mirror of
https://github.com/simstudioai/sim.git
synced 2026-09-01 14:59:19 +08:00
Waleed
3de63c94e3
* feat(self-host): align Docker Compose with Helm and overhaul self-hosting docs Docker Compose shipped no scheduler, so scheduled workflows, every polling trigger, connector syncs, the outbox, and data drains silently never ran. Adds a cron service running the same 18 jobs the Helm chart schedules as CronJobs, and closes the remaining behavioral gaps between the two paths: bundled Redis in the chart, no hosted plan caps in chart defaults, pinned image tags, and fail-fast secrets. A CI check keeps the schedulers in sync. Also rewrites the self-hosting docs: 14 new pages, 8 updated, reorganized into Install / Configure / Operate. * fix(self-host): drop bun install from chart CI, remove air-gapped and backup docs The scheduler-parity check pulled a full dependency install into the chart-validation job, which fails building isolated-vm on that runner. Rewritten to use only node builtins so the job installs nothing. Also removes the air-gapped and backup/restore pages, and stops pinning a concrete release in the docs so the examples do not go stale each release. * fix(helm): bundle Redis in secret-manager modes unless the URL is supplied Suppressing Redis whenever a secret mode was active left those deployments with no Redis at all — REDIS_URL is optional there and both shipped examples omit it. The chart now steps aside only on a detectable signal: an explicit app.env.REDIS_URL, an ESO remoteRefs.app.REDIS_URL mapping, or the new redis.provideUrl=false opt-out for a pre-created Secret it cannot read. * fix(compose): derive realtime BETTER_AUTH_URL from NEXT_PUBLIC_APP_URL realtime read BETTER_AUTH_URL directly and fell back to localhost while simstudio derived it from NEXT_PUBLIC_APP_URL, so setting only the public origin left realtime authenticating against http://localhost:3000. * fix(helm): deliver bundled REDIS_URL via ConfigMap so an operator value always wins Injecting REDIS_URL as an inline container env made it beat every envFrom source, so a REDIS_URL held in a pre-created Secret or synced by External Secrets was silently shadowed and traffic moved to a fresh in-cluster Redis. Kubernetes resolves duplicate envFrom keys by letting the last source win, so the bundled URL now ships as a ConfigMap listed before the app Secret. Any operator-supplied value overrides it without the chart needing to read it, which also removes the redis.provideUrl flag the previous attempt required. * docs(helm): spell out the egress rule external datastores need The default NetworkPolicy allows 443 plus the bundled Postgres and Redis by pod selector. Anything you run outside the chart on another port needs its own rule, which is easiest to miss when REDIS_URL arrives via a Secret the chart cannot inspect. Adds a copyable example to the production checklist and the security guide. * feat(helm): add networkPolicy.allowExternalEgress for managed datastores The default policy allows 443 plus the bundled Postgres and Redis by pod selector, so a managed datastore on another port needs a hand-written CIDR rule — awkward when REDIS_URL arrives via a Secret the chart cannot inspect. Adds an opt-in switch that drops the port restriction while still blocking the cloud metadata endpoints. Defaults to false, keeping this chart stricter than the common chart default of unrestricted egress.
42 lines
1.8 KiB
Docker
42 lines
1.8 KiB
Docker
# Scheduler for the Docker Compose deployment.
|
|
#
|
|
# Runs the same background jobs the Helm chart schedules as Kubernetes CronJobs,
|
|
# so both deployment paths have the same functionality. Without this service,
|
|
# scheduled workflows, polling triggers, connector syncs, the transactional
|
|
# outbox, and data drains never run.
|
|
#
|
|
# supercronic is used rather than busybox crond because it logs job output to
|
|
# stdout (crond only reaches syslog/sendmail), forwards SIGTERM to running jobs
|
|
# so `docker compose stop` is graceful, and refuses to start an iteration while
|
|
# the previous one is still running.
|
|
FROM alpine:3.21
|
|
|
|
ARG SUPERCRONIC_VERSION=v0.2.33
|
|
ARG TARGETARCH
|
|
ARG SUPERCRONIC_SHA256_amd64=feefa310da569c81b99e1027b86b27b51e6ee9ab647747b49099645120cfc671
|
|
ARG SUPERCRONIC_SHA256_arm64=f1f8585c66de020fef494dd636058f99949d108f569fef00016a1c8b9eb145b3
|
|
|
|
RUN set -eux; \
|
|
apk add --no-cache ca-certificates curl tzdata; \
|
|
case "${TARGETARCH}" in \
|
|
amd64) sha="${SUPERCRONIC_SHA256_amd64}" ;; \
|
|
arm64) sha="${SUPERCRONIC_SHA256_arm64}" ;; \
|
|
*) echo "unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
|
|
esac; \
|
|
curl -fsSLo /usr/local/bin/supercronic \
|
|
"https://github.com/aptible/supercronic/releases/download/${SUPERCRONIC_VERSION}/supercronic-linux-${TARGETARCH}"; \
|
|
echo "${sha} /usr/local/bin/supercronic" | sha256sum -c -; \
|
|
chmod +x /usr/local/bin/supercronic; \
|
|
addgroup -g 1001 -S sim; \
|
|
adduser -u 1001 -S -G sim -H sim
|
|
|
|
COPY docker/crontab /etc/sim/crontab
|
|
COPY docker/cron-entrypoint.sh /usr/local/bin/cron-entrypoint.sh
|
|
RUN chmod +x /usr/local/bin/cron-entrypoint.sh
|
|
|
|
USER 1001:1001
|
|
|
|
# The wrapper exits 0 with an actionable message when CRON_SECRET is unset,
|
|
# so an upgrade from a compose file that predates the scheduler still starts.
|
|
ENTRYPOINT ["/usr/local/bin/cron-entrypoint.sh"]
|