lukasandClaude Opus 5
5553b5febe
Everything needed to run the app on an Intel NAS that is also doing other jobs: one published port, no host networking, memory/CPU caps and log rotation on every container, and all state in bind mounts under DATA_ROOT so mail survives image updates, project deletion in the NAS UI, and full reinstalls — and so Hyper Backup/HBS3 can actually see it. - docker/Dockerfile.backend: multi-stage, non-root (uid 10001), tini for the <10s graceful lease release. Installs the four plugins as entry-point distributions. One image, several roles via docker/entrypoint.sh (api | worker-sync | worker-jobs | migrate | reindex | plugins). - docker/Dockerfile.frontend + nginx.conf: SPA + /api reverse proxy with the WebSocket upgrade for /api/ws, and X-Forwarded-Proto preserved so the API still emits __Host-/Secure cookies when TLS is terminated by the NAS reverse proxy (identity/cookies.py keys off request scheme). - docker/docker-compose.prod.yml: project name webmail-prod, NOT webmail — docker-compose.yml (dev services) owns that name, and two compose files sharing one project name fight over each other's containers. Meilisearch is an opt-in profile; SEARCH_BACKEND=pg is the default so a small NAS pays nothing for search. - migrate runs as a one-shot (core Alembic head + every plugin branch) that everything else waits on, so a bad migration can never leave new code running against an old schema. - docker/backup.sh: nightly pg_dump verified with `pg_restore --list` before it counts as a backup, with retention and a baseline on first start. - deploy/webmail.sh: init/doctor/up/down/status/logs/update/rollback/ backup/restore/reindex/psql/shell. `update` is backup -> images -> migrate -> roll workers, api, web -> health-gate, with automatic rollback to the previous version if the gate fails. `doctor` refuses to be quiet when DATA_ROOT is on NFS/SMB (silent Postgres corruption). - deploy/build-push.sh: build images off-NAS (the frontend build wants ~2GB RAM) and push to Gitea, or --save a tar to carry over. - scripts/reindex_search.py: rebuild the search index from Postgres alone. Every SearchDoc field is already stored, so the index is derived data that never needs backing up — this closes the only real objection to running Meilisearch on a box whose volumes may be wiped. - pyproject: package-data for accounts/presets.yaml and the shared plugin Alembic env. Without it a non-editable install (i.e. any image) silently ships a package that fails at runtime. - GET /api/version, used by the deploy health gate. Verified end to end on a real stack: fresh install, all services healthy, core + 4 plugin migration branches applied, login/SPA/plugin bundles through nginx, WS upgrade returning 101, __Host- cookies under a simulated TLS proxy, backup -> restore round-trip preserving user and plugin schema, failed-update auto-rollback (both a bad migration and a boot-crashing API), and Meilisearch profile serving a live query. ruff + mypy --strict clean, 363/363 backend tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Nux3LCu4zP9nih4BRhPyHw
79 lines
4.1 KiB
Python
79 lines
4.1 KiB
Python
"""Application configuration.
|
|
|
|
SPEC §14: the complete env list is read exactly once here (pydantic-settings).
|
|
No ``os.environ`` access is permitted anywhere else in the codebase.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from functools import lru_cache
|
|
|
|
from pydantic import Field
|
|
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
"""All runtime configuration, sourced from the environment (SPEC §14)."""
|
|
|
|
model_config = SettingsConfigDict(env_file=None, extra="ignore")
|
|
|
|
app_domain: str = Field(alias="APP_DOMAIN")
|
|
database_url: str = Field(alias="DATABASE_URL")
|
|
redis_url: str = Field(alias="REDIS_URL")
|
|
master_key: str = Field(alias="MASTER_KEY") # 32 bytes, base64
|
|
|
|
blob_root: str = Field(default="./var/blobs", alias="BLOB_ROOT")
|
|
|
|
search_backend: str = Field(default="pg", alias="SEARCH_BACKEND")
|
|
meili_url: str = Field(default="http://127.0.0.1:7700", alias="MEILI_URL")
|
|
meili_key: str = Field(default="", alias="MEILI_KEY")
|
|
|
|
undo_seconds: int = Field(default=10, alias="UNDO_SECONDS")
|
|
session_ttl_days: int = Field(default=30, alias="SESSION_TTL_DAYS")
|
|
max_attachment_mb: int = Field(default=25, alias="MAX_ATTACHMENT_MB")
|
|
log_level: str = Field(default="INFO", alias="LOG_LEVEL")
