-
Notifications
You must be signed in to change notification settings - Fork 325
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Support for Kamal deployment; plus credentials.yml.tt
- Loading branch information
Showing
8 changed files
with
225 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| # Secrets defined here are available for reference under registry/password, env/secret, builder/secrets, | ||
| # and accessories/*/env/secret in config/deploy.yml. All secrets should be pulled from either | ||
| # password manager, ENV, or a file. DO NOT ENTER RAW CREDENTIALS HERE! This file needs to be safe for git. | ||
|
|
||
| # Grab the registry password from ENV | ||
| KAMAL_REGISTRY_PASSWORD=$KAMAL_REGISTRY_PASSWORD | ||
|
|
||
| # Improve security by using a password manager. Never check config/master.key or config/credentials/*.key into git! | ||
| RAILS_MASTER_KEY=$(cat config/credentials/production.key) | ||
|
|
||
| # Either use .env or rails credentials to store database password. | ||
| # HOSTEDGPT_DATABASE_PASSWORD=$HOSTEDGPT_DATABASE_PASSWORD | ||
| credentials=$(bin/rails credentials:show --environment production) | ||
| HOSTEDGPT_DATABASE_PASSWORD=$(echo "$credentials" | yq '.database.password // "password"') | ||
|
|
||
| # Used by postgres:16 image to set password | ||
| POSTGRES_PASSWORD=$HOSTEDGPT_DATABASE_PASSWORD |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,24 +1,27 @@ | ||
| default: &default | ||
| adapter: postgresql | ||
| encoding: unicode | ||
| host: localhost | ||
| pool: <%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %> | ||
| port: <%= ENV['HOSTEDGPT_DATABASE_PORT'] || 5432 %> | ||
| <% if RUBY_PLATFORM =~ /darwin/ %> | ||
| <% if ENV["HOSTEDGPT_DATABASE_HOST"] %> | ||
| host: <%= ENV["HOSTEDGPT_DATABASE_HOST"] %> | ||
| <% end %> | ||
| <% if ENV["HOSTEDGPT_DATABASE_PORT"] %> | ||
| port: <%= ENV["HOSTEDGPT_DATABASE_PORT"] %> | ||
| <% end %> | ||
| <% if RUBY_PLATFORM =~ /darwin/ %> | ||
| gssencmode: disable | ||
| <% end %> | ||
| <% end %> | ||
|
|
||
| development: | ||
| <<: *default | ||
| database: <%= ENV['HOSTEDGPT_DEV_DB'] || "hostedgpt_development" %> | ||
| database: <%= ENV.fetch("HOSTEDGPT_DEV_DB", "hostedgpt_development") %> | ||
|
|
||
| test: | ||
| <<: *default | ||
| database: <%= ENV['HOSTEDGPT_TEST_DB'] || "hostedgpt_test" %> | ||
| database: <%= ENV.fetch("HOSTEDGPT_TEST_DB", "hostedgpt_test") %> | ||
|
|
||
| production: | ||
| <<: *default | ||
| database: hostedgpt_production | ||
| username: hostedgpt | ||
| database: <%= ENV.fetch("HOSTEDGPT_PRODUCTION_DB", "hostedgpt_production") %> | ||
| username: <%= ENV.fetch("HOSTEDGPT_DATABASE_USERNAME", "hostedgpt") %> | ||
| password: <%= ENV["HOSTEDGPT_DATABASE_PASSWORD"] %> | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,107 @@ | ||
| # Name of your application. Used to uniquely configure containers. | ||
| service: hostedgpt | ||
|
|
||
| # Name of the container image. | ||
| image: my-docker-user/hostedgpt | ||
|
|
||
| # Deploy to these servers. | ||
| servers: | ||
| web: | ||
| - 168.192.0.1 | ||
| # job: | ||
| # hosts: | ||
| # - 168.192.0.1 | ||
| # cmd: bin/rake solid_queue:start | ||
|
|
||
| # Enable SSL auto certification via Let's Encrypt (and allow for multiple apps on one server). | ||
| # Set ssl: false if using something like Cloudflare to terminate SSL (but keep host!). | ||
| proxy: | ||
| ssl: true | ||
| host: hostedgpt.example.com | ||
| app_port: 8080 | ||
|
|
||
| # Credentials for your image host. | ||
| registry: | ||
