Matvey/site
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial commit: site monorepo with API, web, and infra.

Browse Source 
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
влад
2026-07-16 10:11:54 +03:00
co-authored by Cursor
commit 016910ffb7
447 changed files with 73972 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/docker/.env.production.example
+13
View File
@@ -0,0 +1,13 @@
# Copy to infra/docker/.env.production and fill in production values.
FRONTEND_URL=https://compton.example.com
PUBLIC_BASE_URL=https://compton.example.com
CORS_ORIGINS=["https://compton.example.com"]
TRUSTED_PROXY_IPS=172.16.0.0/12,10.0.0.0/8
SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_USER=
SMTP_PASSWORD=
SMTP_FROM=noreply@compton.example.com
TLS_CERT_DIR=./certs
ADMIN_INITIAL_PASSWORD=ChangeMeProductionAdmin1234
SEED_DEMO_USERS=false
infra/docker/.env.staging.example
+12
View File
@@ -0,0 +1,12 @@
# Copy to infra/docker/.env.staging and fill in domain/SMTP values.
FRONTEND_URL=https://staging.example.com
PUBLIC_BASE_URL=https://staging.example.com
CORS_ORIGINS=["https://staging.example.com"]
TRUSTED_PROXY_IPS=172.16.0.0/12,10.0.0.0/8
SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_USER=
SMTP_PASSWORD=
SMTP_FROM=noreply@example.com
TLS_CERT_DIR=./certs
ADMIN_INITIAL_PASSWORD=ChangeMeStagingAdmin1234
infra/docker/README.md
+31
View File
@@ -0,0 +1,31 @@
# Docker deployment
Краткая справка. Подробный runbook: [docs/deploy.md](../../docs/deploy.md).
| Файл | Среда |
|------|-------|
| [`../../docker-compose.yml`](../../docker-compose.yml) | Локальная разработка |
| [`../../docker-compose.test.yml`](../../docker-compose.test.yml) | CI / E2E |
| [`docker-compose.staging.yml`](docker-compose.staging.yml) | Staging VPS |
| [`docker-compose.prod.yml`](docker-compose.prod.yml) | Production VPS |
## Staging
```bash
cp infra/docker/.env.staging.example infra/docker/.env.staging
# TLS: infra/docker/certs/fullchain.pem, privkey.pem
python3 apps/api/scripts/bootstrap_install.py
./infra/docker/deploy-staging.sh
```
## Production
```bash
cp infra/docker/.env.production.example infra/docker/.env.production
python3 apps/api/scripts/bootstrap_install.py
./infra/docker/deploy-prod.sh infra/docker/.env.production
```
## QA на staging
См. [docs/release.md](../../docs/release.md): E2E, k6, ZAP, Lighthouse.
infra/docker/deploy-prod.sh
Executable
+23
View File
@@ -0,0 +1,23 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
cd "$ROOT"
ENV_FILE="${1:-infra/docker/.env.production}"
if [[ ! -f "$ENV_FILE" ]]; then
echo "Missing $ENV_FILE — copy infra/docker/.env.production.example first."
exit 1
fi
if [[ ! -f apps/api/data/secrets/install.env ]]; then
python3 apps/api/scripts/bootstrap_install.py
fi
docker compose \
-f infra/docker/docker-compose.prod.yml \
--env-file "$ENV_FILE" \
up -d --build
echo "Production deploy complete."
infra/docker/deploy-staging.sh
Executable
+23
View File
@@ -0,0 +1,23 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
cd "$ROOT"
ENV_FILE="${1:-infra/docker/.env.staging}"
if [[ ! -f "$ENV_FILE" ]]; then
echo "Missing $ENV_FILE — copy infra/docker/.env.staging.example first."
exit 1
fi
if [[ ! -f apps/api/data/secrets/install.env ]]; then
python3 apps/api/scripts/bootstrap_install.py
fi
docker compose \
-f infra/docker/docker-compose.staging.yml \
--env-file "$ENV_FILE" \
up -d --build
echo "Staging deploy complete. Verify: curl -k https://\$(grep FRONTEND_URL $ENV_FILE | cut -d= -f2)/api/v1/health"
