♻️(yhub) create dedicated file for environment variables in development

For now the environment variable for yhub were added to the common file.
This number of environment is growing and is specific to yhub so we
decided to create a dedicated file for yhub

.github/workflows/impress.yml

@@ -263,8 +263,13 @@ jobs:
           REDIS_PREFIX: yhub
           COLLABORATION_BACKEND_BASE_URL: http://localhost:8000
           COLLABORATION_SERVER_ORIGIN: http://localhost:3000
-          AWS_STORAGE_BUCKET_NAME: impress-media-storage
+          # the legacy Django bucket it migrates documents out of, named apart
+          # from the AWS_S3_* the job sets for django itself
           SOFT_MIGRATION: "true"
+          LEGACY_S3_ENDPOINT_URL: http://localhost:9000
+          LEGACY_S3_ACCESS_KEY_ID: impress
+          LEGACY_S3_SECRET_ACCESS_KEY: password
+          LEGACY_S3_BUCKET_NAME: impress-media-storage
         run: |
           nohup node server.js > /tmp/yhub.log 2>&1 &
           dockerize -wait tcp://localhost:3002 -timeout 30s

Makefile

@@ -88,6 +88,7 @@ create-env-local-files:
 	@touch env.d/development/postgresql.local
 	@touch env.d/development/kc_auth.local
 	@touch env.d/development/kc_postgresql.local
+	@touch env.d/development/yhub.local
 .PHONY: create-env-local-files
 
 generate-secret-keys:

compose.yml

@@ -239,18 +239,11 @@ services:
     image: impress:yhub-development
     environment:
       HOME: /tmp # same reason as node-based services above (unmapped uid)
-      PORT: 3002
-      REDIS: redis://yhub-valkey:6379
-      POSTGRES: postgres://yhub:pass@yhub-postgres:5432/yhub
-      REDIS_PREFIX: yhub
-      # seed rooms from the legacy Django/S3 document store on first access —
-      # S3 endpoint/credentials come from env.d/development/common
-      SOFT_MIGRATION: "true"
-      # signs the calls made to the backend, which holds the public half
-      YHUB_JWT_PRIVATE_KEY_FILE: /data/jwt/yhub-private.pem
+    # its own file rather than the backend's: this server reads none of the
+    # django settings `common` carries, and everything it does read is in there
     env_file:
-      - env.d/development/common
-      - env.d/development/common.local
+      - env.d/development/yhub
+      - env.d/development/yhub.local
     volumes:
       - ./data/jwt:/data/jwt:ro
       # editing a source file restarts the server (nodemon), no rebuild

env.d/development/common

@@ -37,15 +37,6 @@ AWS_S3_ACCESS_KEY_ID=impress
 AWS_S3_SECRET_ACCESS_KEY=password
 MEDIA_BASE_URL=http://localhost:8083
 
-# The same bucket, read by yhub's soft migration under names of its own: the
-# bucket the collaboration server migrates *out of* is not the one it will
-# persist *into* once the S3 persistence plugin is turned on, so it does not
-# read the backend's AWS_S3_* settings. Locally they hold the same minio, and
-# an override of the three above wants the same override here.
-LEGACY_S3_ENDPOINT_URL=http://minio:9000
-LEGACY_S3_ACCESS_KEY_ID=impress
-LEGACY_S3_SECRET_ACCESS_KEY=password
-
 # OIDC
 OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/certs
 OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8083/realms/impress/protocol/openid-connect/auth

env.d/development/yhub

@@ -0,0 +1,34 @@
+# Collaboration server (yhub)
+#
+# Everything the collaboration server reads, and nothing else: it shares the
+# backend's stores and origins by value, not by loading the backend's own
+# environment. Override any of it in yhub.local, which is not committed.
+
+# Stores. Its own valkey and its own postgres database — the backend's live
+# next to them and are never touched from here.
+PORT=3002
+REDIS=redis://yhub-valkey:6379
+POSTGRES=postgres://yhub:pass@yhub-postgres:5432/yhub
+REDIS_PREFIX=yhub
+
+# Backend. It answers who a user is and what they may do with a document, and
+# publishes the JWKS the admin tokens it signs are verified against. The origin
+# list is what a browser may open a websocket from — the frontend dev server.
+COLLABORATION_BACKEND_BASE_URL=http://app-dev:8000
+COLLABORATION_SERVER_ORIGIN=http://localhost:3000
+# sent as X-Y-Provider-Key on the calls made to the backend; the same value as
+# in `common`, which is where the backend reads the one it compares it to
+Y_PROVIDER_API_KEY=yprovider-api-key
+
+# Signs the calls made to the backend, which holds the public half. Generated
+# by `make generate-secret-keys`, never committed.
+YHUB_JWT_PRIVATE_KEY_FILE=/data/jwt/yhub-private.pem
+
+# Soft migration: seed a room from the legacy Django/S3 document store the
+# first time it is opened. The bucket read here is the backend's media one —
+# in this stack the same minio, under the credentials of this server rather
+# than the backend's own AWS_S3_* settings.
+SOFT_MIGRATION=true
+LEGACY_S3_ENDPOINT_URL=http://minio:9000
+LEGACY_S3_ACCESS_KEY_ID=impress
+LEGACY_S3_SECRET_ACCESS_KEY=password

src/yhub-server/README.md

@@ -372,8 +372,9 @@ Configuration: `LEGACY_S3_ENDPOINT_URL`, `LEGACY_S3_ACCESS_KEY_ID`,
 `LEGACY_S3_REGION_NAME`, and `LEGACY_S3_BUCKET_NAME` (defaults to Django's dev
 default `impress-media-storage`; production uses a different bucket name and
 must set it explicitly). The server refuses to boot when the flag is set
-without endpoint and credentials. In development the values arrive via
-`env.d/development/common`.
+without endpoint and credentials. In development they come, like everything
+else this server reads, from `env.d/development/yhub` (and `yhub.local`, which
+is not committed — `make create-env-local-files` creates it).
 
 The prefix is deliberate: these name **the bucket this server migrates out
 of**, which is the backend's media bucket and not the one yhub will persist