cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(deploy): ship tested AI service
CI and Deploy / test (push) Failing after 1m11s
Details
CI and Deploy / deploy (push) Has been skipped
Details

Browse Source
This commit is contained in:
cesnimda
2026-08-24 21:24:35 +02:00
parent e8e6fac420
commit 72e6783c81
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci-deploy.yml
+1
View File
@@ -155,6 +155,7 @@ jobs:
git reset --hard ${{ github.sha }} git reset --hard ${{ github.sha }}
git clean -fd git clean -fd
chmod +x deploy/deploy.sh chmod +x deploy/deploy.sh
DEPLOY_BUILD_AI_SERVICE=true \
APP_VERSION=${{ github.run_number }} \ APP_VERSION=${{ github.run_number }} \
APP_COMMIT_SHA=${{ github.sha }} \ APP_COMMIT_SHA=${{ github.sha }} \
APP_BUILD_STAMP="$(date -u +'%Y-%m-%d %H:%M UTC')" \ APP_BUILD_STAMP="$(date -u +'%Y-%m-%d %H:%M UTC')" \
docs/architecture/deployment.md
+5 -3
View File
@@ -3,10 +3,12 @@
Production runs the frontend/nginx, ASP.NET API, AI sidecar, and configured database through Docker Production runs the frontend/nginx, ASP.NET API, AI sidecar, and configured database through Docker
Compose. The backend is not published directly; nginx proxies `/api`. `deploy/deploy.sh` validates Compose. The backend is not published directly; nginx proxies `/api`. `deploy/deploy.sh` validates
configuration, takes and verifies a provider-appropriate backup before replacement, builds/restarts the configuration, takes and verifies a provider-appropriate backup before replacement, builds/restarts the
stack, and performs health checks. stack, and performs health checks. The protected production workflow explicitly rebuilds the AI sidecar
so application and AI contracts always come from the same tested commit.
Production commands explicitly select `docker-compose.yml`; it publishes no application ports. Production commands explicitly select `docker-compose.yml`. The operator-owned reverse proxy still
Traefik reaches frontend/nginx over `jobtracker_shared`, must match the canonical Host exactly, and targets frontend/nginx through compatibility port 3000; the host firewall blocks direct external access.
Traefik must match the canonical Host exactly and
must replace `X-Forwarded-For` and `X-Forwarded-Proto`. Nginx passes those sanitized values to the must replace `X-Forwarded-For` and `X-Forwarded-Proto`. Nginx passes those sanitized values to the
backend over the dedicated `WEB_PROXY_SUBNET`; nginx also derives its only application server name backend over the dedicated `WEB_PROXY_SUBNET`; nginx also derives its only application server name
from `APP_PUBLIC_BASE_URL` and rejects unknown Hosts except its liveness endpoint. The backend trusts from `APP_PUBLIC_BASE_URL` and rejects unknown Hosts except its liveness endpoint. The backend trusts