From 72e6783c81cd1a657499bfe5034ac715df61b3fa Mon Sep 17 00:00:00 2001 From: cesnimda Date: Mon, 24 Aug 2026 21:24:35 +0200 Subject: [PATCH] fix(deploy): ship tested AI service --- .gitea/workflows/ci-deploy.yml | 1 + docs/architecture/deployment.md | 8 +++++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/ci-deploy.yml b/.gitea/workflows/ci-deploy.yml index 86c18ac..246a91e 100644 --- a/.gitea/workflows/ci-deploy.yml +++ b/.gitea/workflows/ci-deploy.yml @@ -155,6 +155,7 @@ jobs: git reset --hard ${{ github.sha }} git clean -fd chmod +x deploy/deploy.sh + DEPLOY_BUILD_AI_SERVICE=true \ APP_VERSION=${{ github.run_number }} \ APP_COMMIT_SHA=${{ github.sha }} \ APP_BUILD_STAMP="$(date -u +'%Y-%m-%d %H:%M UTC')" \ diff --git a/docs/architecture/deployment.md b/docs/architecture/deployment.md index d778026..9412e87 100644 --- a/docs/architecture/deployment.md +++ b/docs/architecture/deployment.md @@ -3,10 +3,12 @@ Production runs the frontend/nginx, ASP.NET API, AI sidecar, and configured database through Docker Compose. The backend is not published directly; nginx proxies `/api`. `deploy/deploy.sh` validates configuration, takes and verifies a provider-appropriate backup before replacement, builds/restarts the -stack, and performs health checks. +stack, and performs health checks. The protected production workflow explicitly rebuilds the AI sidecar +so application and AI contracts always come from the same tested commit. -Production commands explicitly select `docker-compose.yml`; it publishes no application ports. -Traefik reaches frontend/nginx over `jobtracker_shared`, must match the canonical Host exactly, and +Production commands explicitly select `docker-compose.yml`. The operator-owned reverse proxy still +targets frontend/nginx through compatibility port 3000; the host firewall blocks direct external access. +Traefik must match the canonical Host exactly and must replace `X-Forwarded-For` and `X-Forwarded-Proto`. Nginx passes those sanitized values to the backend over the dedicated `WEB_PROXY_SUBNET`; nginx also derives its only application server name from `APP_PUBLIC_BASE_URL` and rejects unknown Hosts except its liveness endpoint. The backend trusts