From 261440c69400b511abf82025aa31d930e052a69a Mon Sep 17 00:00:00 2001 From: hexdev Date: Mon, 17 Aug 2026 12:18:05 +0700 Subject: [PATCH] first commit --- .dockerignore | 16 +++ .env.example | 28 ++++++ .gitignore | 184 +++++++++++++++++++++++++++++++++++ backend | 1 + compose.local.yml | 8 ++ compose.production.yml | 87 +++++++++++++++++ deploy/README.md | 79 +++++++++++++++ deploy/backend/Dockerfile | 20 ++++ deploy/caddy/Caddyfile | 70 +++++++++++++ deploy/caddy/Caddyfile.local | 57 +++++++++++ deploy/caddy/Dockerfile | 25 +++++ frontend | 1 + 12 files changed, 576 insertions(+) create mode 100644 .dockerignore create mode 100644 .env.example create mode 100644 .gitignore create mode 160000 backend create mode 100644 compose.local.yml create mode 100644 compose.production.yml create mode 100644 deploy/README.md create mode 100644 deploy/backend/Dockerfile create mode 100644 deploy/caddy/Caddyfile create mode 100644 deploy/caddy/Caddyfile.local create mode 100644 deploy/caddy/Dockerfile create mode 160000 frontend diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..b3796af --- /dev/null +++ b/.dockerignore @@ -0,0 +1,16 @@ +.git +.env +.env.* +!.env.example +**/.env +**/.env.* +**/__pycache__ +**/*.py[cod] +**/.pytest_cache +**/.ruff_cache +**/venv +**/.venv +**/node_modules +**/dist +keys +local diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..0049775 --- /dev/null +++ b/.env.example @@ -0,0 +1,28 @@ +# Public TLS certificate registration address. +ACME_EMAIL=admin@malenia.space + +# Pin the custom Caddy base image version used during build. +CADDY_VERSION=2.10.2 + +# PostgreSQL. Keep the database accessible only through the Docker private network. +POSTGRES_USER=malenia +POSTGRES_PASSWORD=replace-with-a-long-random-password +POSTGRES_DB=malenia +POSTGRES_HOST=postgres +POSTGRES_PORT=5432 + +# Backend key files. Set an absolute VPS path in production, for example /opt/malenia/keys. +KEYS_DIR=./keys +PRIVATE_KEY_FP=/run/secrets/keys/private.pem +PUBLIC_KEY_FP=/run/secrets/keys/public.pem + +# Application secrets and integrations. Do not commit the production .env file. +ACCESS_TOKEN_TTL=60 +PALLY_SHOP_ID= +PALLY_TOKEN= +REMNAWAVE_BASE_URL= +REMNAWAVE_SUB_URL= +REMNAWAVE_TOKEN= +REMNAWAVE_DEFAULT_SQUADS_UUIDS= +MINIMAL_DEPOSIT=0 +REFERAL_BONUS=30 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..6170880 --- /dev/null +++ b/.gitignore @@ -0,0 +1,184 @@ +# ---> Python +# Byte-compiled / optimized / DLL files +__pycache__/ +*.py[cod] +*$py.class + +# C extensions +*.so + +# Distribution / packaging +.Python +build/ +develop-eggs/ +dist/ +downloads/ +eggs/ +.eggs/ +lib/ +lib64/ +parts/ +sdist/ +var/ +wheels/ +share/python-wheels/ +*.egg-info/ +.installed.cfg +*.egg +MANIFEST + +# PyInstaller +# Usually these files are written by a python script from a template +# before PyInstaller builds the exe, so as to inject date/other infos into it. +*.manifest +*.spec + +# Installer logs +pip-log.txt +pip-delete-this-directory.txt + +# Unit test / coverage reports +htmlcov/ +.tox/ +.nox/ +.coverage +.coverage.* +.cache +nosetests.xml +coverage.xml +*.cover +*.py,cover +.hypothesis/ +.pytest_cache/ +cover/ + +# Translations +*.mo +*.pot + +# Django stuff: +*.log +local_settings.py +db.sqlite3 +db.sqlite3-journal + +# Flask stuff: +instance/ +.webassets-cache + +# Scrapy stuff: +.scrapy + +# Sphinx documentation +docs/_build/ + +# PyBuilder +.pybuilder/ +target/ + +# Jupyter Notebook +.ipynb_checkpoints + +# IPython +profile_default/ +ipython_config.py + +# pyenv +# For a library or package, you might want to ignore these files since the code is +# intended to run in multiple environments; otherwise, check them in: +# .python-version + +# pipenv +# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control. +# However, in