v0.34.0: containerize for per-PR preview environments (flotilla SPEC §15)

2026-06-01 06:51:22 -07:00
parent 97ba3ae9b5
commit 0252e40527
9 changed files with 292 additions and 2 deletions
@@ -0,0 +1,49 @@
+# Preview environment shape (flotilla SPEC §15) — TEST values only.
+#
+# These are the env vars a per-PR preview boots with. The operator loads them
+# into flotilla's PREVIEW overlay layer (NOT the base overlay, NOT secrets):
+#
+#     while IFS='=' read -r k v; do
+#       [ -n "$k" ] && case "$k" in \#*) ;; *) \
+#         ohm-rfc-app-flotilla overlay set ohm-rfc-app "$k=$v" --preview ;; esac
+#     done < deploy/preview/preview.env.example
+#
+# CRITICAL (§15 / §3 invariant 1): a preview resolves ZERO real secret bytes.
+# Every value here is synthetic or a documented public test value. None is a
+# real credential. Do NOT bind real `secret_refs` for previews.
+
+# --- Turnstile: Cloudflare's documented ALWAYS-PASS test keys (public) -------
+# Site key is also baked into the image at build time (Dockerfile ARG); the
+# secret key here makes server-side verification always succeed.
+CLOUDFLARE_TURNSTILE_SECRET=1x0000000000000000000000000000000AA
+VITE_TURNSTILE_SITE_KEY=1x00000000000000000000AA
+
+# --- Email: a catch-all SMTP sink (run Mailpit/Inbucket as a sidecar/service)-
+# No mail leaves the preview; everything lands in the sink's web UI.
+SMTP_HOST=mailpit
+SMTP_PORT=1025
+SMTP_STARTTLS=0
+SMTP_PASSWORD=preview-sink-no-auth
+EMAIL_FROM=preview@preview.invalid
+EMAIL_FROM_NAME=RFC App (preview)
+
+# --- Analytics: no-op'd -------------------------------------------------------
+VITE_AMPLITUDE_API_KEY=
+
+# --- App identity / required env (synthetic) ---------------------------------
+# These satisfy backend/app/config.py's required vars with non-secret test
+# values. SECRET_KEY is a throwaway — sessions in an ephemeral preview need a
+# key, not a SECRET one. GITEA_* point at whatever read surface the preview
+# uses; for a content-light framework-PR preview the seeded synthetic DB
+# carries the visible state and Gitea need not be reachable.
+SECRET_KEY=preview-throwaway-not-a-secret-0000000000
+GITEA_URL=https://git.wiggleverse.org
+GITEA_BOT_USER=preview-bot
+GITEA_BOT_TOKEN=preview-not-a-real-token
+GITEA_ORG=preview
+GITEA_WEBHOOK_SECRET=preview-webhook-not-a-secret
+OAUTH_CLIENT_ID=preview-oauth-client
+OAUTH_CLIENT_SECRET=preview-oauth-not-a-secret
+# APP_URL: set to the Cloud Run service URL once `preview up` reports it, if the
+# app's OAuth redirect / absolute-URL building needs it for your review flow.
+APP_URL=http://localhost:8080