mirror of
https://github.com/Patiun/com.gregkilmer.www.git
synced 2026-11-07 19:58:24 +00:00
Claude
754c6482be
- Dockerfile with a check target (typecheck and tests) and one image per service on a pinned Node 22.20 Alpine base, each with only its own production dependencies and a health check. - deploy/compose.yaml: gk-content, gk-admin and gk-site on homelab_network with no host ports, read-only root filesystems, no capabilities, the vault's Site folder mounted into the content service, and backup.dump=sqlite on it. - deploy/deploy.sh builds and checks the commit, restarts the stack, and goes back to the last good tag if it doesn't come up healthy; rollback.sh swaps tags. .gitea/workflows/deploy.yml runs it on a host runner on Cosmos. - docs/deploy.md runbook (settings, runner, mirror, NPM hosts, Turnstile, Healthchecks, backups, cutover) and the stack's inventory note in vault-kit. - Site: trusts X-Forwarded-Host/Proto for gregkilmer.com hosts so form posts pass Astro's origin check behind the proxy; rate limits read CF-Connecting-IP; site URL set for absolute links. - Content service: the held-change webhook carries a Discord-ready message; .env.example lists the core settings. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012aSbo2D1qP8cMFQCykf7kx
71 lines
2.9 KiB
Bash
71 lines
2.9 KiB
Bash
# Content service settings. Copy to .env (never commit it) or set them in the
|
|
# container's environment. See docs/content-service.md, "Running it".
|
|
# On Cosmos this file is /home/greg/homelab/gregkilmer/content.env (docs/deploy.md).
|
|
|
|
# --- Core -----------------------------------------------------------------------
|
|
# role:token pairs, 24+ random characters each (openssl rand -hex 24).
|
|
# reader: the site; admin: the admin page; intake: the site's forms;
|
|
# agent: AI agents over MCP; editor: future editing tools.
|
|
CONTENT_TOKENS=
|
|
# Healthchecks ping after every full scan of the Site folder.
|
|
HEALTHCHECK_URL=
|
|
# Discord (or any) webhook, told whenever a change is held for review.
|
|
NOTIFY_WEBHOOK_URL=
|
|
# Email addresses an agent may add to a note without a hold.
|
|
ALLOWED_EMAILS=greg@gregkilmer.com,contact@gregkilmer.com,orders@gregkilmer.com
|
|
# SCAN_MINUTES=5
|
|
# SUBMISSION_MAX_MB=10
|
|
|
|
# --- Sync jobs (docs/content-service.md, "Sync jobs") ------------------------
|
|
# Public sources to run: archidekt (hourly), bgg (daily), covers (every 15 min).
|
|
SYNC_JOBS=archidekt,bgg,covers
|
|
# Optional per-job interval override, in minutes.
|
|
# SYNC_ARCHIDEKT_MINUTES=60
|
|
# SYNC_BGG_MINUTES=1440
|
|
# SYNC_COVERS_MINUTES=15
|
|
# Healthchecks ping URLs, one per job (start, success and fail are pinged).
|
|
SYNC_ARCHIDEKT_HEALTHCHECK_URL=
|
|
SYNC_BGG_HEALTHCHECK_URL=
|
|
SYNC_COVERS_HEALTHCHECK_URL=
|
|
# BoardGameGeek application token (sent as Authorization: Bearer), if BGG asks for one.
|
|
BGG_TOKEN=
|
|
# TMDB v3 API key or v4 read access token, for film and TV covers.
|
|
TMDB_API_KEY=
|
|
|
|
# --- Homelab syncs on Cosmos (docs/content-service.md, "Homelab sources") ----
|
|
# Each is enabled by its own URL and login; all are read only against the source.
|
|
# PersonalReader, manga and manhwa (hourly). Its own read-only Suwayomi account.
|
|
SUWAYOMI_URL=
|
|
SUWAYOMI_USER=
|
|
SUWAYOMI_PASS=
|
|
# ui_login (default with a user), basic, or none.
|
|
# SUWAYOMI_AUTH=ui_login
|
|
# PersonalReader, light novels and books (daily).
|
|
KAVITA_URL=
|
|
KAVITA_API_KEY=
|
|
# Filament in stock (hourly). UNVERIFIED API: check the path and mapping first.
|
|
BAMBUDDY_URL=
|
|
# BAMBUDDY_SPOOLS_PATH=/api/v1/inventory/spools
|
|
# BAMBUDDY_API_KEY=
|
|
# BAMBUDDY_AUTH_HEADER=
|
|
# BAMBUDDY_GROUP=Filament
|
|
# BAMBUDDY_MATERIALS=PLA,PETG
|
|
# BAMBUDDY_MIN_GRAMS=50
|
|
# Leather and paper in stock (hourly). Entries are name or name=Group.
|
|
HOMEBOX_URL=
|
|
HOMEBOX_USER=
|
|
HOMEBOX_PASS=
|
|
HOMEBOX_LABELS=leather,paper
|
|
# HOMEBOX_LOCATIONS=
|
|
SYNC_SUWAYOMI_HEALTHCHECK_URL=
|
|
SYNC_KAVITA_HEALTHCHECK_URL=
|
|
SYNC_BAMBUDDY_HEALTHCHECK_URL=
|
|
SYNC_HOMEBOX_HEALTHCHECK_URL=
|
|
|
|
# --- Form submissions (docs/content-service.md, "Form submissions") ----------
|
|
# Add an intake token for the site's forms to CONTENT_TOKENS, e.g.
|
|
# CONTENT_TOKENS=reader:…,admin:…,intake:<24+ random characters>
|
|
# The site uses the same value as CONTENT_INTAKE_TOKEN. It can only file submissions.
|
|
# Largest attachment a submission may carry, in MB. Files go to DATA_DIR/submissions.
|
|
SUBMISSION_MAX_MB=10
|