From e9f0ef3cfc04fbcece1702d8ed2ebc3c5bfc65e4 Mon Sep 17 00:00:00 2001 From: Manuel Raynaud Date: Fri, 14 Aug 2026 10:57:04 +0200 Subject: [PATCH] =?UTF-8?q?=E2=99=BB=EF=B8=8F(yhub)=20create=20dedicated?= =?UTF-8?q?=20file=20for=20environment=20variables=20in=20development?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit For now the environment variable for yhub were added to the common file. This number of environment is growing and is specific to yhub so we decided to create a dedicated file for yhub --- .github/workflows/impress.yml | 7 ++++++- Makefile | 1 + compose.yml | 15 ++++----------- env.d/development/common | 9 --------- env.d/development/yhub | 34 ++++++++++++++++++++++++++++++++++ src/yhub-server/README.md | 5 +++-- 6 files changed, 48 insertions(+), 23 deletions(-) create mode 100644 env.d/development/yhub diff --git a/.github/workflows/impress.yml b/.github/workflows/impress.yml index f9c13f2a0..593c30c8b 100644 --- a/.github/workflows/impress.yml +++ b/.github/workflows/impress.yml @@ -263,8 +263,13 @@ jobs: REDIS_PREFIX: yhub COLLABORATION_BACKEND_BASE_URL: http://localhost:8000 COLLABORATION_SERVER_ORIGIN: http://localhost:3000 - AWS_STORAGE_BUCKET_NAME: impress-media-storage + # the legacy Django bucket it migrates documents out of, named apart + # from the AWS_S3_* the job sets for django itself SOFT_MIGRATION: "true" + LEGACY_S3_ENDPOINT_URL: http://localhost:9000 + LEGACY_S3_ACCESS_KEY_ID: impress + LEGACY_S3_SECRET_ACCESS_KEY: password + LEGACY_S3_BUCKET_NAME: impress-media-storage run: | nohup node server.js > /tmp/yhub.log 2>&1 & dockerize -wait tcp://localhost:3002 -timeout 30s diff --git a/Makefile b/Makefile index 5753f4475..603fe4d91 100644 --- a/Makefile +++ b/Makefile @@ -88,6 +88,7 @@ create-env-local-files: @touch env.d/development/postgresql.local @touch env.d/development/kc_auth.local @touch env.d/development/kc_postgresql.local + @touch env.d/development/yhub.local .PHONY: create-env-local-files generate-secret-keys: diff --git a/compose.yml b/compose.yml index 8b50c94f7..9850b2921 100644 --- a/compose.yml +++ b/compose.yml @@ -239,18 +239,11 @@ services: image: impress:yhub-development environment: HOME: /tmp # same reason as node-based services above (unmapped uid) - PORT: 3002 - REDIS: redis://yhub-valkey:6379 - POSTGRES: postgres://yhub:pass@yhub-postgres:5432/yhub - REDIS_PREFIX: yhub - # seed rooms from the legacy Django/S3 document store on first access — - # S3 endpoint/credentials come from env.d/development/common - SOFT_MIGRATION: "true" - # signs the calls made to the backend, which holds the public half - YHUB_JWT_PRIVATE_KEY_FILE: /data/jwt/yhub-private.pem + # its own file rather than the backend's: this server reads none of the + # django settings `common` carries, and everything it does read is in there env_file: - - env.d/development/common - - env.d/development/common.local + - env.d/development/yhub + - env.d/development/yhub.local volumes: - ./data/jwt:/data/jwt:ro # editing a source file restarts the server (nodemon), no rebuild diff --git a/env.d/development/common b/env.d/development/common index 954128b04..4b09afab7 100644 --- a/env.d/development/common +++ b/env.d/development/common @@ -37,15 +37,6 @@ AWS_S3_ACCESS_KEY_ID=impress AWS_S3_SECRET_ACCESS_KEY=password MEDIA_BASE_URL=http://localhost:8083 -# The same bucket, read by yhub's soft migration under names of its own: the -# bucket the collaboration server migrates *out of* is not the one it will -# persist *into* once the S3 persistence plugin is turned on, so it does not -# read the backend's AWS_S3_* settings. Locally they hold the same minio, and -# an override of the three above wants the same override here. -LEGACY_S3_ENDPOINT_URL=http://minio:9000 -LEGACY_S3_ACCESS_KEY_ID=impress -LEGACY_S3_SECRET_ACCESS_KEY=password - # OIDC OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/realms/impress/protocol/openid-connect/certs OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8083/realms/impress/protocol/openid-connect/auth diff --git a/env.d/development/yhub b/env.d/development/yhub new file mode 100644 index 000000000..39aff425c --- /dev/null +++ b/env.d/development/yhub @@ -0,0 +1,34 @@ +# Collaboration server (yhub) +# +# Everything the collaboration server reads, and nothing else: it shares the +# backend's stores and origins by value, not by loading the backend's own +# environment. Override any of it in yhub.local, which is not committed. + +# Stores. Its own valkey and its own postgres database — the backend's live +# next to them and are never touched from here. +PORT=3002 +REDIS=redis://yhub-valkey:6379 +POSTGRES=postgres://yhub:pass@yhub-postgres:5432/yhub +REDIS_PREFIX=yhub + +# Backend. It answers who a user is and what they may do with a document, and +# publishes the JWKS the admin tokens it signs are verified against. The origin +# list is what a browser may open a websocket from — the frontend dev server. +COLLABORATION_BACKEND_BASE_URL=http://app-dev:8000 +COLLABORATION_SERVER_ORIGIN=http://localhost:3000 +# sent as X-Y-Provider-Key on the calls made to the backend; the same value as +# in `common`, which is where the backend reads the one it compares it to +Y_PROVIDER_API_KEY=yprovider-api-key + +# Signs the calls made to the backend, which holds the public half. Generated +# by `make generate-secret-keys`, never committed. +YHUB_JWT_PRIVATE_KEY_FILE=/data/jwt/yhub-private.pem + +# Soft migration: seed a room from the legacy Django/S3 document store the +# first time it is opened. The bucket read here is the backend's media one — +# in this stack the same minio, under the credentials of this server rather +# than the backend's own AWS_S3_* settings. +SOFT_MIGRATION=true +LEGACY_S3_ENDPOINT_URL=http://minio:9000 +LEGACY_S3_ACCESS_KEY_ID=impress +LEGACY_S3_SECRET_ACCESS_KEY=password diff --git a/src/yhub-server/README.md b/src/yhub-server/README.md index e427cf918..cad57347d 100644 --- a/src/yhub-server/README.md +++ b/src/yhub-server/README.md @@ -372,8 +372,9 @@ Configuration: `LEGACY_S3_ENDPOINT_URL`, `LEGACY_S3_ACCESS_KEY_ID`, `LEGACY_S3_REGION_NAME`, and `LEGACY_S3_BUCKET_NAME` (defaults to Django's dev default `impress-media-storage`; production uses a different bucket name and must set it explicitly). The server refuses to boot when the flag is set -without endpoint and credentials. In development the values arrive via -`env.d/development/common`. +without endpoint and credentials. In development they come, like everything +else this server reads, from `env.d/development/yhub` (and `yhub.local`, which +is not committed — `make create-env-local-files` creates it). The prefix is deliberate: these name **the bucket this server migrates out of**, which is the backend's media bucket and not the one yhub will persist