|
|
# Release identifier baked into the container image at build time; surfaced
|
|
# by GET /api/version so a deploy can verify what is actually running.
|
|
app_version: str = Field(default="dev", alias="APP_VERSION")
|
|
|
|
# --- Sync engine v2 (workers layer) --------------------------------------
|
|
# Worker role: "sync" (lease-owned account runners) | "jobs" (arq consumer)
|
|
# | "all" (both, single-process dev default).
|
|
worker_role: str = Field(default="all", alias="WORKER_ROLE")
|
|
interactive_concurrency: int = Field(default=20, alias="INTERACTIVE_CONCURRENCY")
|
|
bulk_concurrency: int = Field(default=2, alias="BULK_CONCURRENCY")
|
|
# Lease protocol (§2): account ownership across sync workers.
|
|
max_accounts_per_worker: int = Field(default=400, alias="MAX_ACCOUNTS_PER_WORKER")
|
|
lease_ttl: int = Field(default=60, alias="LEASE_TTL")
|
|
lease_renew: int = Field(default=20, alias="LEASE_RENEW")
|
|
# Activity tiers (§5): hot = persistent IDLE, warm/cold = transient polls.
|
|
poll_warm: int = Field(default=180, alias="POLL_WARM")
|
|
poll_cold: int = Field(default=900, alias="POLL_COLD")
|
|
tier_hot_activity_h: int = Field(default=24, alias="TIER_HOT_ACTIVITY_H")
|
|
tier_session_grace_min: int = Field(default=30, alias="TIER_SESSION_GRACE_MIN")
|
|
tier_cold_after_d: int = Field(default=3, alias="TIER_COLD_AFTER_D")
|
|
hot_budget_per_worker: int = Field(default=250, alias="HOT_BUDGET_PER_WORKER")
|
|
# Memory/connection bounds (§7, §4): peak RAM ~= PARSE_CONCURRENCY x STREAM_PARSE_MB.
|
|
per_host_conn_cap: int = Field(default=50, alias="PER_HOST_CONN_CAP")
|
|
parse_concurrency: int = Field(default=4, alias="PARSE_CONCURRENCY")
|
|
stream_parse_mb: int = Field(default=8, alias="STREAM_PARSE_MB")
|
|
|
|
oauth_google_client_id: str = Field(default="", alias="OAUTH_GOOGLE_CLIENT_ID")
|
|
oauth_google_client_secret: str = Field(default="", alias="OAUTH_GOOGLE_CLIENT_SECRET")
|
|
oauth_ms_client_id: str = Field(default="", alias="OAUTH_MS_CLIENT_ID")
|
|
oauth_ms_client_secret: str = Field(default="", alias="OAUTH_MS_CLIENT_SECRET")
|
|
# Gates the "Sign in with Google instead" OAuth fallback in the wizard (SPEC
|
|
# §6.2.1). Off until an operator configures a verified Cloud project.
|
|
google_oauth_enabled: bool = Field(default=False, alias="GOOGLE_OAUTH_ENABLED")
|
|
# Server-side sender avatars (Gravatar + domain favicon). Fetched by the server
|
|
# (never the browser) so senders can't see the user's IP or read activity.
|
|
sender_avatars_enabled: bool = Field(default=True, alias="SENDER_AVATARS_ENABLED")
|
|
# Auto-purge Trash/Spam messages older than this many days (0 disables).
|
|
trash_retention_days: int = Field(default=30, alias="TRASH_RETENTION_DAYS")
|
|
|
|
|
|
@lru_cache(maxsize=1)
|
|
def get_settings() -> Settings:
|
|
"""Return the process-wide settings singleton."""
|
|
return Settings() # values are sourced from the environment
|