M2c-dev: development compose stack, backup job, Firebase setup docs

infra/dev: compose stack on the Mac (server kvitt-server:dev, on-demand backup), .env.example, build/up/logs/backup/copy-google-services scripts. No Caddy, no TLS (debug builds accept http to private LAN addresses, AC-2.8). Bind-mounted data. infra/backup: alpine 3.24.2 image and backup.sh (SPEC 10.9; Drive upload skipped when RCLONE_FOLDER_ID is empty). infra/README.md for the dev stack and Firebase. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-17 21:18:36 +02:00
parent 5e1be38364
commit c885aba313
13 changed files with 523 additions and 0 deletions
@@ -0,0 +1,86 @@
+# Kvitt development stack on the owner's Mac (SPEC §10 "Development first", D-001).
+# Not the Pi stack: that is infra/compose.yaml, built by M2c-pi.
+#
+# No Caddy and no TLS here: debug builds accept http:// to private LAN addresses (AC-2.8), so the
+# server publishes its own port on the Mac. Release builds never talk to this stack.
+#
+# Use the scripts next to this file (see infra/README.md):
+#   infra/dev/build.sh    build kvitt-server:dev (from server/Dockerfile) and kvitt-backup:dev
+#   infra/dev/up.sh       start the server, wait for /health, print the LAN URL
+#   infra/dev/logs.sh     follow the logs
+#   infra/dev/backup.sh   run the backup job once (local snapshot, no Drive upload)
+# Relative paths below resolve against this directory (infra/dev/).
+
+name: kvitt-dev
+
+x-logging: &logging
+  driver: json-file
+  options:
+    max-size: "10m"
+    max-file: "3"
+
+services:
+  server:
+    image: ${KVITT_SERVER_IMAGE:-kvitt-server:dev}
+    command: ["serve"]
+    restart: unless-stopped
+    user: "10001:10001"
+    read_only: true
+    cap_drop: [ALL]
+    security_opt:
+      - no-new-privileges:true
+    mem_limit: 160m
+    ports:
+      # The only published port of the dev stack; reachable from the phone on the home Wi-Fi.
+      - "${KVITT_DEV_PORT:-8080}:8080"
+    environment:
+      TZ: Europe/Stockholm
+      KVITT_DATA_DIR: /data
+      KVITT_BIND: 0.0.0.0:8080
+      # Invite links and the landing page point here; up.sh fills it from the Mac's LAN address when empty.
+      KVITT_PUBLIC_URL: ${KVITT_PUBLIC_URL:-http://localhost:8080}
+      KVITT_FCM_CREDENTIALS: /secrets/fcm-service-account.json
+      KVITT_FCM_PROJECT_ID: ${KVITT_FCM_PROJECT_ID:-kvitt-1337}
+      RUST_LOG: ${RUST_LOG:-info}
+    volumes:
+      # SQLite database, pictures and APKs: a bind-mounted folder on the Mac (git-ignored).
+      - ${KVITT_DEV_DATA_DIR:-./data}:/data
+      # The secrets folder, read-only, so the server finds /secrets/fcm-service-account.json (git-ignored).
+      # The folder is mounted rather than the file: a missing source file would make Docker create a directory
+      # in its place, while a missing key must simply leave push disabled with a start-up warning (§10.4).
+      - ${KVITT_SECRETS_DIR:-../secrets}:/secrets:ro
+    healthcheck:
+      test: ["CMD", "kvitt-server", "healthcheck"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    logging: *logging
+    networks: [kvitt]
+
+  backup:
+    image: ${KVITT_BACKUP_IMAGE:-kvitt-backup:dev}
+    # On demand only: `docker compose run --rm backup /backup.sh` (infra/dev/backup.sh). `up` skips it.
+    profiles: [backup]
+    command: ["/backup.sh"]
+    restart: "no"
+    # Same uid as the server, so it can open the WAL database files the server owns.
+    user: "10001:10001"
+    cap_drop: [ALL]
+    security_opt:
+      - no-new-privileges:true
+    mem_limit: 96m
+    environment:
+      TZ: Europe/Stockholm
+      # Empty on the dev stack: the Drive upload is skipped and the local files are kept (§10.9, D-001).
+      RCLONE_FOLDER_ID: ""
+      RCLONE_REMOTE: ${RCLONE_REMOTE:-gdrive:}
+    volumes:
+      - ${KVITT_DEV_DATA_DIR:-./data}:/data
+      - ${KVITT_DEV_BACKUP_DIR:-./backups}:/backups
+    logging: *logging
+    networks: [kvitt]
+
+networks:
+  kvitt:
+    driver: bridge