgres_db
86-
- postgres_role_maevsi-tusd_password
87-
- postgres_role_maevsi-tusd_username
81+
- source: maevsi_api-notification-secret
82+
target: /run/environment-variables/NUXT_PRIVATE_API_NOTIFICATION_SECRET
83+
- source: maevsi_aws-credentials
84+
target: /home/node/.aws/credentials # TODO: switch to user `node`
85+
- source: maevsi_openai-api-key
86+
target: /run/environment-variables/NUXT_PRIVATE_OPENAI_API_KEY
87+
- source: maevsi_turnstile-key
88+
target: /run/environment-variables/NUXT_TURNSTILE_SECRET_KEY
89+
- source: postgres_db
90+
target: /run/environment-variables/PGDATABASE
91+
- source: postgres_role_maevsi-tusd_password
92+
target: /run/environment-variables/PGPASSWORD
93+
- source: postgres_role_maevsi-tusd_username
94+
target: /run/environment-variables/PGUSER
8895
volumes:
89-
- ./configurations/postgraphile/jwtRS256.key.pub:/run/config/postgraphile_jwt-public-key:ro
96+
- ./configurations/postgraphile/jwtRS256.key.pub:/run/environment-variables/NUXT_PUBLIC_VIO_AUTH_JWT_PUBLIC_KEY:ro
9097
# minio: (( prune )) # breaks renovate
9198
portainer:
9299
deploy:

‎src/production/secrets/maevsi/openai-api-key.secret.template‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
sk-proj-<...>

0 commit comments

Comments
 (0)