docs: the production stack has now actually been run - #285
Merged
Conversation
deploy/compose shipped verified only by `docker compose config`. The README said artifact upload was unproven, which was honest and is no longer true. Brought the whole stack up behind Caddy on local hostnames and checked what it claims: only 80 and 443 published, Postgres and MinIO reachable only inside the network, both apps answering /health on their own hostnames with different bodies — which is the concrete reason they are separate hostnames rather than paths — the object store refusing an unsigned GET, and an artifact surviving a presign, a PUT and a presigned GET with the same bytes. One property nobody had written down turned up on the way. A presigned upload is bound to the size it was issued for: a body larger than the declared sizeBytes is refused with 403. That is a grant for a screenshot being unable to carry a gigabyte, and it is worth reading as the limit working rather than as a misconfiguration, which is what a bare 403 usually means to someone deploying. Certificate issuance is the one thing local testing cannot cover — Caddy uses an internal certificate for a .localhost name — so the DNS-first instruction stays, and now says why.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
deploy/composeshipped verified only bydocker compose config— I had checked that it parses and that exactly two ports publish, and the README said artifact upload was unproven. That was honest and is no longer true.Brought the whole thing up behind Caddy on local hostnames and checked every claim it makes.
caddy 0.0.0.0:80, 0.0.0.0:443; Postgres and MinIO show internal ports only; api/web/worker publish nothing/health{"service":"api"}and{"service":"web"}, each on its own hostname403 AccessDeniedPUT200 → presignedGET200 →EXACTLY12BYbackThe
/healthresult is the concrete justification for a design decision I had only argued for in prose: the two apps return different bodies on the same path. Collapsing them onto one hostname with path routing would have shadowed one of them, andflakemetry doctorprobes exactly that path to tell an unreachable endpoint from a rejected token.Something nobody had written down
The first round-trip attempt returned
403on the upload. Not a misconfiguration — a presigned upload is bound to the size it was issued for, and my second test file was 18 bytes against a grant for 12.So a presign is a bounded grant rather than an open write: a URL issued for a screenshot cannot be spent on a gigabyte. Both the deploy README and the runbook now say so, because a bare
403reads as "something is broken" to whoever is deploying, and here it is the limit working.What local testing cannot cover
Certificate issuance. Caddy uses an internal certificate for a
.localhostname and only talks to Let's Encrypt for a real domain, so the "point DNS at the host before the first start" instruction stays — and now says why rather than just asserting it.Docs only; 62/62 turbo tasks unchanged.