Stage 16: deploy infra & test contour

- backend + gateway multi-stage distroless Dockerfiles; the gateway embeds and serves the SPA at / and /telegram/ via go:embed (committed dist placeholder, real build baked in by the image's node stage) - deploy/docker-compose.yml: backend + gateway + Postgres + Telegram connector (VPN sidecar) + OTel Collector + Prometheus (15d) + Tempo (72h) + Grafana, fronted by a caddy owning a single /_gm Basic-Auth (admin console + Grafana subpath); inter-service on a private network, only caddy on the edge network - new metrics: backend accounts_created_total{kind} (robots excluded) and an in-memory gateway active_users{window=24h,7d} gauge - CI: single .gitea/workflows/ci.yaml (unit/integration/ui + a gated test-contour deploy) on the new feature/* -> development -> master branch model; the old go-unit/integration/ui-test workflows are folded in; the connector-scoped compose is retired (superseded by deploy/) - docs: ARCHITECTURE §11/§12/§13, root + gateway READMEs, CLAUDE.md branching, PLAN.md (stage 16 done + refinements + Stage 17 forward-notes)
2026-06-05 11:42:26 +02:00
parent 8c8f8c4d42
commit 8700fbfae1
35 changed files with 1413 additions and 318 deletions
@@ -0,0 +1,217 @@
+# Full deploy descriptor for the Scrabble test contour: backend + gateway +
+# Postgres + the Telegram connector (with its VPN sidecar) + the observability
+# stack (OTel Collector -> Prometheus + Tempo -> Grafana). Driven by
+# .gitea/workflows/ci.yaml (`docker compose up -d --build`); env values are
+# interpolated from Gitea Actions TEST_ secrets/variables exported by the deploy
+# job (see deploy/.env.example for the unprefixed names).
+#
+# Networking (mirrors ../galaxy-game):
+#   - `internal` (scrabble-internal): all inter-service traffic, project-private
+#     DNS so service names never collide on the shared `edge` network.
+#   - `edge` (external): the host caddy reaches this contour at `scrabble:80`
+#     (the in-compose caddy's alias). The in-compose caddy terminates only HTTP in
+#     the test contour; the host caddy terminates TLS and forwards. For prod
+#     (Stage 17, no host caddy) set CADDY_SITE_ADDRESS to the domain so the caddy
+#     does its own ACME — the contour is then self-contained.
+#   - The connector egresses to api.telegram.org through the `vpn` sidecar
+#     (network_mode: service:vpn); it answers internal gRPC at `telegram:9091`.
+name: scrabble
+
+services:
+  postgres:
+    container_name: scrabble-postgres
+    image: postgres:17-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB:-scrabble}
+      POSTGRES_USER: ${POSTGRES_USER:-scrabble}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-scrabble} -d ${POSTGRES_DB:-scrabble}"]
+      interval: 5s
+      timeout: 3s
+      retries: 30
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    networks: [internal]
+
+  backend:
+    container_name: scrabble-backend
+    image: scrabble-backend:latest
+    build:
+      context: ..
+      dockerfile: backend/Dockerfile
+      args:
+        DICT_VERSION: ${DICT_VERSION:-v1.0.0}
+    restart: unless-stopped
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      # search_path=backend matches the migrations (00001 creates the schema).
+      BACKEND_POSTGRES_DSN: postgres://${POSTGRES_USER:-scrabble}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-scrabble}?sslmode=disable&search_path=backend
+      BACKEND_HTTP_ADDR: ":8080"
+      BACKEND_GRPC_ADDR: ":9090"
+      BACKEND_CONNECTOR_ADDR: telegram:9091
+      BACKEND_LOG_LEVEL: ${LOG_LEVEL:-info}
+      BACKEND_SERVICE_NAME: scrabble-backend
+      BACKEND_OTEL_TRACES_EXPORTER: otlp
+      BACKEND_OTEL_METRICS_EXPORTER: otlp
+      OTEL_EXPORTER_OTLP_ENDPOINT: http://otelcol:4317
+      OTEL_EXPORTER_OTLP_INSECURE: "true"
+    # No container healthcheck: the distroless image has no shell/wget. Readiness
+    # is covered by the CI post-deploy probe (GET / through caddy).
