mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-08-29 04:26:20 +00:00
KaifAhmad1
b2c949f7de
- GCP: remove --allow-unauthenticated, restrict ingress to
internal-and-cloud-load-balancing, replace wildcard ALLOWED_ORIGINS=*
with a substitution variable (_ALLOWED_ORIGINS) so operators supply a
real URL at deploy time; same fix in cloudrun-service.yaml
- Fly.io: replace hardcoded FALKORDB_HOST=localhost with the correct
.internal private-network hostname pattern; update README accordingly
- docker-compose.dev.yml: add missing top-level networks: block so the
frontend service can join the semantica network without --file layering
- K8s/Helm: add readOnlyRootFilesystem: true + runAsUser: 1000 to
container securityContext; mount an emptyDir /tmp so uvicorn can write
temp files
- app.py: fix _read_explorer_settings() or-chain, use in os.environ
checks so an explicit ALLOWED_ORIGINS="" produces an empty allow-list
instead of silently falling through to localhost defaults; remove dead
app.state.falkordb_host/port attributes
- docs: update four locations that still documented {"status":"healthy"}
to reflect the new {"status":"ok"} health response
- tests: update test assertion to read falkordb settings from
app.state.explorer_settings instead of removed top-level attributes
62 lines
1.6 KiB
YAML
62 lines
1.6 KiB
YAML
substitutions:
|
|
_REGION: us-central1
|
|
_SERVICE_NAME: knowledge-explorer
|
|
_IMAGE: gcr.io/$PROJECT_ID/knowledge-explorer
|
|
# Set to your actual service URL — do not use '*' in production.
|
|
_ALLOWED_ORIGINS: https://knowledge-explorer-REPLACE_ME.a.run.app
|
|
|
|
steps:
|
|
- name: gcr.io/cloud-builders/docker
|
|
args:
|
|
- build
|
|
- -t
|
|
- ${_IMAGE}:$SHORT_SHA
|
|
- -t
|
|
- ${_IMAGE}:latest
|
|
- .
|
|
|
|
- name: gcr.io/cloud-builders/docker
|
|
args:
|
|
- push
|
|
- ${_IMAGE}:$SHORT_SHA
|
|
|
|
- name: gcr.io/cloud-builders/docker
|
|
args:
|
|
- push
|
|
- ${_IMAGE}:latest
|
|
|
|
- name: gcr.io/google.com/cloudsdktool/cloud-sdk
|
|
entrypoint: gcloud
|
|
args:
|
|
- run
|
|
- deploy
|
|
- ${_SERVICE_NAME}
|
|
- --image
|
|
- ${_IMAGE}:$SHORT_SHA
|
|
- --region
|
|
- ${_REGION}
|
|
- --platform
|
|
- managed
|
|
# SECURITY: Remove --allow-unauthenticated and restrict ingress for
|
|
# production; add IAP or a load balancer with auth before enabling
|
|
# unauthenticated access. See: cloud.google.com/run/docs/authenticating
|
|
- --no-allow-unauthenticated
|
|
- --ingress
|
|
- internal-and-cloud-load-balancing
|
|
- --port
|
|
- "8000"
|
|
- --min-instances
|
|
- "0"
|
|
- --max-instances
|
|
- "10"
|
|
- --set-env-vars
|
|
# Replace with your actual Cloud Run service URL after first deploy,
|
|
# e.g. ALLOWED_ORIGINS=https://knowledge-explorer-abc123-uc.a.run.app
|
|
- ALLOWED_ORIGINS=${_ALLOWED_ORIGINS}
|
|
- --set-secrets
|
|
- FALKORDB_HOST=falkordb-host:latest,FALKORDB_PORT=falkordb-port:latest
|
|
|
|
images:
|
|
- ${_IMAGE}:$SHORT_SHA
|
|
- ${_IMAGE}:latest
|