remove user-secrets approach & prepare a pilot deploy

2026-07-28 23:18:54 +03:30
parent 630c7907ec
commit 5885280b49
28 changed files with 639 additions and 142 deletions
@@ -0,0 +1,91 @@
+# Balinyaar — full stack for the balinyaar.ir deployment.
+#
+# Three containers, no published ports: everything is reached through the EXISTING Caddy on `caddy_net`,
+# which terminates TLS for balinyaar.ir (→ web) and api.balinyaar.ir (→ api). See DEPLOY.md for the
+# Caddyfile block to add, and deploy/Caddyfile for a copy of it.
+#
+# The database is NOT here — it is the remote SQL Server already configured in
+# server/src/API/Baya.Web.Api/appsettings.Development.json.
+#
+#   docker compose up -d --build
+#   docker compose logs -f api
+
+services:
+  api:
+    build:
+      context: ./server
+    image: balinyaar-api
+    container_name: balinyaar-api
+    restart: unless-stopped
+    depends_on:
+      - otp-relay
+    environment:
+      # Deliberate: the deployed API runs as Development so the demo + lifecycle seeders populate the
+      # shared database and the screens aren't empty. This also exposes the developer exception page and
+      # GET /api/v1/dev/last_otp/{phone} publicly — acceptable for a pre-launch demo, NOT for real users.
+      # Switch to Production (and supply non-placeholder crypto keys) before launch — see DEPLOY.md.
+      ASPNETCORE_ENVIRONMENT: Development
+
+      # The two values that genuinely differ between a laptop and this network. Everything else — crypto
+      # keys, connection strings, CORS origins, trusted proxy networks — lives in appsettings.Development.json.
+      Seams__Sms__Telegram__BaseUrl: http://balinyaar-otp-relay:5010
+      Seams__ObjectStorage__RootPath: /app/data/object-storage
+    volumes:
+      # Uploaded verification documents live on the local-disk object-storage seam; without this they are
+      # inside the container and vanish on the next `up --build`.
+      - api-object-storage:/app/data/object-storage
+      - api-logs:/app/logs
+    networks:
+      - caddy_net
+
+  web:
+    build:
+      context: ./client
+    image: balinyaar-web
+    container_name: balinyaar-web
+    restart: unless-stopped
+    # No environment here on purpose: every NEXT_PUBLIC_* value is compiled into the browser bundle at
+    # build time from client/.env.production. Setting one here would be silently ignored.
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+    networks:
+      - caddy_net
+
+  otp-relay:
+    build:
+      context: ./telegram-otp-bot
+    image: balinyaar-otp-relay
+    container_name: balinyaar-otp-relay
+    restart: unless-stopped
+    environment:
+      TELEGRAM_BOT_TOKEN: "8968527151:AAFiCuNGkXjOiLZfT6urU8tkW8SCsWDM0ic"
+      # Every id here receives EVERY login code, for every phone number. Keep it to people you trust.
+      TELEGRAM_CHAT_IDS: "1277103616,110209855"
+      # Must equal Seams:Sms:Telegram:ApiKey in the API's appsettings.Development.json.
+      API_KEY: "6a8dfaeea1aa375eb61da7663cadf23a3ea245fd939264dd"
+      # api.telegram.org is filtered in Iran — this hop goes out through the proxy container that already
+      # sits on caddy_net. A wrong value fails at boot with a clear message rather than per-OTP.
+      TELEGRAM_PROXY_URL: http://hysteria-client:8081
+      # The code still arrives on Telegram; keeping it out of `docker logs` means a host-log reader can't
+      # harvest login codes.
+      REDACT_CODE_IN_LOGS: "true"
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:5010/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    networks:
+      - caddy_net
+
+volumes:
+  api-object-storage:
+  api-logs:
+
+networks:
+  caddy_net:
+    external: true