Nicolas
7d1ee934ca
All checks were successful
Le job `sanity-build` (build de `apps/api/Dockerfile` sans push) devient
`build-and-push-images` : `docker login` sur le registre Forgejo intégré
via le token Actions du run (`permissions: packages: write`), puis build +
push des 3 images `batchcooking-{app,intent-service,llm-worker}` taguées
`vX.Y.Z` et `latest`. Un job séquentiel plutôt qu'une matrix — 3 builds
concurrents saturent le daemon Docker du runner unique (cf. mémoire
`ci-forgejo-runner-constraints`) sans gain réel pour une release.
`docker-compose.yml` référence maintenant ces images
(`image: git.dev.kyuno.fr/kyuno/batchcooking-*:${IMAGE_TAG:-latest}`) avec
le bloc `build:` gardé en repli local — Portainer peut tirer les images
pré-construites ou continuer à builder depuis Git. `.env.example` documente
`IMAGE_TAG` ; le README (section registre + Release) est réécrit.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
80 lines
4.2 KiB
Text
80 lines
4.2 KiB
Text
# Used by docker-compose.yml to provision the local Postgres container.
|
|
# Pick your own values — do not reuse these across environments, and never
|
|
# commit the real .env (it's git-ignored).
|
|
POSTGRES_USER=changeme
|
|
POSTGRES_PASSWORD=changeme
|
|
POSTGRES_DB=batchcooking
|
|
POSTGRES_PORT=5432
|
|
|
|
# Used by docker-compose.yml's "app" service (Docker-only — the native
|
|
# `pnpm dev:api` workflow reads apps/api/.env instead, set both when using
|
|
# both workflows). Required, no default on purpose — generate your own.
|
|
JWT_SECRET=changeme-generate-a-real-random-secret-at-least-32-chars
|
|
|
|
# Optional — host port for the Docker review stack's single app container
|
|
# (docker-compose.yml), serving both the API and the built frontend.
|
|
# APP_PORT=3000
|
|
|
|
# Optional — tag of the prebuilt images the release CI pushes to the Forgejo
|
|
# container registry (git.dev.kyuno.fr/kyuno/batchcooking-{app,intent-service,
|
|
# llm-worker}). Used by `docker compose pull` and a pull-based Portainer
|
|
# stack; leave it `latest` or pin a release tag (e.g. v0.2.4). Ignored when
|
|
# building locally instead (`docker compose build`, or `up` with no image
|
|
# present) — see docker-compose.yml's `image:`/`build:` comment.
|
|
# IMAGE_TAG=latest
|
|
|
|
# --- Admin surface (apps/web's /admin/* routes + the /admin/* API) --------
|
|
# All optional: an instance that doesn't run the admin app needs none of
|
|
# these. `requireAdmin` fails closed when ADMIN_JWT_SECRET is unset, so
|
|
# leaving it out simply disables every /admin/* route. The admin UI is
|
|
# served by the same app/container as the rest of the frontend — no
|
|
# separate origin, so no CORS entry of its own.
|
|
#
|
|
# Secret for the admin session JWT — MUST be different from JWT_SECRET so an
|
|
# end-user token can never be replayed against /admin/*. Generate your own
|
|
# the same way as JWT_SECRET above.
|
|
# ADMIN_JWT_SECRET=changeme-generate-a-real-random-secret-at-least-32-chars
|
|
# Optional — read only by `src/scripts/create-admin.ts` when its --email /
|
|
# --password / --name flags are omitted (e.g. to bootstrap the first admin
|
|
# from inside the container). Never read by the running server.
|
|
# ADMIN_INITIAL_EMAIL=ops@example.com
|
|
# ADMIN_INITIAL_PASSWORD=changeme-at-least-8-chars
|
|
# ADMIN_INITIAL_NAME=Ops
|
|
#
|
|
# Optional — lets an admin open a Forgejo ticket from a contact message
|
|
# (apps/web's /admin/messages, issue #81). All three needed together: the
|
|
# button stays hidden and the endpoint answers 503 unless all are set to a
|
|
# non-empty value. docker-compose.yml forwards these into the "app"
|
|
# container, so setting them here is enough (a blank value counts as
|
|
# unset). FORGEJO_TOKEN is a personal access token with the write:issue
|
|
# scope — generate it in Forgejo, never commit the real value.
|
|
# FORGEJO_BASE_URL=https://git.example.com
|
|
# FORGEJO_TOKEN=changeme-a-forgejo-personal-access-token
|
|
# FORGEJO_REPO=owner/repo
|
|
|
|
# Optional — only set this to false if THIS deployment is served over
|
|
# plain HTTP (no TLS in front of it). Left unset, the session cookie
|
|
# requires HTTPS (Secure attribute) as it should for a real deployment;
|
|
# over plain HTTP a Secure cookie is silently never sent back by the
|
|
# browser, so login "succeeds" but every subsequent request 401s.
|
|
# COOKIE_SECURE=false
|
|
|
|
# Required — secret shared between "app" and "tech-step-intent-service"
|
|
# (docker-compose.yml, apps/api/src/config/env.ts). Unlike
|
|
# INTERNAL_WORKER_SECRET below, there's no "leave it unset" escape hatch:
|
|
# tech-step-intent-service is a core dependency, not an optional background
|
|
# job — without it, no recipe step can have its techniques detected at all.
|
|
# Generate your own the same way as JWT_SECRET above.
|
|
INTENT_SERVICE_SECRET=changeme-generate-a-real-random-secret-at-least-32-chars
|
|
|
|
# Only needed to run the optional `tech-step-llm-worker` service — shared
|
|
# between it and "app" (docker-compose.yml). Generate your own the same
|
|
# way as JWT_SECRET above; leave both this and the service commented
|
|
# out/unset to run without it.
|
|
# INTERNAL_WORKER_SECRET=changeme-generate-a-real-random-secret-at-least-32-chars
|
|
|
|
# Optional — cron expression (node-cron syntax) the worker wakes up on to
|
|
# run its audit/feedback-loop jobs. Default: weekly, Sunday 03:00 — a
|
|
# provisional floor, not a calibrated value (see
|
|
# services/tech-step-llm-worker/README.md).
|
|
# TECH_STEP_WORKER_CRON=0 3 * * 0
|