julian
83298bc0c5
The booth deploys the compose files FLAT (e.g. /opt/parking_systems/) with
booth.sh next to them, but the script assumed it lived in <repo>/scripts/ and
blindly did `cd ..` — so REPO_DIR resolved to the parent, where there are no
compose files, and every subcommand operated on the wrong dir. `usage()` then
sed-read a relative $0 that no longer existed after the cd ("can't read
booth.sh"). Discover the compose files instead: check the script's own dir,
then ../, then $PWD, and cd to whichever has docker-compose.yml. usage() reads
an absolute $SELF so it survives the cd.
Also: .env.example defaulted TAG=main, but the registry only has dev-* tags
(no main build yet), so `compose pull` 404s. Default to TAG=dev and document
the moving-vs-immutable (dev / dev-<sha>) tag scheme.
Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
38 lines
2.0 KiB
Bash
38 lines
2.0 KiB
Bash
# Booth deploy env — copy to `.env` and fill in, then run ./scripts/booth.sh up
|
|
# (prod). Consumed by docker-compose.yml + the prod override via --env-file.
|
|
# See wiki/decisions/container-deployment.md. Do NOT commit the filled-in .env.
|
|
|
|
# --- image source (prod pulls from the house Gitea registry) ------------------
|
|
# The registry namespace; combined with the image name + TAG below.
|
|
REGISTRY=git.infra.msai.al/mca/parking_solution
|
|
# Image tag to deploy. CI publishes TWO tags per build: a MOVING branch tag
|
|
# (`dev`, and `main` once that branch is built) republished on every push, and an
|
|
# IMMUTABLE per-commit `dev-<sha>` (e.g. dev-830993b). Use the moving tag for a
|
|
# self-updating booth (`booth.sh update` pulls the latest); pin the `<branch>-<sha>`
|
|
# form for a reproducible, deterministic deploy. NOTE: `main` images only exist once
|
|
# something is built on main — until then deploy from `dev`.
|
|
TAG=dev
|
|
|
|
# --- secrets (NO safe defaults — the server refuses to boot without a real one) -
|
|
# JWT signing secret. Generate yourself, never share it: openssl rand -hex 32
|
|
# Must be 32+ chars and must NOT contain change-me / insecure / dev-only.
|
|
JWT_SECRET=
|
|
|
|
# Ledger-signing key for the append-only signed event chain. Set a DISTINCT value
|
|
# in prod (don't reuse JWT_SECRET). openssl rand -hex 32
|
|
EVENT_SIGNING_KEY=
|
|
|
|
# --- booth LAN specifics ------------------------------------------------------
|
|
# Auth cookie is HTTPS-only by default; the booth is plain HTTP behind Caddy on
|
|
# :80, so this MUST stay 0 or operators cannot log in. Set to 1 only behind TLS.
|
|
COOKIE_SECURE=0
|
|
|
|
# Remote origins the live WS feed must accept (same-origin always passes). Add any
|
|
# address admins hit the UI from beyond the booth itself, comma-separated, e.g.
|
|
# http://parksystems.msai.al (leave blank if only the local booth URL is used).
|
|
WS_ALLOWED_ORIGINS=
|
|
|
|
# Vision/ANPR. Prod override already forces the fast_alpr engine; leave VISION_ENABLED=1
|
|
# unless you are running without the camera. (Set 0 to disable the vision call entirely.)
|
|
VISION_ENABLED=1
|