c8a7a0b253
Implements the staging-environments OpenSpec change. Persistent staging at staging.trails.cool / planner.staging.trails.cool deploys from main; PR opens get a journal-only preview at pr-<N>.staging.trails.cool that shares the persistent planner. cd-staging.yml builds tagged images, manages per-PR Postgres databases and Caddyfile snippets, evicts the oldest preview at the cap of 3, and tears everything down on PR close. staging-cleanup.yml runs weekly to sweep orphaned previews. DNS records (staging + *.staging A/AAAA) already applied to production via tofu. Caddy approach: per-PR Caddyfile snippets imported from /etc/caddy/sites/ and reloaded on each PR event — no wildcard / on-demand TLS, no router service. Production compose gains a trails-shared network for the staging project to reach Postgres, and host.docker.internal on Caddy so it can reverse-proxy staging containers published on the host loopback. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
29 lines
1 KiB
Text
29 lines
1 KiB
Text
# Staging environment variables. The cd-staging.yml workflow assembles
|
|
# these from SOPS secrets + workflow-injected values and ships them to the
|
|
# server as `infrastructure/staging.env`. Keep this file in sync with the
|
|
# `environment:` blocks in `docker-compose.staging.yml`.
|
|
#
|
|
# For PR previews the same template is reused, with DOMAIN, STAGING_DATABASE,
|
|
# and image tags overridden per-PR by the workflow.
|
|
|
|
# Domain the staging stack serves at. Persistent staging uses
|
|
# staging.trails.cool; PR previews use pr-<n>.staging.trails.cool.
|
|
DOMAIN=staging.trails.cool
|
|
|
|
# Database name on the shared production Postgres. Persistent staging uses
|
|
# trails_staging; PR previews use trails_pr_<n>.
|
|
STAGING_DATABASE=trails_staging
|
|
|
|
# Inherited from SOPS secrets.app.env (decrypted in the workflow):
|
|
POSTGRES_PASSWORD=
|
|
JWT_SECRET=
|
|
SESSION_SECRET=
|
|
BROUTER_URL=
|
|
BROUTER_AUTH_TOKEN=
|
|
|
|
# Image tag to deploy. `latest` for staging, `pr-<n>` for PR previews.
|
|
JOURNAL_IMAGE_TAG=latest
|
|
PLANNER_IMAGE_TAG=latest
|
|
|
|
# Sentry release SHA, set by the workflow.
|
|
SENTRY_RELEASE=
|