Fix docker file issue
This commit is contained in:
-113
@@ -1,113 +0,0 @@
|
|||||||
# ---- image coordinates ----
|
|
||||||
REGISTRY=git.vectur45.com/trent/vigilcare-clinical
|
|
||||||
IMAGE_TAG=v1.0.0
|
|
||||||
|
|
||||||
# ---- exposed ports on the production host ----
|
|
||||||
API_PORT=5270
|
|
||||||
GATEWAY_PORT=5081
|
|
||||||
DASHBOARD_PORT=8088
|
|
||||||
DASHBOARD_ORIGIN=https://vigilcare-clinical.vectur45.com
|
|
||||||
# Gitea Actions var PROD_API_URL (dashboard build) — not read by compose:
|
|
||||||
# https://api.vigilcare-clinical.vectur45.com
|
|
||||||
|
|
||||||
|
|
||||||
# ---- PostgreSQL (container on the same VM, reached via the shared-service network) ----
|
|
||||||
# Runtime (DML-only) connection used by the API container.
|
|
||||||
# "postgres" = the service name in the Postgres compose project - rename to match it exactly.
|
|
||||||
# Port 5432 is the container's internal port, NOT the 5433 published on the host.
|
|
||||||
# SSL Mode=Disable: Postgres on the shared-services Docker network has no TLS.
|
|
||||||
# Use Require only when connecting to a TLS-enabled external Postgres.
|
|
||||||
PG_CONNECTION="Host=postgres;Port=5432;Database=vigilcare;Username=admin;Password=PartyHard753!;SSL Mode=Disable"
|
|
||||||
# DDL-privileged connection used ONLY by the EF migration bundle (Step 6 / CD migrate job).
|
|
||||||
# That job currently runs an act_runner container that is NOT joined to shared-service
|
|
||||||
# (see .gitea/workflows/cd.yml), so it MUST keep using the externally-routable host:port,
|
|
||||||
# not the container network name, unless that job is later attached to shared-service too.
|
|
||||||
# Never put this credential in the API container environment.
|
|
||||||
PG_CONNECTION_DDL="Host=postgres.site.com;Port=5432;Database=vigilcare;Username=admin;Password=PartyHard753!;SSL Mode=Require;Trust Server Certificate=false"
|
|
||||||
GATEWAY_PG_CONNECTION="Host=postgres;Port=5432;Database=vigilcare_ward;Username=admin;Password=PartyHard753!;SSL Mode=Disable"