| # Specify the registry server, if you're not using Docker Hub | ||
| # server: registry.digitalocean.com / ghcr.io / ... | ||
| username: my-docker-user | ||
|
|
||
| # Always use an access token rather than real password when possible. | ||
| password: | ||
| - KAMAL_REGISTRY_PASSWORD | ||
|
|
||
| # Inject ENV variables into containers (secrets come from .kamal/secrets). | ||
| env: | ||
| secret: | ||
| - RAILS_MASTER_KEY | ||
| - HOSTEDGPT_DATABASE_PASSWORD | ||
| clear: | ||
| # Run the Solid Queue Supervisor inside the web server's Puma process to do jobs. | ||
| # When you start using multiple servers, you should split out job processing to a dedicated machine. | ||
| RUN_SOLID_QUEUE_IN_PUMA: true | ||
|
|
||
| # Set number of processes dedicated to Solid Queue (default: 1) | ||
| # JOB_CONCURRENCY: 3 | ||
|
|
||
| # Set number of cores available to the application on each server (default: 1). | ||
| # WEB_CONCURRENCY: 2 | ||
|
|
||
| HOSTEDGPT_FORCE_SSL: "false" | ||
|
|
||
| # Match this to any external database server to configure Active Record correctly | ||
| HOSTEDGPT_DATABASE_HOST: hostedgpt-db | ||
| HOSTEDGPT_DATABASE_USERNAME: postgres | ||
| HOSTEDGPT_PRODUCTION_DB: hostedgpt_production | ||
|
|
||
| # Log everything from Rails | ||
| RAILS_LOG_LEVEL: debug | ||
|
|
||
| # Aliases are triggered with "bin/kamal <alias>". You can overwrite arguments on invocation: | ||
| # "bin/kamal logs -r job" will tail logs from the first server in the job section. | ||
| aliases: | ||
| console: app exec --interactive --reuse "bin/rails console" | ||
| shell: app exec --interactive --reuse "bash" | ||
| logs: app logs -f | ||
| dbc: app exec --interactive --reuse "bin/rails dbconsole" | ||
|
|
||
| # Use a persistent storage volume for sqlite database files and local Active Storage files. | ||
| # Recommended to change this to a mounted volume path that is backed up off server. | ||
| volumes: | ||
| - "hostedgpt_storage:/rails/storage" | ||
|
|
||
| # Bridge fingerprinted assets, like JS and CSS, between versions to avoid | ||
| # hitting 404 on in-flight requests. Combines all files from new and old | ||
| # version inside the asset_path. | ||
| asset_path: /rails/public/assets | ||
|
|
||
| # Configure the image builder. | ||
| builder: | ||
| arch: amd64 | ||
|
|
||
| # # Build image via remote server (useful for faster amd64 builds on arm64 computers) | ||
| # remote: ssh://docker@docker-builder-server | ||
| # | ||
| # # Pass arguments and secrets to the Docker build process | ||
| # args: | ||
| # RUBY_VERSION: ruby-3.3.5 | ||
| # secrets: | ||
| # - GITHUB_TOKEN | ||
| # - RAILS_MASTER_KEY | ||
|
|
||
| # Use a different ssh user than root | ||
| # ssh: | ||
| # user: deploy | ||
|
|
||
| # Use accessory services (secrets come from .kamal/secrets). | ||
| accessories: | ||
| db: | ||
| image: postgres:16 | ||
| host: 168.192.0.1 | ||
| # port: 5432 | ||
| env: | ||
| clear: | ||
| POSTGRES_DB: hostedgpt_production | ||
| secret: | ||
| - POSTGRES_PASSWORD | ||
| directories: | ||
| - data:/var/lib/postgresql/data |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| # Used as the base secret for all MessageVerifiers in Rails, including the one protecting cookies. | ||
| secret_key_base: <%= secret_key_base %> | ||
|
|
||
| active_record_encryption: | ||
| primary_key: <%= SecureRandom.alphanumeric(32) %> | ||
| deterministic_key: <%= SecureRandom.alphanumeric(32) %> | ||
| key_derivation_salt: <%= SecureRandom.alphanumeric(32) %> | ||
|
|
||
| # database: | ||
| # password: <%= SecureRandom.alphanumeric(32) %> |