infra/docker/docker-compose.prod.yml
+135
View File
@@ -0,0 +1,135 @@
# Production stack — VPS deploy.
# Usage:
# python apps/api/scripts/bootstrap_install.py
# cp infra/docker/.env.production.example infra/docker/.env.production
# docker compose -f infra/docker/docker-compose.prod.yml --env-file infra/docker/.env.production up -d --build
services:
postgres:
image: postgres:16
restart: unless-stopped
env_file:
- ../../apps/api/data/secrets/install.env
volumes:
- prod_postgres_data:/var/lib/postgresql/data
networks:
- internal
redis:
image: redis:7-alpine
restart: unless-stopped
networks:
- internal
minio:
image: minio/minio
restart: unless-stopped
command: server /data --console-address ":9001"
env_file:
- ../../apps/api/data/secrets/install.env
volumes:
- prod_minio_data:/data
networks:
- internal
api:
build:
context: ../../apps/api
dockerfile: Dockerfile
restart: unless-stopped
environment:
APP_ENV: production
ENABLE_DOCS: "false"
ENABLE_TEST_ROUTES: "false"
COOKIE_SECURE: "true"
ENABLE_RATE_LIMIT: "true"
EMAIL_DELIVERY_MODE: smtp
STORAGE_MODE: s3
S3_ENDPOINT: http://minio:9000
REDIS_URL: redis://redis:6379/0
SEED_DEMO_USERS: "false"
env_file:
- ../../apps/api/data/secrets/install.env
- .env.production
volumes:
- ../../apps/api/data/secrets:/app/data/secrets
- prod_api_logs:/app/data/logs
depends_on:
- postgres
- redis
- minio
networks:
- internal
web:
build:
context: ../..
dockerfile: apps/web/Dockerfile
restart: unless-stopped
environment:
VITE_USE_API_PROXY: "true"
VITE_API_URL: http://api:8000
depends_on:
- api
networks:
- internal
nginx:
image: nginx:stable-alpine
restart: unless-stopped
ports:
- "80:80"
- "443:443"
volumes:
- ../nginx/default.tls.conf:/etc/nginx/conf.d/default.conf:ro
- ${TLS_CERT_DIR:-./certs}:/etc/nginx/certs:ro
depends_on:
- web
- api
networks:
- internal
worker:
build:
context: ../../apps/api
dockerfile: Dockerfile
restart: unless-stopped
command: ["python", "-m", "app.worker"]
environment:
APP_ENV: production
CELERY_BROKER_URL: redis://redis:6379/0
env_file:
- ../../apps/api/data/secrets/install.env
- .env.production
depends_on:
- postgres
- redis
networks:
- internal
celery-worker:
build:
context: ../../apps/api
dockerfile: Dockerfile
restart: unless-stopped
command: ["celery", "-A", "app.celery_app", "worker", "--loglevel=info"]
environment:
APP_ENV: production
CELERY_BROKER_URL: redis://redis:6379/0
env_file:
- ../../apps/api/data/secrets/install.env
- .env.production
depends_on:
- postgres
- redis
networks:
- internal
networks:
internal:
driver: bridge
volumes:
prod_postgres_data:
prod_minio_data:
prod_api_logs:
infra/docker/docker-compose.staging.yml
+83
View File
@@ -0,0 +1,83 @@
# Staging stack — VPS deploy (no bind mounts, production-like settings).
# Usage:
# cp infra/docker/.env.staging.example infra/docker/.env.staging
# docker compose -f infra/docker/docker-compose.staging.yml --env-file infra/docker/.env.staging up -d --build
services:
postgres:
image: postgres:16
restart: unless-stopped
env_file:
- ../../apps/api/data/secrets/install.env
volumes:
- staging_postgres_data:/var/lib/postgresql/data
redis:
image: redis:7-alpine
restart: unless-stopped
minio:
image: minio/minio
restart: unless-stopped
command: server /data --console-address ":9001"
env_file:
- ../../apps/api/data/secrets/install.env
volumes:
- staging_minio_data:/data
api:
build:
context: ../../apps/api
dockerfile: Dockerfile
restart: unless-stopped
environment:
APP_ENV: staging
ENABLE_DOCS: "false"
ENABLE_TEST_ROUTES: "false"
COOKIE_SECURE: "true"
ENABLE_RATE_LIMIT: "true"
EMAIL_DELIVERY_MODE: smtp
STORAGE_MODE: s3
S3_ENDPOINT: http://minio:9000
REDIS_URL: redis://redis:6379/0
SEED_DEMO_USERS: "false"
env_file:
- ../../apps/api/.env.example
- ../../apps/api/data/secrets/install.env
- .env.staging
volumes:
- ../../apps/api/data/secrets:/app/data/secrets
- staging_api_logs:/app/data/logs
depends_on:
- postgres
- redis
- minio
web:
build:
context: ../..