|
|
||||||
|
|
||||||
# ---- Redis (container on the same VM, reached via the shared-service network) ----
|
|
||||||
# "redis" = the service name in the Redis compose project - rename to match it exactly.
|
|
||||||
# Port 6379 is the container's internal port; confirm it matches (it usually does).
|
|
||||||
REDIS_CONNECTION=redis:6379,abortConnect=false
|
|
||||||
GATEWAY_REDIS_CONNECTION=redis:6379,abortConnect=false,defaultDatabase=1
|
|
||||||
|
|
||||||
# ---- external Seq ----
|
|
||||||
# On vectur-home-server (Tailscale) - use the ingestion port (5341), not the web UI
|
|
||||||
# port (8080->80). No TLS is configured, so plain http, not https.
|
|
||||||
SEQ_URL=http://vectur-home-server:5341
|
|
||||||
# The compose only sets SEQ_FIRSTRUN_ADMINUSERNAME/PASSWORD for first-run login,
|
|
||||||
# it does not provision an API key. Generate one manually via Seq's web UI
|
|
||||||
# (Settings -> API Keys) after the container's first run, then paste it here.
|
|
||||||
SEQ_API_KEY=CHANGE_ME
|
|
||||||
|
|
||||||
# ---- external Kafka ----
|
|
||||||
# Single-broker cluster on vectur-home-server (Tailscale) - PLAINTEXT only, no SASL.
|
|
||||||
# Traffic relies on the Tailscale mesh for encryption in transit.
|
|
||||||
KAFKA_BOOTSTRAP=vectur-home-server:9092
|
|
||||||
KAFKA_REPLICATION_FACTOR=1
|
|
||||||
KAFKA_SECURITY_PROTOCOL=Plaintext
|
|
||||||
|
|
||||||
# ---- external Elasticsearch ----
|
|
||||||
# Unauthenticated cluster: leave ES_API_KEY / ES_USERNAME / ES_PASSWORD unset.
|
|
||||||
# Program.cs only attaches auth when those values are non-empty.
|
|
||||||
ES_URI=http://vectur-home-server:9200
|
|
||||||
ES_API_KEY=
|
|
||||||
# ES_USERNAME=
|
|
||||||
# ES_PASSWORD=
|
|
||||||
|
|
||||||
# ---- external RabbitMQ ----
|
|
||||||
# Plain AMQP on vectur-home-server (Tailscale) - only 5672 is exposed, no TLS listener.
|
|
||||||
# RABBITMQ_USERNAME/PASSWORD must match RABBITMQ_DEFAULT_USER/PASS in the RabbitMQ
|
|
||||||
# compose's own .env on vectur-home-server.
|
|
||||||
RABBITMQ_HOST=vectur-home-server
|
|
||||||
RABBITMQ_PORT=5672
|
|
||||||
RABBITMQ_USERNAME=admin
|
|
||||||
RABBITMQ_PASSWORD=2va2xcLWTAlRN4abEv3wa7EVawHXk+tnRkQVOOXqs2M=
|
|
||||||
RABBITMQ_USE_SSL=false
|
|
||||||
GATEWAY_RABBITMQ_HOST=vectur-home-server
|
|
||||||
GATEWAY_RABBITMQ_PORT=5672
|
|
||||||
GATEWAY_RABBITMQ_USERNAME=admin
|
|
||||||
GATEWAY_RABBITMQ_PASSWORD=2va2xcLWTAlRN4abEv3wa7EVawHXk+tnRkQVOOXqs2M=
|
|
||||||
GATEWAY_RABBITMQ_USE_SSL=false
|
|
||||||
|
|
||||||
# ---- external MinIO ----
|
|
||||||
# Host publishes the S3 API on 9002 (mapped to container's 9000), no TLS termination.
|
|
||||||
# MINIO_ACCESS_KEY/SECRET_KEY must match MINIO_ROOT_USER/MINIO_ROOT_PASSWORD in the
|
|
||||||
# MinIO compose's own .env on vectur-home-server.
|
|
||||||
MINIO_ENDPOINT=vectur-home-server:9002
|
|
||||||
MINIO_ACCESS_KEY=admin
|
|
||||||
MINIO_SECRET_KEY=p3QUh8mXvosfFjrJYJJPd36tGiPbsOASWdIe6FKzdLI=
|
|
||||||
MINIO_USE_SSL=false
|
|
||||||
|
|
||||||
# ---- application secrets (generate with: openssl rand -base64 48) ----
|
|
||||||
JWT_SIGNING_KEY=T0oK2f3YhBesoMgZnEB7vmi4Dfbd7LxtuemkXI8j3xA=
|
|
||||||
# WARNING: rotating PHI_SEARCH_TOKEN_KEY invalidates every stored patient
|
|
||||||
# search token. See docs/ops/phi-encryption-runbook.md before changing it.
|
|
||||||
PHI_SEARCH_TOKEN_KEY=tbL0Nku3+bK476bv4zmfyRBiiRMTTF3To4Qq9RUOSVg=
|
|
||||||
GATEWAY_API_KEY=ZxFKE4wUChEg+VzNGM16zFSuHeM+I+IQc59rIzN0U2g=
|
|
||||||
FHIR_API_KEY=wY29TLNIzLouIEKDu+XAxmZ3T1R5cjE2IIXxaYWpNAg=
|
|
||||||
GATEWAY_JWT_SIGNING_KEY=TfxbvLz992kr8simlbr8s61W5gKQbLqjyTuPjgCWjV0=
|
|
||||||
|
|
||||||
# ---- gateway identity ----
|
|
||||||
GATEWAY_ID=ce985c14-42de-4db4-8538-c2a203496d9e
|
|
||||||
GATEWAY_SITE_ID=e9fba67a-fcf5-4966-acb1-dab58a68bff2
|
|
||||||
GATEWAY_DEPARTMENT=ICU
|
|
||||||
GATEWAY_CODE=GW-ICU-1
|
|
||||||
GATEWAY_SITE_CODE=SITE-01
|
|
||||||
GATEWAY_SITE_NAME=Primary Site
|
|
||||||
# GATEWAY_SITE_ADDRESS=
|
|
||||||
|
|
||||||
# ---- production bootstrap users (API seeds these when missing; not demo accounts) ----
|
|
||||||
SEED_ADMIN_USERNAME=admin
|
|
||||||
SEED_ADMIN_PASSWORD="zx+yv8XtbxQq0E5YZ3d8kP5g"
|
|
||||||
SEED_ADMIN_DISPLAY_NAME=System Admin
|
|
||||||
SEED_NURSE_USERNAME=nurse
|
|
||||||
SEED_NURSE_PASSWORD="qcYtKfgLMezlT63AIxrPdmtK"
|
|
||||||
SEED_NURSE_DISPLAY_NAME=Charge Nurse
|
|
||||||
SEED_PHYSICIAN_USERNAME=physician
|
|
||||||
SEED_PHYSICIAN_PASSWORD="msKxpOQIGHK/StlrPIDBx9ZD"
|
|
||||||
SEED_PHYSICIAN_DISPLAY_NAME=Attending Physician
|
|
||||||
|
|
||||||
SIMULATION_ENABLED=true
|
|
||||||
SIMULATION_RUNNER_PASSWORD=tlIxrcgEEQKh9BYdjZ6/fWwj4TFoN4zTtCUfICrQpxI=
|
|
||||||
@@ -45,9 +45,9 @@ RUN apt-get update \
|
|||||||
|
|
||||||
COPY --from=build /app/publish .
|
COPY --from=build /app/publish .
|
||||||
|
|
||||||
RUN useradd --uid 1654 --user-group --no-create-home appuser \
|
# aspnet:8.0 already ships non-root user `app` (UID/GID 1654).
|
||||||
&& chown -R appuser:appuser /app
|
RUN chown -R app:app /app
|
||||||
USER appuser
|
USER app
|
||||||
|
|
||||||
ENV ASPNETCORE_URLS=http://+:8080
|
ENV ASPNETCORE_URLS=http://+:8080
|
||||||
EXPOSE 8080
|
EXPOSE 8080
|
||||||
|
|||||||
@@ -0,0 +1,6 @@
|
|||||||
|
1, Create folder and change permissions
|
||||||
|
|
||||||
|
ssh vectur45@35.201.217.185 "sudo mkdir -p /opt/<project-name> && sudo chown -R vectur45:vectur45 /opt/<project-name> && sudo chmod 755 /opt/<project-name>"
|
||||||
|
|
||||||
|
2. Copy .env to folder
|
||||||
|
scp -i ~/.ssh/vectur45 .env vectur45@35.201.217.185:/opt/<project-name>/.env
|
||||||
Reference in New Issue
Block a user