Dockerize scha and wire Gitea CI/CD for server-infra deploy.

Move secrets and DB config to env-driven settings so prod can run on shared Postgres behind deploy.sh, matching company_site.
2026-07-14 05:11:41 -05:00
parent b97d5ac792
commit 2081210b78
24 changed files with 1232 additions and 150 deletions
@@ -0,0 +1,53 @@
+# Server-side secrets for server-infra deploy.
+# Copy to the control node (never commit):
+#   ~/Documents/secrets/scha/scha_prod.env
+#   ~/Documents/secrets/scha/scha_beta.env   (optional)
+#
+# server-infra pushes these to /opt/apps/env/scha_<env>.env on each host at deploy time.
+#
+# Docker Compose: if a secret contains $ (e.g. in DATABASE_URL password), escape each
+# $ as $$ or compose will treat $word as a variable (see "pqv1n variable is not set").
+
+# =============================================================================
+# PROD template — ports/hosts for production
+# =============================================================================
+DJANGO_ENV=prod
+DJANGO_DEBUG=false
+DJANGO_SECRET_KEY=replace-with-a-long-random-secret
+DJANGO_ALLOWED_HOSTS=schawheaton.aimloperations.com,www.schawheaton.aimloperations.com,schawheaton.com,www.schawheaton.com
+# Optional override; when unset, https:// origins are derived from DJANGO_ALLOWED_HOSTS.
+# DJANGO_CSRF_TRUSTED_ORIGINS=https://schawheaton.aimloperations.com,https://www.schawheaton.aimloperations.com,https://schawheaton.com,https://www.schawheaton.com
+
+# Logging (optional override; defaults: dev=DEBUG, beta=INFO, prod=WARNING)
+# DJANGO_LOG_LEVEL=WARNING
+
+# Shared external Postgres (10.0.0.230) — prod database
+DATABASE_URL=postgres://westfarn:replace-db-password@10.0.0.230:5432/scha
+
+# Host port on adama/roslin (must match server-infra host_apps)
+WEB_PORT=8002
+
+# Stripe (rotate away from any keys previously committed in git)
+STRIPE_PUBLISHABLE_KEY=pk_live_replace-me
+STRIPE_SECRET_KEY=sk_live_replace-me
+STRIPE_ENDPOINT_SECRET=whsec_replace-me
+
+# reCAPTCHA (rotate away from any keys previously committed in git)
+RECAPTCHA_PUBLIC_KEY=replace-with-production-public-key
+RECAPTCHA_PRIVATE_KEY=replace-with-production-private-key
+
+# Gunicorn
+GUNICORN_WORKERS=2
+GUNICORN_BIND=0.0.0.0:8000
+
+# =============================================================================
+# BETA overrides (use separate file: scha_beta.env)
+# =============================================================================
+# DJANGO_ENV=beta
+# DJANGO_SECRET_KEY=replace-with-a-different-beta-secret
+# DJANGO_ALLOWED_HOSTS=beta.schawheaton.aimloperations.com
+# DATABASE_URL=postgres://westfarn:replace-db-password@10.0.0.230:5432/scha_beta
+# WEB_PORT=8012
+# STRIPE_PUBLISHABLE_KEY=pk_test_replace-me
+# STRIPE_SECRET_KEY=sk_test_replace-me
+# STRIPE_ENDPOINT_SECRET=whsec_replace-me