0f34594ce0
All checks were successful
PR build (required check) / changes (pull_request) Successful in 12s
secrets-guard / encrypted (pull_request) Successful in 11s
PR build (required check) / build-frontend (pull_request) Has been skipped
PR build (required check) / validate-observability (pull_request) Has been skipped
PR build (required check) / build-backend (pull_request) Successful in 1m40s
PR build (required check) / gate (pull_request) Successful in 4s
Move climate history to ERA5 served from our own object storage, with a prod-only query service in front: - data/era5lake.py: lake layout (per-point whole-record 1940+ serving files, a tile/year/month hive table, an Iceberg-style manifest) plus grid math and the read client (local dir -> lake service -> bucket). - gen_era5_lake.py: tile-aligned extractor from the Earthmover Icechunk ERA5 archive (one 86-year pull covers all 144 points of a chunk tile; resumable from the manifest; --cities / --tiles / --land). - lake_app.py + THERMOGRAPH_ROLE=lake: the lake service. /history serves a point's parquet off a disk cache (11ms cold / 3ms warm in rehearsal); /query runs SELECT-only SQL on DuckDB over the hive table (79ms pruned aggregate, 88ms full scan of a 4.5M-row tile). httpfs is baked at image build. - climate.py: history chain is now era5-lake -> NASA POWER -> Open-Meteo; the lake slice starts at START_DATE so grading windows are unchanged, and an unconfigured lake costs nothing (beta/LAN unchanged). - stack: lake service (1..2 replicas behind the VIP, own cache volume) plus a second autoscaler instance (autoscale.sh gains TARGET_SERVICE); web/worker get THERMOGRAPH_LAKE_URL. - seed_era5.py: constants corrected against the live store (icechunkV2, single/temporal, valid_time, ECMWF short names, pcodec). Bucket creds (THERMOGRAPH_LAKE_S3_ACCESS_KEY/_SECRET_KEY) go in the prod vault; until they land the lake stays healthy and everything falls through to NASA exactly as before.
45 lines
1.7 KiB
Docker
45 lines
1.7 KiB
Docker
# Thermograph backend: FastAPI API + accounts/notifications + the SSR content
|
|
# JSON API frontend consumes. Split from the monorepo (repo-split Stage 7).
|
|
FROM python:3.12-slim
|
|
|
|
# curl is only for the container HEALTHCHECK below. Everything Python needs
|
|
# ships as manylinux wheels (asyncpg, psycopg[binary], polars, numpy,
|
|
# cryptography via pywebpush, PyNaCl), so no compiler/build toolchain is
|
|
# required.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install deps first so this layer caches across code-only changes.
|
|
COPY requirements.txt /tmp/requirements.txt
|
|
RUN pip install --no-cache-dir -r /tmp/requirements.txt
|
|
# Bake DuckDB's httpfs extension so the lake role's S3 reads need no runtime
|
|
# extension download (tasks may roll while egress is degraded).
|
|
RUN python -c "import duckdb; duckdb.connect().execute('INSTALL httpfs')"
|
|
|
|
COPY . /app/
|
|
RUN chmod +x /app/deploy/entrypoint.sh
|
|
|
|
# Non-root runtime user. Create the writable state dirs and own the whole tree
|
|
# so the parquet cache, logs, notifier.lock, homepage.json, vapid.json can be
|
|
# written. When the named volumes first mount over /app/data and /app/logs,
|
|
# Docker seeds them from this image content -- including this ownership --
|
|
# so they stay writable.
|
|
RUN useradd --system --create-home --uid 10001 thermograph \
|
|
&& mkdir -p /app/data /app/logs \
|
|
&& chown -R thermograph:thermograph /app
|
|
|
|
USER thermograph
|
|
WORKDIR /app
|
|
|
|
ENV PORT=8137 \
|
|
WORKERS=4 \
|
|
THERMOGRAPH_BASE=/ \
|
|
PYTHONUNBUFFERED=1
|
|
|
|
EXPOSE 8137
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
|
|
CMD curl -fsS http://127.0.0.1:${PORT}/healthz || exit 1
|
|
|
|
ENTRYPOINT ["/app/deploy/entrypoint.sh"]
|