+    networks: [internal]
+
+  gateway:
+    container_name: scrabble-gateway
+    image: scrabble-gateway:latest
+    build:
+      context: ..
+      dockerfile: gateway/Dockerfile
+      args:
+        VITE_TELEGRAM_BOT_ID: ${VITE_TELEGRAM_BOT_ID:-}
+        VITE_TELEGRAM_LINK: ${VITE_TELEGRAM_LINK:-}
+        VITE_GATEWAY_URL: ${VITE_GATEWAY_URL:-}
+    restart: unless-stopped
+    depends_on: [backend]
+    environment:
+      GATEWAY_HTTP_ADDR: ":8081"
+      GATEWAY_BACKEND_HTTP_URL: http://backend:8080
+      GATEWAY_BACKEND_GRPC_ADDR: backend:9090
+      GATEWAY_CONNECTOR_ADDR: telegram:9091
+      GATEWAY_DEFAULT_SUPPORTED_LANGUAGES: ${GATEWAY_DEFAULT_SUPPORTED_LANGUAGES:-en,ru}
+      GATEWAY_LOG_LEVEL: ${LOG_LEVEL:-info}
+      GATEWAY_SERVICE_NAME: scrabble-gateway
+      GATEWAY_OTEL_TRACES_EXPORTER: otlp
+      GATEWAY_OTEL_METRICS_EXPORTER: otlp
+      OTEL_EXPORTER_OTLP_ENDPOINT: http://otelcol:4317
+      OTEL_EXPORTER_OTLP_INSECURE: "true"
+      # GATEWAY_ADMIN_* intentionally unset: in the deployed contour the front
+      # caddy owns the /_gm Basic-Auth and routes /_gm to the backend directly.
+    networks: [internal]
+
+  # --- Telegram connector (egress via the VPN sidecar) -----------------------
+  vpn:
+    container_name: scrabble-telegram-vpn
+    image: docker.iliadenisov.ru/developer/amneziawg-sidecar:latest
+    restart: unless-stopped
+    privileged: true
+    environment:
+      AWG_CONF: ${AWG_CONF:?set AWG_CONF}
+    networks:
+      internal:
+        aliases: [telegram]
+
+  telegram:
+    container_name: scrabble-telegram
+    image: scrabble-telegram:latest
+    build:
+      context: ..
+      dockerfile: platform/telegram/Dockerfile
+    restart: unless-stopped
+    depends_on: [vpn]
+    network_mode: "service:vpn"
+    environment:
+      # The bot tokens live ONLY in this container (ARCHITECTURE.md §12). At least
+      # one token is required (the connector validates this at boot).
+      TELEGRAM_BOT_TOKEN_EN: ${TELEGRAM_BOT_TOKEN_EN:-}
+      TELEGRAM_BOT_TOKEN_RU: ${TELEGRAM_BOT_TOKEN_RU:-}
+      TELEGRAM_GAME_CHANNEL_ID_EN: ${TELEGRAM_GAME_CHANNEL_ID_EN:-}
+      TELEGRAM_GAME_CHANNEL_ID_RU: ${TELEGRAM_GAME_CHANNEL_ID_RU:-}
+      TELEGRAM_MINIAPP_URL: ${TELEGRAM_MINIAPP_URL:?set TELEGRAM_MINIAPP_URL}
+      TELEGRAM_GRPC_ADDR: ":9091"
+      TELEGRAM_TEST_ENV: ${TELEGRAM_TEST_ENV:-false}
+      TELEGRAM_API_BASE_URL: ${TELEGRAM_API_BASE_URL:-}
+      TELEGRAM_LOG_LEVEL: ${LOG_LEVEL:-info}
+      TELEGRAM_SERVICE_NAME: scrabble-telegram
+      TELEGRAM_OTEL_TRACES_EXPORTER: otlp
+      TELEGRAM_OTEL_METRICS_EXPORTER: otlp
+      OTEL_EXPORTER_OTLP_ENDPOINT: http://otelcol:4317
+      OTEL_EXPORTER_OTLP_INSECURE: "true"
+
+  # --- Edge reverse proxy (single /_gm Basic-Auth; SPA + Connect -> gateway) --
+  caddy:
+    container_name: scrabble-caddy
+    image: caddy:2-alpine
+    restart: unless-stopped
+    depends_on: [gateway, backend, grafana]
+    environment:
+      # Test: ":80" (host caddy terminates TLS). Prod: a domain for own ACME.
