woggioni
ed90a2a5a6
CI / Build and push docker image (push) Successful in 7m1s
Build the backend as a fully static musl binary (rust:1-alpine + x86_64-unknown-linux-musl) and run it in a scratch image with only the binary and the compiled frontend: 32 MB instead of ~110 MB, no shell, package manager or libc, running as the numeric user 10001:10001. The binary moves to /usr/local/bin/tavolo so `tavolo migrate` and `tavolo serve` resolve on PATH in compose and Kubernetes. TLS for OIDC and Postgres validates against Mozilla's roots embedded in the binary by webpki-roots, so no certificate files are needed; the OTLP client is built without a TLS backend, so OTEL_EXPORTER_OTLP_ENDPOINT must be http:// (documented). The Docker HEALTHCHECK is removed since scratch has no curl: Kubernetes probes /api/health over HTTP and Compose gates on its dependency checks. `strip = "symbols"` trims the release binary. Validated with docker compose up --build: migrations, sessions, lobby creation, the OIDC discovery redirect and the SPA all work, proving musl DNS resolution for the postgres/redis/mockoauth service names.
102 lines
4.5 KiB
Bash
102 lines
4.5 KiB
Bash
# Database (match statistics). The app assembles the DSN from these
|
|
# parts; DATABASE_PORT may be left unset to use the driver default
|
|
# (5432 for Postgres). DATABASE_OPTIONS is a raw query string appended
|
|
# to the URL (e.g. ssl=require); leave empty for none.
|
|
DATABASE_ENGINE=postgres
|
|
DATABASE_HOST=localhost
|
|
DATABASE_PORT=5432
|
|
DATABASE_NAME=tavolo
|
|
DATABASE_USER=tavolo
|
|
DATABASE_PASSWORD=password
|
|
DATABASE_OPTIONS=
|
|
# Full-DSN override: when set, the parts above are ignored (managed-DB
|
|
# URLs). The Rust server supports Postgres only.
|
|
#DATABASE_URL=postgres://tavolo:password@localhost:5432/tavolo
|
|
|
|
# OIDC providers. Each provider is an indexed block: OIDC_<n>_PROVIDER
|
|
# (required; names the provider in the login URL /auth/<provider>/login and
|
|
# in its session state), OIDC_<n>_ISSUER, OIDC_<n>_CLIENT_ID,
|
|
# OIDC_<n>_CLIENT_SECRET (optional: leave unset for public clients),
|
|
# OIDC_<n>_REDIRECT_URI (defaults to
|
|
# http://localhost:8080/auth/<provider>/callback), OIDC_<n>_POST_LOGIN_REDIRECT
|
|
# and OIDC_<n>_POST_LOGOUT_REDIRECT (default /). Indices must be contiguous
|
|
# from 0; add a second provider with an OIDC_1_* block (and so on).
|
|
#
|
|
# The values below target the dev mock-oauth2-server (it does not validate
|
|
# clients, so any client id/secret works). For a real IdP like Keycloak,
|
|
# use its values and register the redirect URI there.
|
|
OIDC_0_PROVIDER=default
|
|
OIDC_0_ISSUER=http://localhost:8180/tavolo
|
|
OIDC_0_CLIENT_ID=tavolo
|
|
OIDC_0_CLIENT_SECRET=dev-secret
|
|
OIDC_0_REDIRECT_URI=http://localhost:8080/auth/default/callback
|
|
# A second provider, e.g. Google:
|
|
#OIDC_1_PROVIDER=google
|
|
#OIDC_1_ISSUER=https://accounts.google.com
|
|
#OIDC_1_CLIENT_ID=...
|
|
#OIDC_1_CLIENT_SECRET=...
|
|
#OIDC_1_REDIRECT_URI=http://localhost:8080/auth/google/callback
|
|
|
|
# Redis (session and live-game storage). Unset to fall back to in-memory
|
|
# stores (only sensible for local development with a single worker).
|
|
REDIS_URL=redis://localhost:6379/0
|
|
|
|
# How long a live game survives in Redis without activity.
|
|
GAME_TTL_SECONDS=86400
|
|
|
|
# Seconds the between-hands scoring summary waits for acknowledgements
|
|
# before dealing the next hand anyway.
|
|
HAND_ACK_TIMEOUT_SECONDS=30
|
|
|
|
# Seconds a player has to play before the server plays a random legal card
|
|
# for them (covers disconnects and idle players).
|
|
TURN_TIMEOUT_SECONDS=30
|
|
|
|
# Accepted for compatibility with the Python server but ignored: the Rust
|
|
# server configures logging through RUST_LOG (tracing env filter syntax).
|
|
#LOGGING_CONFIG=/path/to/logging.yaml
|
|
#RUST_LOG=tavolo=info,sqlx=warn,redis=warn
|
|
|
|
# CORS (via kaya-cors' CorsMixin; same semantics as Starlette's
|
|
# CORSMiddleware). Disabled unless CORS_ALLOW_ORIGINS or
|
|
# CORS_ALLOW_ORIGIN_REGEX is set — the app serves the SPA and the API from
|
|
# the same origin, so no CORS headers are needed by default.
|
|
# Comma-separated list of origins allowed to make cross-origin requests,
|
|
# or "*" for any origin:
|
|
#CORS_ALLOW_ORIGINS=https://example.com,https://app.example.com
|
|
# Optional regex (fullmatch) allowed origins are additionally checked
|
|
# against — handy for dynamic preview URLs:
|
|
#CORS_ALLOW_ORIGIN_REGEX=https://tavolo-[a-z0-9-]+\.vercel\.app
|
|
# Comma-separated allowed methods, or "*" for all (default GET):
|
|
#CORS_ALLOW_METHODS=GET,POST
|
|
# Comma-separated allowed request headers, or "*" to mirror back whatever
|
|
# the browser requests (default: only the CORS-safelisted headers):
|
|
#CORS_ALLOW_HEADERS=Authorization,Content-Type
|
|
# Allow cookies/credentials on cross-origin requests (1/true/yes/on):
|
|
#CORS_ALLOW_CREDENTIALS=false
|
|
# Comma-separated response headers exposed to the browser:
|
|
#CORS_EXPOSE_HEADERS=
|
|
# Seconds browsers may cache the preflight response (default 600):
|
|
#CORS_MAX_AGE=600
|
|
|
|
# OpenTelemetry (compiled in by default). Off unless OTEL_ENABLED is
|
|
# truthy; exports traces (HTTP/WebSocket) and process metrics, plus custom
|
|
# tavolo.active_users / tavolo.ongoing_games gauges and logs over OTLP/HTTP.
|
|
# The endpoint defaults to http://localhost:4318 when unset and must use
|
|
# http:// (the OTLP client is built without a TLS backend; terminate TLS in
|
|
# front of a remote collector).
|
|
#OTEL_ENABLED=true
|
|
#OTEL_SERVICE_NAME=tavolo
|
|
#OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4318
|
|
#OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer token,X-Tenant=one
|
|
# Paths excluded from tracing and metrics (default /api/health).
|
|
#OTEL_EXCLUDED_PATHS=/api/health
|
|
# Metric export interval (ms, default 60000) and session/game count poll
|
|
# interval (seconds, default 15).
|
|
#OTEL_METRIC_EXPORT_INTERVAL_MILLIS=60000
|
|
#OTEL_METRICS_POLL_INTERVAL_SECONDS=15
|
|
|
|
# App server
|
|
APP_HOST=0.0.0.0
|
|
APP_PORT=8080
|