9e19fb5219
* chore(deploy): trust proxy headers + document HTTPS env vars - uvicorn: add --proxy-headers --forwarded-allow-ips='*' so the app honors X-Forwarded-Proto/Host from a TLS-terminating reverse proxy (Caddy, Cloudflare Tunnel, nginx, LB). Without this the app saw every request as plain HTTP and built redirect/OAuth URLs from the raw Host, which is fragile behind a proxy. - .env.template: document DOMAIN (enables Secure cookie flag) and new SERVER_URL (deterministic base URL for OAuth callbacks and external links). Grouped under a dedicated HTTPS / REVERSE PROXY section. * chore(deploy): add proxy header flags to Dockerfile CMD and Kamal config Matches the docker-compose changes so non-compose deployments (docker run, Kubernetes, ECS, Kamal) also trust X-Forwarded-Proto/X-Forwarded-For. * fix(auth): align Google OAuth cookie Secure flag with password/email providers Google OAuth set the access_token cookie Secure flag based on the TESTING env var, while password and email providers use DOMAIN. This meant the DOMAIN env var (now documented in config/.env.template) did not actually control Secure for Google cookies. Align all three providers on DOMAIN so the documented behavior holds consistently.
67 lines
1.2 KiB
YAML
67 lines
1.2 KiB
YAML
# Kamal production deployment config
|
|
# Usage: kamal deploy
|
|
|
|
service: data-analyst
|
|
|
|
image: ghcr.io/keboola/data-analyst
|
|
|
|
registry:
|
|
server: ghcr.io
|
|
username:
|
|
- KAMAL_REGISTRY_USERNAME
|
|
password:
|
|
- KAMAL_REGISTRY_PASSWORD
|
|
|
|
servers:
|
|
web:
|
|
hosts:
|
|
- YOUR_SERVER_IP
|
|
cmd: uvicorn app.main:app --host 0.0.0.0 --port 8000 --proxy-headers --forwarded-allow-ips='*'
|
|
options:
|
|
volume:
|
|
- /data:/data
|
|
|
|
accessories:
|
|
scheduler:
|
|
image: ghcr.io/keboola/data-analyst
|
|
host: YOUR_SERVER_IP
|
|
cmd: python -m services.scheduler
|
|
env:
|
|
clear:
|
|
API_URL: http://data-analyst-web:8000
|
|
secret:
|
|
- SCHEDULER_API_TOKEN
|
|
volumes:
|
|
- /data:/data
|
|
|
|
telegram-bot:
|
|
image: ghcr.io/keboola/data-analyst
|
|
host: YOUR_SERVER_IP
|
|
cmd: python -m services.telegram_bot
|
|
env:
|
|
secret:
|
|
- TELEGRAM_BOT_TOKEN
|
|
volumes:
|
|
- /data:/data
|
|
|
|
proxy:
|
|
ssl: true
|
|
host: data.your-domain.com
|
|
|
|
healthcheck:
|
|
path: /api/health
|
|
port: 8000
|
|
interval: 30
|
|
|
|
env:
|
|
clear:
|
|
DATA_DIR: /data
|
|
LOG_LEVEL: info
|
|
secret:
|
|
- JWT_SECRET_KEY
|
|
- KEBOOLA_STORAGE_TOKEN
|
|
- KEBOOLA_STACK_URL
|
|
- KEBOOLA_PROJECT_ID
|
|
- GOOGLE_CLIENT_ID
|
|
- GOOGLE_CLIENT_SECRET
|
|
- TELEGRAM_BOT_TOKEN
|