Replace the Python/kaya server in server/ with a Rust Cargo workspace of three crates mirroring the old layout: tavolo-platform (lobby API, live-game store, websocket endpoint, deadline scheduler, stats/Elo, OIDC sessions), tavolo-scopone (pure scopone scientifico rules plus the platform adapter) and tavolo-app (composition root and the `tavolo` binary with serve/migrate/backfill-elo). The HTTP and WebSocket contracts, error messages, Redis key layout and Postgres schema are unchanged, so the existing web/ frontend and in-flight games keep working. Notable differences: sessions are JSON under tavolo:session: (Python pickle sessions invalidate once), LOGGING_CONFIG is ignored in favour of RUST_LOG, DATABASE_URL must be Postgres, sqlx migrations replace aerich, and OpenTelemetry exports Rust process metrics instead of CPython gc metrics (no Postgres/Redis client instrumentation). Docker Compose and the Kubernetes manifest now run the single Rust image (embedded migrations, /static and /assets served by the app); the release CI keeps building server/Dockerfile. The full test suite (scopone rules, platform store/deadlines/stats/websockets, OIDC login flow, scopone e2e) is ported and runs with cargo test --workspace; Redis/Postgres integration tests are gated on TEST_REDIS_URL/TEST_DATABASE_URL.
This commit is contained in:
+47
-66
@@ -1,24 +1,28 @@
|
||||
# syntax=docker/dockerfile:1
|
||||
# Multi-stage build for the tavolo stack (kaya backend + Sycamore/WASM
|
||||
# frontend). The Docker build context is the REPOSITORY ROOT (see
|
||||
# docker-compose.yml) so this single image assembles both parts:
|
||||
# Multi-stage build for the tavolo stack (Rust/Axum backend +
|
||||
# Sycamore/WASM frontend). The Docker build context is the REPOSITORY ROOT
|
||||
# (see docker-compose.yml) so this single image assembles both parts:
|
||||
#
|
||||
# web-builder rust + trunk -> compiles web/ into web/dist
|
||||
# builder alpine python -> python venv with the backend + deps
|
||||
# runtime alpine python + the venv + the compiled frontend
|
||||
# web-builder rust + trunk -> compiles web/ into web/dist
|
||||
# rust-builder rust -> compiles server/ into the tavolo binary
|
||||
# runtime debian slim -> the binary + the compiled frontend
|
||||
#
|
||||
# apk and pip both use BuildKit cache mounts (type=cache): the package
|
||||
# caches persist in the builder's cache across builds instead of being
|
||||
# re-downloaded, and never land in the image layers.
|
||||
# The backend embeds its sqlx migrations, serves /static and /assets itself
|
||||
# and hosts the SPA shell, so the runtime image needs no Python, Granian or
|
||||
# migration files.
|
||||
#
|
||||
# Build and run it with (from the repository root):
|
||||
# docker compose up --build
|
||||
|
||||
# --- Web builder -------------------------------------------------------------
|
||||
FROM rust:1-slim AS web-builder
|
||||
FROM rust:1-slim-bookworm AS web-builder
|
||||
|
||||
ARG TRUNK_VERSION=0.21.14
|
||||
# The build environment blocks plain HTTP: force the apt mirrors to HTTPS.
|
||||
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
|
||||
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
||||
sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list.d/debian.sources \
|
||||
{ sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list 2>/dev/null || true; } \
|
||||
&& { sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || true; } \
|
||||
&& apt-get update \
|
||||
&& apt-get install -y --no-install-recommends curl ca-certificates \
|
||||
&& curl -fsSL "https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" \
|
||||
@@ -36,79 +40,56 @@ COPY web/assets ./assets
|
||||
COPY web/vendor ./vendor
|
||||
COPY web/src ./src
|
||||
|
||||
# --public-url makes trunk emit asset URLs under /static, the prefix Granian
|
||||
# serves in the runtime image (see GRANIAN_STATIC_PATH_* below). Dev builds
|
||||
# (trunk serve) keep the default "/" public URL.
|
||||
# --public-url makes trunk emit asset URLs under /static, the prefix the
|
||||
# server mounts in the runtime image. Dev builds (trunk serve) keep the
|
||||
# default "/" public URL.
|
||||
RUN --mount=type=cache,target=/usr/local/cargo/registry \
|
||||
--mount=type=cache,target=/web/target \
|
||||
trunk build --release --public-url /static/
|
||||
|
||||
# --- Python builder ----------------------------------------------------------
|
||||
FROM alpine:3.24 AS builder
|
||||
|
||||
RUN --mount=type=cache,target=/var/cache/apk \
|
||||
apk add python3 py3-pip build-base python3-dev
|
||||
# --- Rust builder ------------------------------------------------------------
|
||||
FROM rust:1-slim-bookworm AS rust-builder
|
||||
|
||||
WORKDIR /build
|
||||
|
||||
COPY server/Cargo.toml server/Cargo.lock ./
|
||||
COPY server/crates ./crates
|
||||
|
||||
COPY server/requirements.txt ./
|
||||
RUN --mount=type=cache,target=/root/.cache/pip \
|
||||
python3 -m venv /opt/venv \
|
||||
&& /opt/venv/bin/pip install --upgrade pip \
|
||||
&& /opt/venv/bin/pip install -r requirements.txt
|
||||
# The target directory lives in a cache mount (so repeated builds reuse it)
|
||||
# and the binary is copied out of the mount into the image layer.
|
||||
RUN --mount=type=cache,target=/usr/local/cargo/registry \
|
||||
--mount=type=cache,target=/build/target \
|
||||
cargo build --release --locked \
|
||||
&& cp target/release/tavolo /tavolo
|
||||
|
||||
# The three sibling distributions, installed from the local tree (PEP 420
|
||||
# namespace packages sharing the `tavolo` namespace). --no-deps: every
|
||||
# third-party dependency — including the tavolo-app `otel` extra — is
|
||||
# already pinned in requirements.txt.
|
||||
COPY server/packages/ ./packages/
|
||||
RUN --mount=type=cache,target=/root/.cache/pip \
|
||||
/opt/venv/bin/pip install --no-deps ./packages/tavolo-platform ./packages/tavolo-scopone ./packages/tavolo-app
|
||||
# server/pyproject.toml only carries the [tool.aerich] section (the
|
||||
# db-migrate compose service runs `aerich upgrade` with working_dir=/app,
|
||||
# next to ./migrations).
|
||||
COPY server/pyproject.toml ./
|
||||
# aerich migration files are a release artifact: the db-migrate compose
|
||||
# service runs `aerich upgrade` from this image before the app starts.
|
||||
COPY server/migrations/ ./migrations/
|
||||
# --- Runtime -----------------------------------------------------------------
|
||||
FROM debian:bookworm-slim
|
||||
|
||||
# --- Runtime ---------------------------------------------------------------
|
||||
FROM alpine:3.24
|
||||
# The slim base ships no CA store; seed it from the builder so the HTTPS apt
|
||||
# mirrors (and later, outbound TLS) can be verified.
|
||||
COPY --from=web-builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
||||
|
||||
RUN --mount=type=cache,target=/var/cache/apk \
|
||||
apk add python3 ca-certificates tzdata \
|
||||
&& addgroup -S app && adduser -S -G app app
|
||||
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
|
||||
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
||||
{ sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list 2>/dev/null || true; } \
|
||||
&& { sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || true; } \
|
||||
&& apt-get update \
|
||||
&& apt-get install -y --no-install-recommends ca-certificates curl tzdata \
|
||||
&& rm -rf /var/lib/apt/lists/* \
|
||||
&& addgroup --system app && adduser --system --ingroup app app
|
||||
|
||||
COPY --from=builder /opt/venv /opt/venv
|
||||
COPY --from=builder /build/migrations /app/migrations
|
||||
# aerich reads [tool.aerich] from pyproject.toml (its default config file);
|
||||
# the db-migrate compose service runs `aerich upgrade` with working_dir=/app.
|
||||
COPY --from=builder /build/pyproject.toml /app/pyproject.toml
|
||||
# The compiled single-page application. Granian serves the assets directly
|
||||
# in Rust — hashed js/wasm/css under /static/* and the card images under
|
||||
# /assets/* (see the GRANIAN_STATIC_PATH_* env vars below; click splits
|
||||
# multi-value env vars on whitespace for routes and ':' for paths). The
|
||||
# Python app only serves the SPA shell (index.html) at / and for
|
||||
# client-side routes (STATIC_DIR).
|
||||
COPY --from=rust-builder /tavolo /usr/local/bin/tavolo
|
||||
# The compiled single-page application: hashed js/wasm/css under /static and
|
||||
# the card images under /assets (mounted by the server from STATIC_DIR).
|
||||
COPY --from=web-builder /web/dist /app/web/dist
|
||||
|
||||
ENV PATH="/opt/venv/bin:$PATH" \
|
||||
PYTHONUNBUFFERED=1 \
|
||||
PYTHONDONTWRITEBYTECODE=1 \
|
||||
GRANIAN_HOST=0.0.0.0 \
|
||||
GRANIAN_PORT=8080 \
|
||||
GRANIAN_INTERFACE=rsgi \
|
||||
GRANIAN_STATIC_PATH_ROUTE="/static /assets" \
|
||||
GRANIAN_STATIC_PATH_MOUNT="/app/web/dist:/app/web/dist/assets" \
|
||||
GRANIAN_STATIC_PATH_DIR_TO_FILE=index.html \
|
||||
STATIC_DIR=/app/web/dist
|
||||
ENV STATIC_DIR=/app/web/dist
|
||||
|
||||
USER app
|
||||
|
||||
EXPOSE 8080
|
||||
|
||||
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s \
|
||||
CMD wget -q -O- http://127.0.0.1:8080/api/health || exit 1
|
||||
CMD curl -fsS http://127.0.0.1:8080/api/health || exit 1
|
||||
|
||||
CMD ["granian", "tavolo.app:app"]
|
||||
CMD ["tavolo", "serve"]
|
||||
|
||||
Reference in New Issue
Block a user