+      CADDY_SITE_ADDRESS: ${CADDY_SITE_ADDRESS:-:80}
+      GM_BASICAUTH_USER: ${GM_BASICAUTH_USER:-gm}
+      GM_BASICAUTH_HASH: ${GM_BASICAUTH_HASH:?set GM_BASICAUTH_HASH}
+    volumes:
+      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy-data:/data
+    networks:
+      internal: {}
+      edge:
+        aliases: [scrabble]
+
+  # --- Observability ---------------------------------------------------------
+  otelcol:
+    container_name: scrabble-otelcol
+    image: otel/opentelemetry-collector-contrib:0.119.0
+    restart: unless-stopped
+    command: ["--config=/etc/otelcol/config.yaml"]
+    volumes:
+      - ./otelcol/config.yaml:/etc/otelcol/config.yaml:ro
+    networks: [internal]
+
+  prometheus:
+    container_name: scrabble-prometheus
+    image: prom/prometheus:v2.55.1
+    restart: unless-stopped
+    command:
+      - --config.file=/etc/prometheus/prometheus.yml
+      - --storage.tsdb.retention.time=15d
+    volumes:
+      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - prometheus-data:/prometheus
+    networks: [internal]
+
+  tempo:
+    container_name: scrabble-tempo
+    image: grafana/tempo:2.7.1
+    restart: unless-stopped
+    command: ["-config.file=/etc/tempo/tempo.yaml"]
+    volumes:
+      - ./tempo/tempo.yaml:/etc/tempo/tempo.yaml:ro
+      - tempo-data:/var/tempo
+    networks: [internal]
+
+  grafana:
+    container_name: scrabble-grafana
+    image: grafana/grafana:11.4.0
+    restart: unless-stopped
+    depends_on: [prometheus, tempo]
+    environment:
+      # Served under /_gm/grafana behind caddy's Basic-Auth; anonymous Admin so a
+      # single shared login (caddy) gates it with no per-user Grafana accounts.
+      GF_SERVER_ROOT_URL: ${GRAFANA_ROOT_URL:-/_gm/grafana/}
+      GF_SERVER_SERVE_FROM_SUB_PATH: "true"
+      GF_AUTH_ANONYMOUS_ENABLED: "true"
+      GF_AUTH_ANONYMOUS_ORG_ROLE: Admin
+      GF_AUTH_DISABLE_LOGIN_FORM: "true"
+      GF_AUTH_BASIC_ENABLED: "false"
+      GF_USERS_ALLOW_SIGN_UP: "false"
+      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-admin}
+    volumes:
+      - ./grafana/provisioning:/etc/grafana/provisioning:ro
+      - ./grafana/dashboards:/var/lib/grafana/dashboards:ro
+      - grafana-data:/var/lib/grafana
+    networks: [internal]
+
+networks:
+  internal:
+    name: scrabble-internal
+  edge:
+    external: true
+
+volumes:
+  postgres-data:
+  caddy-data:
+  prometheus-data:
+  tempo-data:
+  grafana-data: