init: M1 scaffolding + M2 organization/clients/services CRUD
- monorepo (npm workspaces): apps/api (Fastify+Prisma+TS), apps/web (Vite+React+TS), packages/shared (zod schemas) - SSO via auth.queo.ru: jose+JWKS plugin, requireDocPermission(viewer|user|admin) - DEV_BYPASS_AUTH for local development (hard-checked off in production) - M2: organization upsert, clients CRUD with search, services catalog with soft-delete - BigInt -> Number serializer for Prisma money columns - Embedded Postgres + npm run dev:demo for one-command local boot - Docker compose for queoserver: postgres + api + web (nginx as ingress proxying /api -> api:3030) - First migration 0_init committed (prisma migrate diff) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
admin
@@ -0,0 +1,19 @@
|
||||
# Заполнить и переименовать в .env (рядом с docker-compose.yml)
|
||||
|
||||
POSTGRES_DB=docmanager
|
||||
POSTGRES_USER=docmanager
|
||||
POSTGRES_PASSWORD=change-me-strong-password
|
||||
|
||||
# AES-256-GCM ключ для шифрования JWT-токенов Точки в БД (32 байта в base64).
|
||||
# node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
|
||||
TOCHKA_JWT_KEY=
|
||||
|
||||
# Случайная строка в URL-пути приёмника webhook (длинная, например 32+ символов).
|
||||
# node -e "console.log(require('crypto').randomBytes(24).toString('hex'))"
|
||||
TOCHKA_WEBHOOK_SECRET=
|
||||
|
||||
# UUID единственной организации в v1.
|
||||
DEFAULT_ORGANIZATION_ID=00000000-0000-0000-0000-000000000001
|
||||
|
||||
# Токен для browserless/chromium контейнера.
|
||||
CHROMIUM_TOKEN=
|
||||
@@ -0,0 +1,24 @@
|
||||
# Caddy для Doc_manager
|
||||
# Public host: doc.queo.ru (cookie-домен .queo.ru — общий с auth.queo.ru/hall.queo.ru)
|
||||
|
||||
doc.queo.ru {
|
||||
encode zstd gzip
|
||||
|
||||
# API + webhooks + health → Fastify
|
||||
@api path /api/* /webhooks/* /health /health/*
|
||||
handle @api {
|
||||
reverse_proxy api:3030
|
||||
}
|
||||
|
||||
# Всё остальное — статика SPA
|
||||
handle {
|
||||
reverse_proxy web:80
|
||||
}
|
||||
|
||||
log {
|
||||
output file /data/access.log {
|
||||
roll_size 10mb
|
||||
roll_keep 5
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
FROM node:20-alpine
|
||||
WORKDIR /app
|
||||
RUN apk add --no-cache openssl tini
|
||||
|
||||
# Корневой манифест для npm workspaces
|
||||
COPY package.json package-lock.json* tsconfig.base.json ./
|
||||
|
||||
# Манифесты воркспейсов
|
||||
COPY apps/api/package.json apps/api/
|
||||
COPY packages/shared/package.json packages/shared/
|
||||
|
||||
# Все зависимости (включая dev — нужен tsx и prisma CLI). Образ на api ~250MB,
|
||||
# приемлемо для small-scale деплоя; оптимизируем многоэтапной сборкой когда понадобится.
|
||||
RUN npm install --include=dev
|
||||
|
||||
# Исходники
|
||||
COPY apps/api ./apps/api
|
||||
COPY packages/shared ./packages/shared
|
||||
|
||||
# Prisma client (без коннекта к БД)
|
||||
RUN cd apps/api && npx prisma generate
|
||||
|
||||
ENV NODE_ENV=production
|
||||
WORKDIR /app/apps/api
|
||||
EXPOSE 3030
|
||||
|
||||
ENTRYPOINT ["/sbin/tini", "--"]
