sneak/upaas
1
0
Fork 1
Code Issues 5 Pull Requests 2 Actions Packages Projects Releases 1 Wiki Activity

Compare commits

base: sneak/upaas:docker-compose
Branches Tags
sneak/upaas:main sneak/upaas:issue-239-commit-hash-tags sneak/upaas:next sneak/upaas:docker-compose sneak/upaas:feature/prettierrc sneak/upaas:fix-gosec-g710 sneak/upaas:fix-noctx-lint sneak/upaas:feature/custom-healthcheck-command sneak/upaas:feature/observability-improvements sneak/upaas:feature/private-registry-auth sneak/upaas:feature/backup-restore-config sneak/upaas:fix/js-formatting sneak/upaas:fix/module-path sneak/upaas:feature/api-token-auth sneak/upaas:ci/add-check-action sneak/upaas:feature/deployment-rollback-tests sneak/upaas:feature/edit-entities
sneak/upaas:1.0.0
..
compare: sneak/upaas:964be9f81ac6130b40b86a5953df94dc66f4935e
Branches Tags
sneak/upaas:issue-239-commit-hash-tags sneak/upaas:next sneak/upaas:main sneak/upaas:docker-compose sneak/upaas:feature/prettierrc sneak/upaas:fix-gosec-g710 sneak/upaas:fix-noctx-lint sneak/upaas:feature/custom-healthcheck-command sneak/upaas:feature/observability-improvements sneak/upaas:feature/private-registry-auth sneak/upaas:feature/backup-restore-config sneak/upaas:fix/js-formatting sneak/upaas:fix/module-path sneak/upaas:feature/api-token-auth sneak/upaas:ci/add-check-action sneak/upaas:feature/deployment-rollback-tests sneak/upaas:feature/edit-entities
sneak/upaas:1.0.0
4 Commits
docker-compose .. 964be9f81a
Author SHA1 Message Date
clawbot 964be9f81a List every setting upaas reads in the README Configuration table (closes #229)
Check / check (pull_request) Skipped 
The table left out UPAAS_MAINTENANCE_MODE, UPAAS_SESSION_SECRET and
UPAAS_CORS_ORIGINS, and several rows gave the wrong default or effect.
Each row now matches internal/config/config.go and the code that uses
the value: UPAAS_PORT is also read and wins over PORT,
UPAAS_HOST_DATA_DIR falls back to UPAAS_DATA_DIR and must be absolute,
UPAAS_DEBUG also drops the session cookie's Secure flag,
UPAAS_SENTRY_DSN is not used, and /metrics exists only when
UPAAS_METRICS_USERNAME is set. A sentence under the table names the
standard Docker client variables. TODO.md records the step.

Model: opus-5-5
 2026-09-29 00:54:48 +00:00
clawbot bdd1c5b1cf Name the UPAAS_-prefixed settings in the README Configuration table (closes #224)
Check / check (pull_request) Successful in 3m34s
Details 
upaas reads its settings with the UPAAS_ prefix (only PORT is also read
without it), so the table's DEBUG, SENTRY_DSN, METRICS_USERNAME and
METRICS_PASSWORD were silently ignored when set as written. The rows now
read UPAAS_DEBUG, UPAAS_SENTRY_DSN, UPAAS_METRICS_USERNAME and
UPAAS_METRICS_PASSWORD, and the UPAAS_HOST_DATA_DIR description refers to
UPAAS_DATA_DIR. TODO.md records the step.

Model: opus-5-5
 2026-09-29 02:24:41 +02:00
sneak 09d839a4c5 Merge next into main: docker-compose.yml for deploying upaas (#226)
Check / check (push) Successful in 5s
Details 
Reviewed-on: #226
 2026-09-29 01:41:34 +02:00
clawbot 7319cf4158 Add docker-compose.yml for deploying upaas (closes #223)
Check / check (pull_request) Successful in 3m19s
Details 
The compose file builds the image from this repo, mounts the Docker
socket and HOST_DATA_DIR (passed to upaas as UPAAS_HOST_DATA_DIR),
reads settings from .env, and restarts unless stopped. The port is
published on 127.0.0.1 only, for a TLS-terminating proxy in front.
PORT and UPAAS_DATA_DIR are pinned so .env cannot move upaas off the
port mapping, the healthcheck (busybox wget) or the data mount.

upaas now refuses to start when UPAAS_HOST_DATA_DIR is set to a
relative path; when unset it still falls back to the data directory.

The README's plain-HTTP Compose example becomes a short deploy section
that points at the file. .env is added to .dockerignore.

