chore: deploy scripts + env

2026-09-17 17:28:06 +02:00
parent 28d2a7ad24
commit 979be91417
8 changed files with 344 additions and 23 deletions
@@ -0,0 +1,66 @@
+# Supervisor config template for polylan-submitter.
+#
+# This is a template, not a ready-to-use file: __NUM_WEB_WORKERS__ is filled
+# in by deploy.sh (the same number it also uses to re-add HAProxy backend
+# servers after each reload - see deploy/haproxy/haproxy.cfg), which then
+# installs the rendered result into /etc/supervisor/conf.d/ and
+# reread/updates supervisor. Run deploy.sh rather than copying this file by
+# hand.
+#
+# Assumes the app is checked out at /opt/polylan-submitter with a venv at
+# /opt/polylan-submitter/.venv, and a "polylan" system user owning it
+# (adduser --system --group polylan). Adjust to taste.
+#
+# App secrets/config (DJANGO_SECRET_KEY, POSTGRES_*, AWS_*, etc. - see
+# settings.py for the full list, polylan-submitter.env.dist for the file
+# template) are NOT listed in the `environment=` lines below - only
+# SETTINGS_ENV_FILE_LOCATION is, pointing settings.py at the file so it can
+# load_dotenv() it itself. That's the only var that needs to reach the
+# process from here at all: it's just a path, not a secret, so unlike the
+# ~19 real secrets it's safe to write directly into this tracked file, and
+# there's no %(ENV_x)s crash risk since it's a literal string, not a
+# pass-through. Rotating a secret just means editing the env file and
+# running `supervisorctl restart polylan-submitter:` (which deploy.sh
+# already does on every deploy) - dotenv is read fresh on every process
+# start, no systemd/supervisord-wide restart involved.
+
+[group:polylan-submitter]
+programs=polylan-submitter-web,polylan-submitter-worker
+
+; Daphne has no built-in multi-worker/--workers flag (single Twisted reactor
+; per process), so "more workers" means more daphne processes. Each one binds
+; its own unix socket under run/; HAProxy load-balances across all of them
+; (see deploy/haproxy/haproxy.cfg). They share state fine since channel
+; layers, sessions, cache, etc. all already go through Redis/Postgres rather
+; than in-process memory. __NUM_WEB_WORKERS__ comes from deploy.sh's
+; NUM_WEB_WORKERS - change it there, not here.
+[program:polylan-submitter-web]
+command=/opt/polylan-submitter/.venv/bin/daphne -u /opt/polylan-submitter/run/web-%(process_num)02d.sock polylan_submitter.asgi:application
+directory=/opt/polylan-submitter/polylan_submitter
+process_name=%(program_name)s-%(process_num)02d
+user=polylan
+numprocs=__NUM_WEB_WORKERS__
+autostart=true
+autorestart=true
+stopasgroup=true
+killasgroup=true
+stopsignal=TERM
+stdout_logfile=/var/log/supervisor/polylan-submitter-web-%(process_num)02d.log
+stderr_logfile=/var/log/supervisor/polylan-submitter-web-%(process_num)02d.log
+environment=DJANGO_SETTINGS_MODULE="polylan_submitter.settings",SETTINGS_ENV_FILE_LOCATION="/opt/polylan-submitter/deploy/supervisor/polylan-submitter.env"
+
+; RQ workers can have multiple `--with-scheduler`, there is a redis-lock
+[program:polylan-submitter-worker]
+command=/opt/polylan-submitter/.venv/bin/python manage.py rqworker default --job-class django_tasks_rq.Job --with-scheduler
+directory=/opt/polylan-submitter/polylan_submitter
+process_name=%(program_name)s-%(process_num)02d
+user=polylan
+numprocs=2
+autostart=true
+autorestart=true
+stopasgroup=true
+killasgroup=true
+stopsignal=TERM
+stdout_logfile=/var/log/supervisor/polylan-submitter-worker-%(process_num)02d.log
+stderr_logfile=/var/log/supervisor/polylan-submitter-worker-%(process_num)02d.log
+environment=DJANGO_SETTINGS_MODULE="polylan_submitter.settings",SETTINGS_ENV_FILE_LOCATION="/opt/polylan-submitter/deploy/supervisor/polylan-submitter.env"
@@ -0,0 +1,58 @@
+# Template for deploy/supervisor/polylan-submitter.env inside the app
+# checkout (/opt/polylan-submitter/deploy/supervisor/polylan-submitter.env on
+# the target host) - that path is in .gitignore, same treatment as
+# settingsLocal.py, so `git pull` never touches or overwrites it once it's
+# there.
+#
+# Copy this file to that path, fill in real values, then:
+#   sudo chown polylan:polylan /opt/polylan-submitter/deploy/supervisor/polylan-submitter.env
+#   sudo chmod 600 /opt/polylan-submitter/deploy/supervisor/polylan-submitter.env
+# (owned by "polylan", not root: this gets read by settings.py itself, which
+# runs as the "polylan" user - see `user=` in polylan-submitter.conf. 600
+# still keeps every other user out.)
+#
+# settings.py loads this via python-dotenv (see SETTINGS_ENV_FILE_LOCATION
+# in polylan-submitter.conf's `environment=`, and the load_dotenv() call
+# near the top of settings.py), not a shell - there's no $VAR expansion or
+# shell-special-character risk here like a bash `source` would have. The one
+# thing dotenv DOES expand is ${VAR_NAME} (braced, referencing another var
+# already defined above it in this same file) - if a real secret value ever
+# happens to literally contain that exact pattern, quote it (single or
+# double quotes both suppress dotenv's own expansion and get stripped).
+# Plain values like the ones below need no quoting at all.
+#
+# load_dotenv() is called with override=False, so an already-exported env
+# var always wins over what's in this file - it only fills gaps. It's also
+# read fresh on every process start (not cached in some long-lived daemon),
+# so rotating a secret just means editing this file and running
+# `sudo supervisorctl restart polylan-submitter:` - which deploy.sh already
+# does on every routine deploy anyway.
+#
+# See settings.py for what each of these does and its dev-mode default.
+
+DJANGO_SECRET_KEY=
+DJANGO_DEBUG=false
+DJANGO_ALLOWED_HOSTS=submitter.polylan.ch
+
+POSTGRES_DB=
+POSTGRES_USER=
+POSTGRES_PASSWORD=
+POSTGRES_HOST=
+POSTGRES_PORT=
+
+REDIS_HOST=
+REDIS_PORT=
+PLACE_REDIS_URL=
+
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+AWS_S3_ENDPOINT_URL=
+AWS_STORAGE_BUCKET_NAME=
+
+SENTRY_ENVIRONMENT=production
+SENTRY_DSN=
+
+MARKET_ENABLED=true
+STEAM_API_KEY=
+AANDT_API_BASE_URL=
+SUBMITTER_BASE_URL=