|
||||
# `prisma migrate deploy` накатывает все миграции из prisma/migrations.
|
||||
# При первом деплое (миграций ещё нет) выполнит `db push` — но db push в проде
|
||||
# опасен; на продакшен-этапе всегда коммитим миграции в репо через `prisma migrate dev`.
|
||||
CMD ["sh", "-c", "npx prisma migrate deploy && npx tsx src/server.ts"]
|
||||
@@ -0,0 +1,14 @@
|
||||
FROM node:20-alpine AS build
|
||||
WORKDIR /app
|
||||
COPY package.json package-lock.json* tsconfig.base.json ./
|
||||
COPY apps/web/package.json apps/web/
|
||||
COPY packages/shared/package.json packages/shared/
|
||||
RUN npm install
|
||||
COPY apps/web ./apps/web
|
||||
COPY packages/shared ./packages/shared
|
||||
RUN npm run build --workspace apps/web
|
||||
|
||||
FROM nginx:1.27-alpine AS runtime
|
||||
COPY docker/nginx-spa.conf /etc/nginx/conf.d/default.conf
|
||||
COPY --from=build /app/apps/web/dist /usr/share/nginx/html
|
||||
EXPOSE 80
|
||||
@@ -0,0 +1,61 @@
|
||||
name: doc-manager
|
||||
|
||||
# Деплой на queoserver (192.168.0.158): хостовый Caddy в /etc/caddy/Caddyfile
|
||||
# проксирует doc.queo.ru → localhost:3031 (web с внутренним прокси /api/* → api).
|
||||
# Локально для разработки используем npm run dev:demo, не этот compose.
|
||||
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:16-alpine
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
POSTGRES_DB: ${POSTGRES_DB:-docmanager}
|
||||
POSTGRES_USER: ${POSTGRES_USER:-docmanager}
|
||||
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-docmanager}
|
||||
volumes:
|
||||
- pg_data:/var/lib/postgresql/data
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-docmanager} -d ${POSTGRES_DB:-docmanager}"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
|
||||
api:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: docker/Dockerfile.api
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
postgres:
|
||||
condition: service_healthy
|
||||
environment:
|
||||
NODE_ENV: production
|
||||
PORT: 3030
|
||||
HOST: 0.0.0.0
|
||||
DATABASE_URL: postgresql://${POSTGRES_USER:-docmanager}:${POSTGRES_PASSWORD:-docmanager}@postgres:5432/${POSTGRES_DB:-docmanager}?schema=public
|
||||
AUTH_ISSUER: ${AUTH_ISSUER:-https://auth.queo.ru}
|
||||
AUTH_AUDIENCE: ${AUTH_AUDIENCE:-queo.ru}
|
||||
AUTH_JWKS_URL: ${AUTH_JWKS_URL:-https://auth.queo.ru/.well-known/jwks.json}
|
||||
AUTH_COOKIE_NAME: q_at
|
||||
AUTH_LOGIN_URL: ${AUTH_LOGIN_URL:-https://auth.queo.ru/auth/login}
|
||||
CORS_ORIGINS: ${CORS_ORIGINS:-https://doc.queo.ru}
|
||||
TOCHKA_JWT_KEY: ${TOCHKA_JWT_KEY:-}
|
||||
TOCHKA_WEBHOOK_SECRET: ${TOCHKA_WEBHOOK_SECRET:-}
|
||||
DEFAULT_ORGANIZATION_ID: ${DEFAULT_ORGANIZATION_ID:-00000000-0000-0000-0000-000000000001}
|
||||
DEV_BYPASS_AUTH: "0"
|
||||
expose:
|
||||
- "3030"
|
||||
|
||||
web:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: docker/Dockerfile.web
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- api
|
||||
ports:
|
||||
# Хостовый Caddy на queoserver: doc.queo.ru → localhost:3031
|
||||
- "127.0.0.1:3031:80"
|
||||
|
||||
volumes:
|
||||
pg_data:
|
||||
@@ -0,0 +1,48 @@
|
||||
server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
root /usr/share/nginx/html;
|
||||
index index.html;
|
||||
|
||||
# SPA fallback
|
||||
location / {
|
||||
try_files $uri $uri/ /index.html;
|
||||
}
|
||||
|
||||
# Долгий кэш для хэшированных ассетов Vite
|
||||
location /assets/ {
|
||||
access_log off;
|
||||
expires 1y;
|
||||
add_header Cache-Control "public, immutable";
|
||||
}
|
||||
|
||||
# Прокси на API. Web и api живут в одной compose-сети, dns "api" резолвится.
|
||||
# Браузер видит всё как один origin (https://doc.queo.ru), куки auth.queo.ru
|
||||
# отправляются автоматически на запросы к /api/me.
|
||||
location /api/ {
|
||||
proxy_pass http://api:3030;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Cookie $http_cookie;
|
||||
}
|
||||
|
||||
# Webhook'и от Точки приходят на этот же origin.
|
||||
location /webhooks/ {
|
||||
proxy_pass http://api:3030;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
# Webhook payload может быть большим (тело документа PDF в base64) — не ограничиваем.
|
||||
client_max_body_size 10m;
|
||||
}
|
||||
|
||||
# Health для мониторинга (не для пользователей).
|
||||
location = /health {
|
||||
proxy_pass http://api:3030;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user