From 4d95108ac5599c01fd04f0ca785e9d60d7df1e2f Mon Sep 17 00:00:00 2001 From: trent Date: Wed, 12 Aug 2026 00:56:55 +0800 Subject: [PATCH] Fix docker file issue --- .env_example | 113 --------------------------------- VigilCareRecordsAPI/Dockerfile | 6 +- docs/setup-get-on-server.md | 6 ++ 3 files changed, 9 insertions(+), 116 deletions(-) delete mode 100644 .env_example create mode 100644 docs/setup-get-on-server.md diff --git a/.env_example b/.env_example deleted file mode 100644 index c634776..0000000 --- a/.env_example +++ /dev/null @@ -1,113 +0,0 @@ -# ---- image coordinates ---- -REGISTRY=git.vectur45.com/trent/vigilcare-clinical -IMAGE_TAG=v1.0.0 - -# ---- exposed ports on the production host ---- -API_PORT=5270 -GATEWAY_PORT=5081 -DASHBOARD_PORT=8088 -DASHBOARD_ORIGIN=https://vigilcare-clinical.vectur45.com -# Gitea Actions var PROD_API_URL (dashboard build) — not read by compose: -# https://api.vigilcare-clinical.vectur45.com - - -# ---- PostgreSQL (container on the same VM, reached via the shared-service network) ---- -# Runtime (DML-only) connection used by the API container. -# "postgres" = the service name in the Postgres compose project - rename to match it exactly. -# Port 5432 is the container's internal port, NOT the 5433 published on the host. -# SSL Mode=Disable: Postgres on the shared-services Docker network has no TLS. -# Use Require only when connecting to a TLS-enabled external Postgres. -PG_CONNECTION="Host=postgres;Port=5432;Database=vigilcare;Username=admin;Password=PartyHard753!;SSL Mode=Disable" -# DDL-privileged connection used ONLY by the EF migration bundle (Step 6 / CD migrate job). -# That job currently runs an act_runner container that is NOT joined to shared-service -# (see .gitea/workflows/cd.yml), so it MUST keep using the externally-routable host:port, -# not the container network name, unless that job is later attached to shared-service too. -# Never put this credential in the API container environment. -PG_CONNECTION_DDL="Host=postgres.site.com;Port=5432;Database=vigilcare;Username=admin;Password=PartyHard753!;SSL Mode=Require;Trust Server Certificate=false" -GATEWAY_PG_CONNECTION="Host=postgres;Port=5432;Database=vigilcare_ward;Username=admin;Password=PartyHard753!;SSL Mode=Disable" - -# ---- Redis (container on the same VM, reached via the shared-service network) ---- -# "redis" = the service name in the Redis compose project - rename to match it exactly. -# Port 6379 is the container's internal port; confirm it matches (it usually does). -REDIS_CONNECTION=redis:6379,abortConnect=false -GATEWAY_REDIS_CONNECTION=redis:6379,abortConnect=false,defaultDatabase=1 - -# ---- external Seq ---- -# On vectur-home-server (Tailscale) - use the ingestion port (5341), not the web UI -# port (8080->80). No TLS is configured, so plain http, not https. -SEQ_URL=http://vectur-home-server:5341 -# The compose only sets SEQ_FIRSTRUN_ADMINUSERNAME/PASSWORD for first-run login, -# it does not provision an API key. Generate one manually via Seq's web UI -# (Settings -> API Keys) after the container's first run, then paste it here. -SEQ_API_KEY=CHANGE_ME - -# ---- external Kafka ---- -# Single-broker cluster on vectur-home-server (Tailscale) - PLAINTEXT only, no SASL. -# Traffic relies on the Tailscale mesh for encryption in transit. -KAFKA_BOOTSTRAP=vectur-home-server:9092 -KAFKA_REPLICATION_FACTOR=1 -KAFKA_SECURITY_PROTOCOL=Plaintext - -# ---- external Elasticsearch ---- -# Unauthenticated cluster: leave ES_API_KEY / ES_USERNAME / ES_PASSWORD unset. -# Program.cs only attaches auth when those values are non-empty. -ES_URI=http://vectur-home-server:9200 -ES_API_KEY= -# ES_USERNAME= -# ES_PASSWORD= - -# ---- external RabbitMQ ---- -# Plain AMQP on vectur-home-server (Tailscale) - only 5672 is exposed, no TLS listener. -# RABBITMQ_USERNAME/PASSWORD must match RABBITMQ_DEFAULT_USER/PASS in the RabbitMQ -# compose's own .env on vectur-home-server. -RABBITMQ_HOST=vectur-home-server -RABBITMQ_PORT=5672 -RABBITMQ_USERNAME=admin -RABBITMQ_PASSWORD=2va2xcLWTAlRN4abEv3wa7EVawHXk+tnRkQVOOXqs2M= -RABBITMQ_USE_SSL=false -GATEWAY_RABBITMQ_HOST=vectur-home-server -GATEWAY_RABBITMQ_PORT=5672 -GATEWAY_RABBITMQ_USERNAME=admin -GATEWAY_RABBITMQ_PASSWORD=2va2xcLWTAlRN4abEv3wa7EVawHXk+tnRkQVOOXqs2M= -GATEWAY_RABBITMQ_USE_SSL=false - -# ---- external MinIO ---- -# Host publishes the S3 API on 9002 (mapped to container's 9000), no TLS termination. -# MINIO_ACCESS_KEY/SECRET_KEY must match MINIO_ROOT_USER/MINIO_ROOT_PASSWORD in the -# MinIO compose's own .env on vectur-home-server. -MINIO_ENDPOINT=vectur-home-server:9002 -MINIO_ACCESS_KEY=admin -MINIO_SECRET_KEY=p3QUh8mXvosfFjrJYJJPd36tGiPbsOASWdIe6FKzdLI= -MINIO_USE_SSL=false - -# ---- application secrets (generate with: openssl rand -base64 48) ---- -JWT_SIGNING_KEY=T0oK2f3YhBesoMgZnEB7vmi4Dfbd7LxtuemkXI8j3xA= -# WARNING: rotating PHI_SEARCH_TOKEN_KEY invalidates every stored patient -# search token. See docs/ops/phi-encryption-runbook.md before changing it. -PHI_SEARCH_TOKEN_KEY=tbL0Nku3+bK476bv4zmfyRBiiRMTTF3To4Qq9RUOSVg= -GATEWAY_API_KEY=ZxFKE4wUChEg+VzNGM16zFSuHeM+I+IQc59rIzN0U2g= -FHIR_API_KEY=wY29TLNIzLouIEKDu+XAxmZ3T1R5cjE2IIXxaYWpNAg= -GATEWAY_JWT_SIGNING_KEY=TfxbvLz992kr8simlbr8s61W5gKQbLqjyTuPjgCWjV0= - -# ---- gateway identity ---- -GATEWAY_ID=ce985c14-42de-4db4-8538-c2a203496d9e -GATEWAY_SITE_ID=e9fba67a-fcf5-4966-acb1-dab58a68bff2 -GATEWAY_DEPARTMENT=ICU -GATEWAY_CODE=GW-ICU-1 -GATEWAY_SITE_CODE=SITE-01 -GATEWAY_SITE_NAME=Primary Site -# GATEWAY_SITE_ADDRESS= - -# ---- production bootstrap users (API seeds these when missing; not demo accounts) ---- -SEED_ADMIN_USERNAME=admin -SEED_ADMIN_PASSWORD="zx+yv8XtbxQq0E5YZ3d8kP5g" -SEED_ADMIN_DISPLAY_NAME=System Admin -SEED_NURSE_USERNAME=nurse -SEED_NURSE_PASSWORD="qcYtKfgLMezlT63AIxrPdmtK" -SEED_NURSE_DISPLAY_NAME=Charge Nurse -SEED_PHYSICIAN_USERNAME=physician -SEED_PHYSICIAN_PASSWORD="msKxpOQIGHK/StlrPIDBx9ZD" -SEED_PHYSICIAN_DISPLAY_NAME=Attending Physician - -SIMULATION_ENABLED=true -SIMULATION_RUNNER_PASSWORD=tlIxrcgEEQKh9BYdjZ6/fWwj4TFoN4zTtCUfICrQpxI= diff --git a/VigilCareRecordsAPI/Dockerfile b/VigilCareRecordsAPI/Dockerfile index f6bfbae..05c7daa 100644 --- a/VigilCareRecordsAPI/Dockerfile +++ b/VigilCareRecordsAPI/Dockerfile @@ -45,9 +45,9 @@ RUN apt-get update \ COPY --from=build /app/publish . -RUN useradd --uid 1654 --user-group --no-create-home appuser \ - && chown -R appuser:appuser /app -USER appuser +# aspnet:8.0 already ships non-root user `app` (UID/GID 1654). +RUN chown -R app:app /app +USER app ENV ASPNETCORE_URLS=http://+:8080 EXPOSE 8080 diff --git a/docs/setup-get-on-server.md b/docs/setup-get-on-server.md new file mode 100644 index 0000000..aa7ce19 --- /dev/null +++ b/docs/setup-get-on-server.md @@ -0,0 +1,6 @@ +1, Create folder and change permissions + +ssh vectur45@35.201.217.185 "sudo mkdir -p /opt/ && sudo chown -R vectur45:vectur45 /opt/ && sudo chmod 755 /opt/" + +2. Copy .env to folder +scp -i ~/.ssh/vectur45 .env vectur45@35.201.217.185:/opt//.env \ No newline at end of file