query/apphosting.yaml at main · DataScience-GT/query · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
# Monorepo — the deployed app is sites/mainweb (workspace name: web).
# There is no sites/portal; the portal is a route group inside mainweb.

# Schema first, then the app. `push` applies additive changes; anything
# destructive stops for a confirmation that </dev/null cannot give, so it aborts
# rather than dropping a column. push exits 0 even then, so `db:check` is the
# real gate — it fails the build if any declared column is still missing.
scripts:
  buildCommand: pnpm install && pnpm --filter @query/db exec drizzle-kit push --verbose < /dev/null && pnpm --filter @query/db db:check && pnpm turbo run build --filter=web && mkdir -p sites/mainweb/.next/standalone/sites/mainweb/.next && cp -r sites/mainweb/.next/static sites/mainweb/.next/standalone/sites/mainweb/.next/static && (cp -r sites/mainweb/public sites/mainweb/.next/standalone/sites/mainweb/public || true)
  runCommand: node sites/mainweb/.next/standalone/sites/mainweb/server.js

runConfig:
  runtime: nodejs20
  concurrency: 80
  cpu: 2
  memoryMiB: 1024
  minInstances: 0
  maxInstances: 10

env:
  - variable: PORT
    value: "8080"
  - variable: HOSTNAME
    value: "0.0.0.0"
  # BUILD too, for the schema push above. Grant the build service account
  # access once:
  #   firebase apphosting:secrets:grantaccess DATABASE_URL --backend query
  - variable: DATABASE_URL
    secret: DATABASE_URL
    availability:
      - BUILD
      - RUNTIME
  - variable: AUTH_SECRET
    secret: AUTH_SECRET
  - variable: NEXTAUTH_SECRET
    secret: AUTH_SECRET
  - variable: GOOGLE_CLIENT_ID
    secret: AUTH_GOOGLE_ID
  - variable: GOOGLE_CLIENT_SECRET
    secret: AUTH_GOOGLE_SECRET
  # GitHub sign-in. The provider is only registered when BOTH of these are
  # present (packages/auth/src/config.ts), so until the secrets exist the
  # login page hides the button rather than offering one that cannot work.
  # Callback URL to register on the GitHub OAuth app:
  #   https://datasciencegt.org/api/auth/callback/github
  - variable: GITHUB_CLIENT_ID
    secret: AUTH_GITHUB_ID
  - variable: GITHUB_CLIENT_SECRET
    secret: AUTH_GITHUB_SECRET
  - variable: AUTH_URL
    value: https://datasciencegt.org
  - variable: NEXTAUTH_URL
    value: https://datasciencegt.org
  - variable: STRIPE_SECRET_KEY
    secret: projects/672446353769/secrets/STRIPE_SECRET_KEY
  - variable: NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY
    secret: projects/672446353769/secrets/NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY
  - variable: STRIPE_WEBHOOK_SECRET
    secret: projects/672446353769/secrets/STRIPE_WEBHOOK_SECRET
  - variable: NODE_ENV
    value: production
  # Consumer Gmail, which caps around 500 recipients a day — shared between
  # sign-in codes and every acceptance or announcement send. Acceptance waves
  # are capped at 500 for that reason. Moving to a real provider is these three
  # values plus the secret, and no code change:
  #   HOST -> email-smtp.<region>.amazonaws.com | smtp.postmarkapp.com | smtp.sendgrid.net
  #   USER -> the provider's SMTP username (not an address)
  #   EMAIL_SERVER_PASSWORD secret -> the provider's SMTP password
  # EMAIL_FROM must then be an address on a domain verified with that provider.
  - variable: EMAIL_SERVER_HOST
    value: smtp.gmail.com
  - variable: EMAIL_SERVER_PORT
    value: "587"
  - variable: EMAIL_SERVER_USER
    value: datascience.gt@gmail.com
  - variable: EMAIL_SERVER_PASSWORD
    secret: projects/672446353769/secrets/EMAIL_SERVER_PASSWORD
  - variable: EMAIL_FROM
    value: datascience.gt@gmail.com
  # Flood-protection thresholds, sized per instance for a full venue.
  # These are the ceiling for one signed-in person, not for the building —
  # the limiter keys on user id when somebody is signed in. The short block
  # duration bounds a false positive to a page refresh rather than locking
  # an attendee out for five minutes in the middle of a workshop.
  - variable: DDOS_BURST_THRESHOLD
    value: "3000"
  - variable: DDOS_MAX_REQUESTS_PER_MINUTE
    value: "20000"
  - variable: DDOS_SUSPICIOUS_THRESHOLD
    value: "14000"
  - variable: DDOS_BLOCK_DURATION_MS
    value: "30000"
  # Proxies between the client and this process that append to
  # X-Forwarded-For. Set explicitly rather than left to the code default so
  # the value is reviewable here. Cloud Run behind Google's load balancer is
  # 1; if a CDN is added in front, this becomes 2 — and getting it wrong is
  # silent. The process logs the observed header shape once at startup
  # ("[Security] x-forwarded-for has N entries"); expect hops = entries - 1.
  - variable: TRUSTED_PROXY_HOPS
    value: "1"