emi
2d3f37c474
All checks were successful
Sync infra to hosts / sync-beta (push) Successful in 8s
Sync infra to hosts / sync-prod (push) Successful in 7s
secrets-guard / encrypted (push) Successful in 8s
shell-lint / shellcheck (push) Successful in 10s
Build + push backend image (Forgejo registry) / build-push (push) Successful in 1m14s
Deploy backend to beta VPS / deploy (push) Successful in 2m4s
The gateway bot and APScheduler were long-lived stateful I/O loops running inside the async web app under a leader election. They move into a single Go binary that owns ONLY that I/O -- websocket, RESUME, heartbeat, backoff, timers. It owns no grading logic. Anything needing data calls back over a new internal-only surface (/internal/discord/grade, /internal/jobs/*). Grading depends on polars and the parquet cache; reimplementing it in Go would let the bot's grades drift from the API's. The grade route returns gateway-ready JSON and Go relays the bytes verbatim. The binary ships in the backend image and runs as a second compose service off the same tag, so the two ends of the /internal/* contract can never skew. deploy.sh rolls daemon alongside backend -- without that the service would never be created, since a single-service deploy uses --no-deps. It also probes the image first and skips the daemon when rolling a tag that predates the binary: infra tracks main while image tags are env-staged, so a host can legitimately be asked to roll an older backend image, and creating the service anyway would leave a container crash-looping on a missing binary. replicas: 1 with order: stop-first replaces the leader election -- Discord permits one gateway connection per bot token. THERMOGRAPH_INTERNAL_TOKEN is optional: both ends derive it from THERMOGRAPH_AUTH_SECRET via HMAC under a domain-separation label, so this needs no new vault entry. The derivation is pinned to a shared cross-language test vector asserted on both sides, so drift fails CI instead of 401ing every call. Fail closed when neither secret is set. Improvements over the Python: a close intended for RESUME uses 4000 rather than 1000 (Discord invalidates a session closed 1000, so the old default defeated its own resume); MESSAGE_CREATE runs on a bounded worker pool; and a malformed HELLO returns an error rather than a clean reconnect, which would otherwise reset backoff and hot-loop against the gateway. 365 Python tests pass; Go build/vet/test -race clean; shellcheck 0 findings.
68 lines
2.9 KiB
Docker
68 lines
2.9 KiB
Docker
# Thermograph backend: FastAPI API + accounts/notifications + the SSR content
|
|
# JSON API frontend consumes. Split from the monorepo (repo-split Stage 7).
|
|
|
|
# thermograph-daemon (daemon/): the Go process that owns the Discord gateway
|
|
# websocket and the recurring-job timers, calling back into this app's
|
|
# /internal/* routes for anything that needs data. It is built INTO this image
|
|
# on purpose: daemon and backend share the internal API contract, so shipping
|
|
# one image (compose picks the process per-service) makes version skew between
|
|
# them impossible. CGO_ENABLED=0 gives a fully static binary that drops into
|
|
# the python:3.12-slim final stage with no runtime deps; go.mod/go.sum are
|
|
# copied and downloaded before the sources so the Go dep layer caches across
|
|
# daemon code-only changes, same reasoning as the pip layer below.
|
|
FROM golang:1.26 AS daemon-builder
|
|
WORKDIR /src
|
|
COPY daemon/go.mod daemon/go.sum ./
|
|
RUN go mod download
|
|
COPY daemon/ ./
|
|
# -trimpath keeps the build reproducible (identical sources -> identical
|
|
# binary), which is what lets the final stage's COPY layer cache-hit when only
|
|
# Python code changed.
|
|
RUN CGO_ENABLED=0 go build -trimpath -o /out/thermograph-daemon .
|
|
|
|
FROM python:3.12-slim
|
|
|
|
# curl is only for the container HEALTHCHECK below. Everything Python needs
|
|
# ships as manylinux wheels (asyncpg, psycopg[binary], polars, numpy,
|
|
# cryptography via pywebpush, PyNaCl), so no compiler/build toolchain is
|
|
# required.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install deps first so this layer caches across code-only changes.
|
|
COPY requirements.txt /tmp/requirements.txt
|
|
RUN pip install --no-cache-dir -r /tmp/requirements.txt
|
|
|
|
# The daemon binary lands before the app tree: it changes far less often than
|
|
# the Python code, so this layer usually cache-hits and only the COPY below
|
|
# rebuilds. NOT the entrypoint — deploy/entrypoint.sh stays that; compose
|
|
# selects this binary per-service for the daemon container.
|
|
COPY --from=daemon-builder /out/thermograph-daemon /usr/local/bin/thermograph-daemon
|
|
|
|
COPY . /app/
|
|
RUN chmod +x /app/deploy/entrypoint.sh
|
|
|
|
# Non-root runtime user. Create the writable state dirs and own the whole tree
|
|
# so the parquet cache, logs, notifier.lock, homepage.json, vapid.json can be
|
|
# written. When the named volumes first mount over /app/data and /app/logs,
|
|
# Docker seeds them from this image content -- including this ownership --
|
|
# so they stay writable.
|
|
RUN useradd --system --create-home --uid 10001 thermograph \
|
|
&& mkdir -p /app/data /app/logs \
|
|
&& chown -R thermograph:thermograph /app
|
|
|
|
USER thermograph
|
|
WORKDIR /app
|
|
|
|
ENV PORT=8137 \
|
|
WORKERS=4 \
|
|
THERMOGRAPH_BASE=/ \
|
|
PYTHONUNBUFFERED=1
|
|
|
|
EXPOSE 8137
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
|
|
CMD curl -fsS http://127.0.0.1:${PORT}/healthz || exit 1
|
|
|
|
ENTRYPOINT ["/app/deploy/entrypoint.sh"]
|