9e19fb5219
* chore(deploy): trust proxy headers + document HTTPS env vars - uvicorn: add --proxy-headers --forwarded-allow-ips='*' so the app honors X-Forwarded-Proto/Host from a TLS-terminating reverse proxy (Caddy, Cloudflare Tunnel, nginx, LB). Without this the app saw every request as plain HTTP and built redirect/OAuth URLs from the raw Host, which is fragile behind a proxy. - .env.template: document DOMAIN (enables Secure cookie flag) and new SERVER_URL (deterministic base URL for OAuth callbacks and external links). Grouped under a dedicated HTTPS / REVERSE PROXY section. * chore(deploy): add proxy header flags to Dockerfile CMD and Kamal config Matches the docker-compose changes so non-compose deployments (docker run, Kubernetes, ECS, Kamal) also trust X-Forwarded-Proto/X-Forwarded-For. * fix(auth): align Google OAuth cookie Secure flag with password/email providers Google OAuth set the access_token cookie Secure flag based on the TESTING env var, while password and email providers use DOMAIN. This meant the DOMAIN env var (now documented in config/.env.template) did not actually control Secure for Google cookies. Align all three providers on DOMAIN so the documented behavior holds consistently.
27 lines
771 B
Docker
27 lines
771 B
Docker
FROM python:3.13-slim
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
|
|
|
|
ARG AGNES_VERSION=dev
|
|
ARG RELEASE_CHANNEL=dev
|
|
ARG AGNES_COMMIT_SHA=unknown
|
|
ARG AGNES_TAG=unknown
|
|
ENV AGNES_VERSION=${AGNES_VERSION}
|
|
ENV RELEASE_CHANNEL=${RELEASE_CHANNEL}
|
|
ENV AGNES_COMMIT_SHA=${AGNES_COMMIT_SHA}
|
|
ENV AGNES_TAG=${AGNES_TAG}
|
|
|
|
WORKDIR /app
|
|
|
|
COPY . .
|
|
|
|
# Build wheel artifact (served at /cli/download)
|
|
RUN uv build --wheel --out-dir /app/dist
|
|
|
|
# Install production dependencies from pyproject.toml
|
|
RUN uv pip install --system --no-cache .
|
|
|
|
EXPOSE 8000
|
|
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--proxy-headers", "--forwarded-allow-ips", "*"]
|