dockerfile: apps/web/Dockerfile
restart: unless-stopped
environment:
VITE_USE_API_PROXY: "true"
VITE_API_URL: http://api:8000
depends_on:
- api
nginx:
image: nginx:stable-alpine
restart: unless-stopped
ports:
- "80:80"
- "443:443"
volumes:
- ../nginx/default.tls.conf:/etc/nginx/conf.d/default.conf:ro
- ${TLS_CERT_DIR:-./certs}:/etc/nginx/certs:ro
depends_on:
- web
- api
volumes:
staging_postgres_data:
staging_minio_data:
staging_api_logs:
infra/k6/mvp-load-test.js
+58
View File
@@ -0,0 +1,58 @@
import http from "k6/http";
import { check, sleep } from "k6";
const BASE_URL = __ENV.BASE_URL || "http://localhost:8000";
const ADMIN_EMAIL = __ENV.ADMIN_EMAIL || "admin@compton.example";
const ADMIN_PASSWORD = __ENV.ADMIN_PASSWORD || "Admin1234";
export const options = {
stages: [
{ duration: "1m", target: 10 },
{ duration: "3m", target: 50 },
{ duration: "1m", target: 0 }
],
thresholds: {
http_req_duration: ["p(95)<300"],
http_req_failed: ["rate<0.01"]
}
};
export default function () {
const roll = Math.random();
if (roll < 0.35) {
const res = http.get(`${BASE_URL}/api/v1/content/pages`);
check(res, { "content list 200": (r) => r.status === 200 });
} else if (roll < 0.6) {
const res = http.post(
`${BASE_URL}/api/v1/auth/login`,
JSON.stringify({ email: ADMIN_EMAIL, password: ADMIN_PASSWORD }),
{ headers: { "Content-Type": "application/json" } }
);
check(res, { "login 200": (r) => r.status === 200 });
if (res.status === 200) {
const token = res.json("access_token");
const me = http.get(`${BASE_URL}/api/v1/users/me`, {
headers: { Authorization: `Bearer ${token}` }
});
check(me, { "users me 200": (r) => r.status === 200 });
}
} else if (roll < 0.7) {
const login = http.post(
`${BASE_URL}/api/v1/auth/login`,
JSON.stringify({ email: ADMIN_EMAIL, password: ADMIN_PASSWORD }),
{ headers: { "Content-Type": "application/json" } }
);
if (login.status === 200) {
const refresh = http.post(`${BASE_URL}/api/v1/auth/refresh`, null, {
headers: { Cookie: login.headers["Set-Cookie"] || "" }
});
check(refresh, { "refresh ok": (r) => r.status === 200 || r.status === 401 });
}
} else {
const res = http.get(`${BASE_URL}/api/v1/content/pages/about`);
check(res, { "content slug": (r) => r.status === 200 || r.status === 404 });
}
sleep(1);
}
infra/nginx/default.conf
+18
View File
@@ -0,0 +1,18 @@
server {
listen 80;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always;
location /api/ {
proxy_pass http://api:8000;
}
location / {
proxy_pass http://web:5173;
}
}
infra/nginx/default.tls.conf
+49
View File
@@ -0,0 +1,49 @@
server {
listen 80;
server_name _;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
server_name _;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always;
location /api/ {
proxy_pass http://api:8000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /static/ {
alias /usr/share/nginx/html/static/;
try_files $uri =404;
}
location ~ ^/(recipes|recipes_content|components|feed_dispensers|feed_consumption|consumption|reports|lab|lab-profiles|admin)(/|$) {
root /usr/share/nginx/html/static;
try_files $uri $uri/ $uri.html /recipes.html =404;
}
location / {
proxy_pass http://web:5173;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
infra/scripts/backup-postgres.sh
Executable
+14
View File
@@ -0,0 +1,14 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
BACKUP_DIR="$ROOT/backups"
mkdir -p "$BACKUP_DIR"
STAMP="$(date +%F-%H%M)"
FILE="$BACKUP_DIR/postgres-$STAMP.sql.gz"
docker compose -f "$ROOT/infra/docker/docker-compose.prod.yml" exec -T postgres \
pg_dump -U "${POSTGRES_USER:-compton_app}" "${POSTGRES_DB:-compton}" | gzip > "$FILE"
echo "Backup written: $FILE"
infra/scripts/health-check.sh
Executable
+18
View File
@@ -0,0 +1,18 @@
#!/usr/bin/env bash
set -euo pipefail
BASE="${1:-http://localhost:8000}"
BASE="${BASE%/}"
fail() {
echo "FAIL: $1"
exit 1
}
code="$(curl -fsS -o /dev/null -w "%{http_code}" "$BASE/api/v1/health" || echo 000)"
[[ "$code" == "200" ]] || fail "health returned $code"
root_code="$(curl -fsS -o /dev/null -w "%{http_code}" "${BASE%/api/v1/health}/" 2>/dev/null || curl -fsS -o /dev/null -w "%{http_code}" "$(echo "$BASE" | sed 's|:8000||')/" || echo 000)"
echo "Landing/root HTTP: $root_code"
echo "OK: health check passed"
infra/scripts/smoke-prod.sh
Executable
+17
View File
@@ -0,0 +1,17 @@
#!/usr/bin/env bash
set -euo pipefail
BASE="${1:-http://127.0.0.1:8000}"
BASE="${BASE%/}"
echo "== Smoke: health =="
curl -fsS "$BASE/api/v1/health" | grep -q '"status":"ok"'
echo "== Smoke: docs disabled =="
docs_code="$(curl -s -o /dev/null -w "%{http_code}" "$BASE/api/v1/docs")"
[[ "$docs_code" == "404" || "$docs_code" == "307" ]] || { echo "Expected docs 404, got $docs_code"; exit 1; }
echo "== Smoke: public content =="
curl -fsS "$BASE/api/v1/content/pages" | grep -q '"data"'
echo "All smoke checks passed."