chore: deploy scripts + env

2026-09-17 17:28:06 +02:00
parent 28d2a7ad24
commit 979be91417
8 changed files with 344 additions and 23 deletions
@@ -0,0 +1,66 @@
+# Supervisor config template for polylan-submitter.
+#
+# This is a template, not a ready-to-use file: __NUM_WEB_WORKERS__ is filled
+# in by deploy.sh (the same number it also uses to re-add HAProxy backend
+# servers after each reload - see deploy/haproxy/haproxy.cfg), which then
+# installs the rendered result into /etc/supervisor/conf.d/ and
+# reread/updates supervisor. Run deploy.sh rather than copying this file by
+# hand.
+#
+# Assumes the app is checked out at /opt/polylan-submitter with a venv at
+# /opt/polylan-submitter/.venv, and a "polylan" system user owning it
+# (adduser --system --group polylan). Adjust to taste.
+#
+# App secrets/config (DJANGO_SECRET_KEY, POSTGRES_*, AWS_*, etc. - see
+# settings.py for the full list, polylan-submitter.env.dist for the file
+# template) are NOT listed in the `environment=` lines below - only
+# SETTINGS_ENV_FILE_LOCATION is, pointing settings.py at the file so it can
+# load_dotenv() it itself. That's the only var that needs to reach the
+# process from here at all: it's just a path, not a secret, so unlike the
+# ~19 real secrets it's safe to write directly into this tracked file, and
+# there's no %(ENV_x)s crash risk since it's a literal string, not a
+# pass-through. Rotating a secret just means editing the env file and
+# running `supervisorctl restart polylan-submitter:` (which deploy.sh
+# already does on every deploy) - dotenv is read fresh on every process
+# start, no systemd/supervisord-wide restart involved.
+
+[group:polylan-submitter]
+programs=polylan-submitter-web,polylan-submitter-worker
+
+; Daphne has no built-in multi-worker/--workers flag (single Twisted reactor
+; per process), so "more workers" means more daphne processes. Each one binds
+; its own unix socket under run/; HAProxy load-balances across all of them
+; (see deploy/haproxy/haproxy.cfg). They share state fine since channel
+; layers, sessions, cache, etc. all already go through Redis/Postgres rather
+; than in-process memory. __NUM_WEB_WORKERS__ comes from deploy.sh's
+; NUM_WEB_WORKERS - change it there, not here.
+[program:polylan-submitter-web]
+command=/opt/polylan-submitter/.venv/bin/daphne -u /opt/polylan-submitter/run/web-%(process_num)02d.sock polylan_submitter.asgi:application
+directory=/opt/polylan-submitter/polylan_submitter
+process_name=%(program_name)s-%(process_num)02d
+user=polylan
+numprocs=__NUM_WEB_WORKERS__
+autostart=true
+autorestart=true
+stopasgroup=true
+killasgroup=true
+stopsignal=TERM
+stdout_logfile=/var/log/supervisor/polylan-submitter-web-%(process_num)02d.log
+stderr_logfile=/var/log/supervisor/polylan-submitter-web-%(process_num)02d.log
+environment=DJANGO_SETTINGS_MODULE="polylan_submitter.settings",SETTINGS_ENV_FILE_LOCATION="/opt/polylan-submitter/deploy/supervisor/polylan-submitter.env"
+
+; RQ workers can have multiple `--with-scheduler`, there is a redis-lock
+[program:polylan-submitter-worker]
+command=/opt/polylan-submitter/.venv/bin/python manage.py rqworker default --job-class django_tasks_rq.Job --with-scheduler
+directory=/opt/polylan-submitter/polylan_submitter
+process_name=%(program_name)s-%(process_num)02d
+user=polylan
+numprocs=2
+autostart=true
+autorestart=true
+stopasgroup=true
+killasgroup=true
+stopsignal=TERM
+stdout_logfile=/var/log/supervisor/polylan-submitter-worker-%(process_num)02d.log
+stderr_logfile=/var/log/supervisor/polylan-submitter-worker-%(process_num)02d.log
+environment=DJANGO_SETTINGS_MODULE="polylan_submitter.settings",SETTINGS_ENV_FILE_LOCATION="/opt/polylan-submitter/deploy/supervisor/polylan-submitter.env"