Sam Rolfe
7d367f7712
The 06:00 workflow is now one schedule-trigger -> Execute Command pair that runs scripts/morning-brief.sh on the host over a restricted SSH key. The earlier scan -> HTTP shape could not work: the n8n container cannot resolve the `remote` ssh alias (its ~/.ssh/config is a dangling nix symlink) and a split scan node hides scan failures before the notify node runs. - deploy/n8n-morning-brief.json: two-node workflow, scheduleTrigger v1.3 - deploy/setup-n8n-scan-key.sh: restricted (restrict,command=) trigger key - deploy/import-n8n-morning-brief.sh: import + publish + restart + verify - deploy/DEPLOYMENT.md, Makefile: document and expose both scripts (dry run) - docs/phase-7a-n8n-schedule.md: design, verification, failure drill Import into the shared n8n service still needs Sam's approval. Co-Authored-By: Paperclip <noreply@paperclip.ing>
124 lines
4.5 KiB
Markdown
124 lines
4.5 KiB
Markdown
# Deployment — Compass / NHS (school.lab.audasmedia.com.au)
|
|
|
|
Own image, own container, own port **8792**, host `.13` (nixos-desktop). Caddy
|
|
on `.35` (sam-ubuntu1) terminates TLS and proxies to `192.168.20.13:8792`.
|
|
|
|
## Ports
|
|
|
|
| Port | Service |
|
|
|---|---|
|
|
| 8792 | Compass / NHS (this project) |
|
|
|
|
## Host (.13)
|
|
|
|
1. Project folder: `/home/sam/paseo/projects/compass_teams_nhs`.
|
|
2. Data: the named volume `compass-teams-nhs_compass-teams-nhs-data` at `/data`
|
|
(SQLite `school.db`).
|
|
3. Create the environment file from the example:
|
|
|
|
```bash
|
|
cd /home/sam/paseo/projects/compass_teams_nhs
|
|
cp environment.d/school-service.env.example environment.d/school-service.env
|
|
chmod 600 environment.d/school-service.env
|
|
# fill SCHOOL_SESSION_SECRET, SCHOOL_ADMIN_PASSWORD_HASH
|
|
```
|
|
|
|
4. Build and start:
|
|
|
|
```bash
|
|
docker compose up -d --build
|
|
docker compose ps # compass-teams-nhs Up (healthy) 0.0.0.0:8792->8792/tcp
|
|
```
|
|
|
|
5. Verify:
|
|
|
|
```bash
|
|
make verify-phase1
|
|
```
|
|
|
|
## Caddy (.35)
|
|
|
|
1. SSH: `ssh sam@192.168.20.35`.
|
|
2. Append `deploy/caddy/Caddyfile.snippet` to `/Docker/Containers/caddy/Caddyfile`.
|
|
3. Validate and reload (never restart):
|
|
|
|
```bash
|
|
docker exec caddy caddy validate --config /etc/caddy/Caddyfile
|
|
docker exec caddy caddy reload --config /etc/caddy/Caddyfile
|
|
```
|
|
|
|
4. Test: `curl -sS -o /dev/null -w '%{http_code}\n' https://school.lab.audasmedia.com.au/health`
|
|
|
|
## Notes
|
|
|
|
- `.13` has every default Docker address pool subnetted out. This single-container
|
|
service therefore uses `network_mode: bridge` and publishes 8792; it does not
|
|
create a project network.
|
|
- The env file is gitignored. School credentials and harness session state are
|
|
secrets (AGENTS.md §10 rule 3); they never enter git.
|
|
|
|
## Phase 7 — notifications (Apprise)
|
|
|
|
The morning briefs are delivered through the house **Apprise** API on `.35:8210`
|
|
(container `apprise`, host port 8210 → container 8000). Caddy exposes it at
|
|
`https://apprise.lab.audasmedia.com.au` behind basic auth; the service talks to
|
|
the API directly on the internal address.
|
|
|
|
1. Create (or reuse) the Apprise **stored configuration** that holds every
|
|
destination, using these tags:
|
|
|
|
| Tag | Destination |
|
|
|---|---|
|
|
| `harry_email`, `finn_email`, `joanna_email`, `sam_email` | email |
|
|
| `harry_whatsapp`, `finn_whatsapp`, `joanna_whatsapp`, `sam_whatsapp` | WhatsApp (CallMeBot) |
|
|
|
|
2. Copy its **key** into `environment.d/school-service.env` as
|
|
`SCHOOL_APPRISE_KEY`, and generate the n8n token:
|
|
|
|
```bash
|
|
docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.5.0-phase7 gen-secret
|
|
# -> SCHOOL_NOTIFY_TOKEN=<the value>
|
|
```
|
|
|
|
3. Restart the service, then prove the whole path without messaging anyone:
|
|
|
|
```bash
|
|
make preview # prints both boys + the combined brief
|
|
curl -s -X POST -H "Authorization: Bearer $SCHOOL_NOTIFY_TOKEN" \
|
|
'http://127.0.0.1:8792/notify/morning?dry_run=1' | jq .
|
|
```
|
|
|
|
4. Send for real (this messages the family):
|
|
|
|
```bash
|
|
make notify # from the latest scan
|
|
make morning-brief # scan both children, then send
|
|
docker exec compass-teams-nhs /app/school notify status
|
|
```
|
|
|
|
5. Schedule the 06:00 daily run in n8n (Phase 7a, AUD-115):
|
|
|
|
```bash
|
|
deploy/setup-n8n-scan-key.sh --apply # restricted SSH key for the trigger
|
|
deploy/import-n8n-morning-brief.sh --apply # import + publish + restart n8n
|
|
```
|
|
|
|
The workflow has one Execute Command node: `ssh … 'scripts/morning-brief.sh'`.
|
|
It needs no `SCHOOL_NOTIFY_TOKEN` in n8n — the host script reads the project env
|
|
file. See `docs/phase-7a-n8n-schedule.md` for the design and the failure drill.
|
|
|
|
Notes:
|
|
|
|
- The destination URLs (addresses, phone numbers, SMTP passwords) live only in
|
|
the Apprise configuration. `GET /json/urls/{key}` prints `callmebot://` for a
|
|
WhatsApp entry because Apprise masks credentials in privacy mode; the entry is
|
|
real, and the container log shows `CallMeBot SUCCESS`.
|
|
- The scan stays a host step: patchright and its browser are on `.13`, not in the
|
|
service image. `scripts/morning-brief.sh` runs the scan and the send in order.
|
|
- A run that cannot deliver exits non-zero, and the endpoint answers `207`, so a
|
|
broken morning is visible in n8n instead of silent (FR-12).
|
|
- The 06:00 schedule is the n8n workflow `Compass / NHS — 6:00am morning brief`
|
|
(`deploy/n8n-morning-brief.json`), triggered over a restricted SSH key. It runs
|
|
on the shared n8n service on `.13`, so its import, publish, and the one-off n8n
|
|
restart need approval first.
|