case of collaboration, if having platform-specific dependencies or dependencies +# having no cross-platform support, pipenv may install dependencies that don't work, or not +# install all needed dependencies. +#Pipfile.lock + +# UV +# Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control. +# This is especially recommended for binary packages to ensure reproducibility, and is more +# commonly ignored for libraries. +#uv.lock + +# poetry +# Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control. +# This is especially recommended for binary packages to ensure reproducibility, and is more +# commonly ignored for libraries. +# https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control +#poetry.lock + +# pdm +# Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control. +#pdm.lock +# pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it +# in version control. +# https://pdm.fming.dev/latest/usage/project/#working-with-version-control +.pdm.toml +.pdm-python +.pdm-build/ + +# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm +__pypackages__/ + +# Celery stuff +celerybeat-schedule +celerybeat.pid + +# SageMath parsed files +*.sage.py + +# Environments +.env +*.env +dev.env +.venv +env/ +venv/ +ENV/ +env.bak/ +venv.bak/ + +# Spyder project settings +.spyderproject +.spyproject + +# Rope project settings +.ropeproject + +# mkdocs documentation +/site + +# mypy +.mypy_cache/ +.dmypy.json +dmypy.json + +# Pyre type checker +.pyre/ + +# pytype static type analyzer +.pytype/ + +# Cython debug symbols +cython_debug/ + +# PyCharm +# JetBrains specific template is maintained in a separate JetBrains.gitignore that can +# be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore +# and can be added to the global gitignore or merged into this file. For a more nuclear +# option (not recommended) you can uncomment the following to ignore the entire idea folder. +#.idea/ + +# Ruff stuff: +.ruff_cache/ + +# PyPI configuration file +.pypirc + +plans +dev.sh +test_dummy.py +*.pem +tests/ +local diff --git a/backend b/backend new file mode 160000 index 0000000..865c5cb --- /dev/null +++ b/backend @@ -0,0 +1 @@ +Subproject commit 865c5cb9b3ac167e2f223a57a73a3edf85936f3d diff --git a/compose.local.yml b/compose.local.yml new file mode 100644 index 0000000..09a18b3 --- /dev/null +++ b/compose.local.yml @@ -0,0 +1,8 @@ +services: + caddy: + build: + args: + CADDYFILE: deploy/caddy/Caddyfile.local + ports: !override + - "8080:80" + environment: !reset {} diff --git a/compose.production.yml b/compose.production.yml new file mode 100644 index 0000000..dcfe545 --- /dev/null +++ b/compose.production.yml @@ -0,0 +1,87 @@ +name: malenia + +services: + caddy: + build: + context: . + dockerfile: deploy/caddy/Dockerfile + args: + CADDY_VERSION: ${CADDY_VERSION:-2.10.2} + depends_on: + backend: + condition: service_healthy + environment: + ACME_EMAIL: ${ACME_EMAIL:?Set ACME_EMAIL in .env} + ports: + - "80:80" + - "443:443" + restart: unless-stopped + volumes: + - caddy_data:/data + - caddy_config:/config + networks: + - public + - private + + backend: + build: + context: . + dockerfile: deploy/backend/Dockerfile + depends_on: + postgres: + condition: service_healthy + env_file: ${ENV_FILE:-.env} + restart: unless-stopped + volumes: + - ${KEYS_DIR:-./keys}:/run/secrets/keys:ro + healthcheck: + test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health/', timeout=5)"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 20s + networks: + - private + + migrate: + build: + context: . + dockerfile: deploy/backend/Dockerfile + command: ["alembic", "upgrade", "head"] + depends_on: + postgres: + condition: service_healthy + env_file: ${ENV_FILE:-.env} + profiles: ["tools"] + volumes: + - ${KEYS_DIR:-./keys}:/run/secrets/keys:ro + networks: + - private + + postgres: + image: postgres:16.8-alpine + environment: + POSTGRES_USER: ${POSTGRES_USER} + POSTGRES_PASSWORD: ${POSTGRES_PASSWORD} + POSTGRES_DB: ${POSTGRES_DB} + TZ: UTC + restart: unless-stopped + volumes: + - postgres_data:/var/lib/postgresql/data + healthcheck: + test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"] + interval: 10s + timeout: 5s + retries: 5 + networks: + - private + +volumes: + caddy_data: + caddy_config: + postgres_data: + +networks: + public: + private: + internal: true diff --git a/deploy/README.md b/deploy/README.md new file mode 100644 index 0000000..0e04806 --- /dev/null +++ b/deploy/README.md @@ -0,0 +1,79 @@ +# Production deployment + +This stack exposes only Caddy on ports 80 and 443. PostgreSQL and the FastAPI backend +are isolated in the private Docker network. Caddy serves the Vite SPA and proxies public +`/api/*` requests to the backend after removing the `/api` prefix. + +## First deployment + +1. Point the `malenia.space` A record to the VPS public IPv4 address. +2. Install Docker Engine and the Docker Compose plugin on the VPS. Allow only TCP 22, 80, + and 443 through the host firewall. +3. Clone the repository to `/opt/malenia` and create `/opt/malenia/.env` from + `.env.example`. Set file mode `600` and replace all placeholder values. +4. Put `private.pem` and `public.pem` in `/opt/malenia/keys`, set `KEYS_DIR=/opt/malenia/keys` + in `.env`, then grant access only to the backend container user: + + ```bash + sudo chown -R 10001:10001 /opt/malenia/keys + sudo chmod 700 /opt/malenia/keys + sudo chmod 600 /opt/malenia/keys/*.pem + ``` +5. Build and start PostgreSQL, then apply migrations: + + ```bash + docker compose --env-file .env -f compose.production.yml up -d postgres + docker compose --env-file .env -f compose.production.yml --profile tools run --rm migrate + ``` + +6. Start the application: + + ```bash + docker compose --env-file .env -f compose.production.yml up -d --build + ``` + +7. Verify `https://malenia.space/api/health/` and the primary frontend flows. + +## Releases + +Before each release, run frontend checks locally. On the VPS, pull the intended revision, +apply migrations, then rebuild and recreate services: + +```bash +git pull --ff-only +docker compose --env-file .env -f compose.production.yml --profile tools run --rm migrate +docker compose --env-file .env -f compose.production.yml up -d --build +``` + +The Pally callback URL is `https://malenia.space/api/payments/pally/result`. + +## Local production-like test + +This test uses the same images, API proxying, and rate-limit plugin as production, but +serves HTTP on `http://localhost:8080`. It does not need a domain, TLS certificate, or VPS. + +1. Create a local `.env` from `.env.example` and fill the required backend integration + settings. `POSTGRES_HOST=postgres`, `PRIVATE_KEY_FP=/run/secrets/keys/private.pem`, and + `PUBLIC_KEY_FP=/run/secrets/keys/public.pem` must remain unchanged. The local `keys/` + directory must contain both PEM files. +2. Start PostgreSQL and apply migrations: + + ```bash + docker compose --env-file .env -f compose.production.yml -f compose.local.yml up -d postgres + docker compose --env-file .env -f compose.production.yml -f compose.local.yml --profile tools run --rm migrate + ``` + +3. Build and run the stack: + + ```bash + docker compose --env-file .env -f compose.production.yml -f compose.local.yml up -d --build + ``` + +4. Check the frontend at `http://localhost:8080` and the backend through Caddy at + `http://localhost:8080/api/health/`. + +5. Stop the local stack while preserving its database volume: + + ```bash + docker compose --env-file .env -f compose.production.yml -f compose.local.yml down + ``` diff --git a/deploy/backend/Dockerfile b/deploy/backend/Dockerfile new file mode 100644 index 0000000..ec30eb9 --- /dev/null +++ b/deploy/backend/Dockerfile @@ -0,0 +1,20 @@ +FROM python:3.13-slim + +ENV PYTHONDONTWRITEBYTECODE=1 \ + PYTHONUNBUFFERED=1 \ + PIP_NO_CACHE_DIR=1 + +WORKDIR /app + +RUN addgroup --gid 10001 --system app && adduser --uid 10001 --system --ingroup app app + +COPY backend/requirements.txt ./ +RUN pip install --no-cache-dir -r requirements.txt + +COPY backend/ ./ + +USER app + +EXPOSE 8000 + +CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000", "--proxy-headers", "--forwarded-allow-ips", "*"] diff --git a/deploy/caddy/Caddyfile b/deploy/caddy/Caddyfile new file mode 100644 index 0000000..e88d19a --- /dev/null +++ b/deploy/caddy/Caddyfile @@ -0,0 +1,70 @@ +{ + admin off + email {$ACME_EMAIL} +} + +malenia.space { + encode zstd gzip + + log { + output stdout + format json + } + + header { + Strict-Transport-Security "max-age=31536000; includeSubDomains" + X-Content-Type-Options "nosniff" + X-Frame-Options "DENY" + Referrer-Policy "strict-origin-when-cross-origin" + Permissions-Policy "camera=(), geolocation=(), microphone=()" + } + + @api path /api/* + route @api { + rate_limit { + zone auth { + match { + path /api/auth/login /api/auth/signup /api/auth/refresh + } + key {remote_host} + events 10 + window 1m + ipv6_prefix 64 + } + zone checkout { + match { + path /api/orders/checkout + } + key {remote_host} + events 10 + window 10m + ipv6_prefix 64 + } + zone payment_callback { + match { + path /api/payments/pally/result + } + key {remote_host} + events 60 + window 1m + ipv6_prefix 64 + } + zone api { + match { + not path /api/health/ + } + key {remote_host} + events 120 + window 1m + ipv6_prefix 64 + } + } + + uri strip_prefix /api + reverse_proxy backend:8000 + } + + root * /srv + try_files {path} /index.html + file_server +} diff --git a/deploy/caddy/Caddyfile.local b/deploy/caddy/Caddyfile.local new file mode 100644 index 0000000..3504dc7 --- /dev/null +++ b/deploy/caddy/Caddyfile.local @@ -0,0 +1,57 @@ +{ + admin off +} + +:80 { + encode zstd gzip + + log { + output stdout + format json + } + + @api path /api/* + route @api { + rate_limit { + zone auth { + match { + path /api/auth/login /api/auth/signup /api/auth/refresh + } + key {remote_host} + events 10 + window 1m + } + zone checkout { + match { + path /api/orders/checkout + } + key {remote_host} + events 10 + window 10m + } + zone payment_callback { + match { + path /api/payments/pally/result + } + key {remote_host} + events 60 + window 1m + } + zone api { + match { + not path /api/health/ + } + key {remote_host} + events 120 + window 1m + } + } + + uri strip_prefix /api + reverse_proxy backend:8000 + } + + root * /srv + try_files {path} /index.html + file_server +} diff --git a/deploy/caddy/Dockerfile b/deploy/caddy/Dockerfile new file mode 100644 index 0000000..efb8dc7 --- /dev/null +++ b/deploy/caddy/Dockerfile @@ -0,0 +1,25 @@ +ARG CADDY_VERSION=2.10.2 +ARG CADDYFILE=deploy/caddy/Caddyfile + +FROM node:22-alpine AS frontend + +WORKDIR /app + +COPY frontend/package.json frontend/package-lock.json ./ +RUN npm ci + +COPY frontend/ ./ +RUN npm run build + +FROM caddy:${CADDY_VERSION}-builder AS builder + +RUN xcaddy build \ + --with github.com/mholt/caddy-ratelimit@5625512f24f6f59d6f64fb3aafe5eecff0b286db + +FROM caddy:${CADDY_VERSION}-alpine + +ARG CADDYFILE + +COPY --from=builder /usr/bin/caddy /usr/bin/caddy +COPY ${CADDYFILE} /etc/caddy/Caddyfile +COPY --from=frontend /app/dist/ /srv/ diff --git a/frontend b/frontend new file mode 160000 index 0000000..76f2643 --- /dev/null +++ b/frontend @@ -0,0 +1 @@ +Subproject commit 76f26430ba67be1fc122b513f21c66e15e7b7c53