chore: deploy scripts + env

2026-09-17 17:28:06 +02:00
parent 28d2a7ad24
commit 979be91417
8 changed files with 344 additions and 23 deletions
@@ -0,0 +1,58 @@
+# Template for deploy/supervisor/polylan-submitter.env inside the app
+# checkout (/opt/polylan-submitter/deploy/supervisor/polylan-submitter.env on
+# the target host) - that path is in .gitignore, same treatment as
+# settingsLocal.py, so `git pull` never touches or overwrites it once it's
+# there.
+#
+# Copy this file to that path, fill in real values, then:
+#   sudo chown polylan:polylan /opt/polylan-submitter/deploy/supervisor/polylan-submitter.env
+#   sudo chmod 600 /opt/polylan-submitter/deploy/supervisor/polylan-submitter.env
+# (owned by "polylan", not root: this gets read by settings.py itself, which
+# runs as the "polylan" user - see `user=` in polylan-submitter.conf. 600
+# still keeps every other user out.)
+#
+# settings.py loads this via python-dotenv (see SETTINGS_ENV_FILE_LOCATION
+# in polylan-submitter.conf's `environment=`, and the load_dotenv() call
+# near the top of settings.py), not a shell - there's no $VAR expansion or
+# shell-special-character risk here like a bash `source` would have. The one
+# thing dotenv DOES expand is ${VAR_NAME} (braced, referencing another var
+# already defined above it in this same file) - if a real secret value ever
+# happens to literally contain that exact pattern, quote it (single or
+# double quotes both suppress dotenv's own expansion and get stripped).
+# Plain values like the ones below need no quoting at all.
+#
+# load_dotenv() is called with override=False, so an already-exported env
+# var always wins over what's in this file - it only fills gaps. It's also
+# read fresh on every process start (not cached in some long-lived daemon),
+# so rotating a secret just means editing this file and running
+# `sudo supervisorctl restart polylan-submitter:` - which deploy.sh already
+# does on every routine deploy anyway.
+#
+# See settings.py for what each of these does and its dev-mode default.
+
+DJANGO_SECRET_KEY=
+DJANGO_DEBUG=false
+DJANGO_ALLOWED_HOSTS=submitter.polylan.ch
+
+POSTGRES_DB=
+POSTGRES_USER=
+POSTGRES_PASSWORD=
+POSTGRES_HOST=
+POSTGRES_PORT=
+
+REDIS_HOST=
+REDIS_PORT=
+PLACE_REDIS_URL=
+
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+AWS_S3_ENDPOINT_URL=
+AWS_STORAGE_BUCKET_NAME=
+
+SENTRY_ENVIRONMENT=production
+SENTRY_DSN=
+
+MARKET_ENABLED=true
+STEAM_API_KEY=
+AANDT_API_BASE_URL=
+SUBMITTER_BASE_URL=