mirror of
https://github.com/simstudioai/sim.git
synced 2026-09-01 14:59:19 +08:00
Waleed
3de63c94e3
* feat(self-host): align Docker Compose with Helm and overhaul self-hosting docs Docker Compose shipped no scheduler, so scheduled workflows, every polling trigger, connector syncs, the outbox, and data drains silently never ran. Adds a cron service running the same 18 jobs the Helm chart schedules as CronJobs, and closes the remaining behavioral gaps between the two paths: bundled Redis in the chart, no hosted plan caps in chart defaults, pinned image tags, and fail-fast secrets. A CI check keeps the schedulers in sync. Also rewrites the self-hosting docs: 14 new pages, 8 updated, reorganized into Install / Configure / Operate. * fix(self-host): drop bun install from chart CI, remove air-gapped and backup docs The scheduler-parity check pulled a full dependency install into the chart-validation job, which fails building isolated-vm on that runner. Rewritten to use only node builtins so the job installs nothing. Also removes the air-gapped and backup/restore pages, and stops pinning a concrete release in the docs so the examples do not go stale each release. * fix(helm): bundle Redis in secret-manager modes unless the URL is supplied Suppressing Redis whenever a secret mode was active left those deployments with no Redis at all — REDIS_URL is optional there and both shipped examples omit it. The chart now steps aside only on a detectable signal: an explicit app.env.REDIS_URL, an ESO remoteRefs.app.REDIS_URL mapping, or the new redis.provideUrl=false opt-out for a pre-created Secret it cannot read. * fix(compose): derive realtime BETTER_AUTH_URL from NEXT_PUBLIC_APP_URL realtime read BETTER_AUTH_URL directly and fell back to localhost while simstudio derived it from NEXT_PUBLIC_APP_URL, so setting only the public origin left realtime authenticating against http://localhost:3000. * fix(helm): deliver bundled REDIS_URL via ConfigMap so an operator value always wins Injecting REDIS_URL as an inline container env made it beat every envFrom source, so a REDIS_URL held in a pre-created Secret or synced by External Secrets was silently shadowed and traffic moved to a fresh in-cluster Redis. Kubernetes resolves duplicate envFrom keys by letting the last source win, so the bundled URL now ships as a ConfigMap listed before the app Secret. Any operator-supplied value overrides it without the chart needing to read it, which also removes the redis.provideUrl flag the previous attempt required. * docs(helm): spell out the egress rule external datastores need The default NetworkPolicy allows 443 plus the bundled Postgres and Redis by pod selector. Anything you run outside the chart on another port needs its own rule, which is easiest to miss when REDIS_URL arrives via a Secret the chart cannot inspect. Adds a copyable example to the production checklist and the security guide. * feat(helm): add networkPolicy.allowExternalEgress for managed datastores The default policy allows 443 plus the bundled Postgres and Redis by pod selector, so a managed datastore on another port needs a hand-written CIDR rule — awkward when REDIS_URL arrives via a Secret the chart cannot inspect. Adds an opt-in switch that drops the port restriction while still blocking the cloud metadata endpoints. Defaults to false, keeping this chart stricter than the common chart default of unrestricted egress.
25 lines
1.2 KiB
Bash
Executable File
25 lines
1.2 KiB
Bash
Executable File
#!/bin/sh
|
|
# Refuses to run without CRON_SECRET, but exits 0 so `restart: on-failure`
|
|
# leaves the container stopped instead of crash-looping. The rest of the stack
|
|
# is unaffected — this keeps upgrades from an older compose file working, since
|
|
# CRON_SECRET did not exist before the scheduler was added.
|
|
set -eu
|
|
|
|
if [ -z "${CRON_SECRET:-}" ]; then
|
|
echo "sim-cron: CRON_SECRET is not set — background jobs are disabled." >&2
|
|
echo "sim-cron:" >&2
|
|
echo "sim-cron: Scheduled workflows, polling triggers (Gmail, Outlook, IMAP," >&2
|
|
echo "sim-cron: RSS, Drive, Sheets, Calendar, HubSpot), knowledge base connector" >&2
|
|
echo "sim-cron: syncs, and data drains will not run until it is configured." >&2
|
|
echo "sim-cron:" >&2
|
|
echo "sim-cron: Add this to the .env file next to docker-compose.prod.yml," >&2
|
|
echo "sim-cron: then run: docker compose -f docker-compose.prod.yml up -d" >&2
|
|
echo "sim-cron:" >&2
|
|
echo "sim-cron: CRON_SECRET=$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')" >&2
|
|
echo "sim-cron:" >&2
|
|
echo "sim-cron: The app container must receive the same value." >&2
|
|
exit 0
|
|
fi
|
|
|
|
exec /usr/local/bin/supercronic -passthrough-logs /etc/sim/crontab
|