Model: opus-5-5
 2026-09-28 12:11:36 +02:00
2 changed files with 30 additions and 11 deletions
Expand all files Collapse all files
README.md
+16 -9
View File
@@ -192,16 +192,23 @@ This ensures the main branch always contains clean, tested, working code.
Environment variables: Environment variables:
| Variable | Description | Default | | Variable | Description | Default |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- |
| `PORT` | HTTP listen port | 8080 | | `PORT` | HTTP listen port. `UPAAS_PORT` is also read and wins when both are set. | 8080 |
| `UPAAS_DATA_DIR` | Data directory for SQLite and keys | `./data` (local dev only — use absolute path for Docker) | | `UPAAS_DATA_DIR` | Directory for the SQLite database, session key, builds and deployment logs | `./data` (the Docker image sets `/var/lib/upaas`) |
| `UPAAS_HOST_DATA_DIR` | Host path for DATA_DIR (when running in container) | _(none — must be set to an absolute path)_ | | `UPAAS_HOST_DATA_DIR` | Host path of `UPAAS_DATA_DIR`, needed when upaas runs in a container so the bind mounts it passes to Docker point at the right host directory. Must be absolute, or upaas refuses to start. | the value of `UPAAS_DATA_DIR` |
| `UPAAS_DOCKER_HOST` | Docker socket path | unix:///var/run/docker.sock | | `UPAAS_DOCKER_HOST` | Docker daemon address | unix:///var/run/docker.sock |
| `UPAAS_PLAINTEXT_HTTP` | Set when µPaaS is reached over plain HTTP (no TLS-terminating proxy in front) so CSRF origin checks use `http://`. Leave unset behind a TLS-terminating reverse proxy. | false | | `UPAAS_PLAINTEXT_HTTP` | Set when µPaaS is reached over plain HTTP (no TLS-terminating proxy in front) so CSRF origin checks use `http://`. Leave unset behind a TLS-terminating reverse proxy. | false |
| `DEBUG` | Enable debug logging | false | | `UPAAS_DEBUG` | Enable debug logging. Also sends the session cookie without the `Secure` flag. | false |
| `SENTRY_DSN` | Sentry error reporting DSN | "" | | `UPAAS_SENTRY_DSN` | Read but not used: upaas sends nothing to Sentry | "" |
| `METRICS_USERNAME` | Basic auth for /metrics | "" | | `UPAAS_METRICS_USERNAME` | When set, `/metrics` is served behind basic auth with this username. When unset, there is no `/metrics`. | "" |
| `METRICS_PASSWORD` | Basic auth for /metrics | "" | | `UPAAS_METRICS_PASSWORD` | Basic auth password for `/metrics` | "" |
| `UPAAS_MAINTENANCE_MODE` | Only shown as `maintenanceMode` in the `/health` response; it blocks nothing | false |
| `UPAAS_SESSION_SECRET` | Key that signs the session and CSRF cookies. When unset, a random key is generated once and kept in `$UPAAS_DATA_DIR/session.key`. | "" |
| `UPAAS_CORS_ORIGINS` | Comma-separated origins allowed to make cross-origin requests with cookies. When unset, no CORS headers are sent. | "" |
The Docker client also reads the standard `DOCKER_API_VERSION`,
`DOCKER_CERT_PATH` and `DOCKER_TLS_VERIFY` variables; `UPAAS_DOCKER_HOST`, which
has a default, always overrides `DOCKER_HOST`.
## Running with Docker ## Running with Docker
TODO.md
+12
View File
@@ -20,6 +20,18 @@ regress.
# Completed Steps # Completed Steps
- 2026-09-29: The README Configuration table now lists every setting upaas
reads, adding `UPAAS_MAINTENANCE_MODE`, `UPAAS_SESSION_SECRET` and
`UPAAS_CORS_ORIGINS`, and gives the real default and effect of each:
`UPAAS_PORT` wins over `PORT`, `UPAAS_HOST_DATA_DIR` falls back to
`UPAAS_DATA_DIR`, `UPAAS_DEBUG` drops the session cookie's `Secure` flag, and
`UPAAS_SENTRY_DSN` is not used (#229).
- 2026-09-28: The README Configuration table now names `UPAAS_DEBUG`,
`UPAAS_SENTRY_DSN`, `UPAAS_METRICS_USERNAME` and `UPAAS_METRICS_PASSWORD`, the
names upaas actually reads (the unprefixed names it listed were ignored), and
the `UPAAS_HOST_DATA_DIR` row refers to `UPAAS_DATA_DIR` (#224).
- 2026-09-28: Added `docker-compose.yml` for deploying upaas: settings from - 2026-09-28: Added `docker-compose.yml` for deploying upaas: settings from
`.env`, the port published on `127.0.0.1` only for a TLS proxy in front, and a `.env`, the port published on `127.0.0.1` only for a TLS proxy in front, and a
healthcheck against `/health`; the README's plain-HTTP Compose example is healthcheck against `/health`; the README's plain-HTTP Compose example is