Sam Rolfe
4950755b3d
Imported the SSH credential and schoolMorningBrf, published it, restarted n8n once, and confirmed the activation log line (no Unrecognized node type). A hand run through the published workflow finished green and delivered 8/8 (Harry, Finn, combined Jo + Sam). Record the evidence and the N8N_RUNNERS_BROKER_PORT workaround for 'n8n execute'.
129 lines
4.9 KiB
Markdown
129 lines
4.9 KiB
Markdown
# Deployment — Compass / NHS (school.lab.audasmedia.com.au)
|
|
|
|
Own image, own container, own port **8792**, host `.13` (nixos-desktop). Caddy
|
|
on `.35` (sam-ubuntu1) terminates TLS and proxies to `192.168.20.13:8792`.
|
|
|
|
## Ports
|
|
|
|
| Port | Service |
|
|
|---|---|
|
|
| 8792 | Compass / NHS (this project) |
|
|
|
|
## Host (.13)
|
|
|
|
1. Project folder: `/home/sam/paseo/projects/compass_teams_nhs`.
|
|
2. Data: the named volume `compass-teams-nhs_compass-teams-nhs-data` at `/data`
|
|
(SQLite `school.db`).
|
|
3. Create the environment file from the example:
|
|
|
|
```bash
|
|
cd /home/sam/paseo/projects/compass_teams_nhs
|
|
cp environment.d/school-service.env.example environment.d/school-service.env
|
|
chmod 600 environment.d/school-service.env
|
|
# fill SCHOOL_SESSION_SECRET, SCHOOL_ADMIN_PASSWORD_HASH
|
|
```
|
|
|
|
4. Build and start:
|
|
|
|
```bash
|
|
docker compose up -d --build
|
|
docker compose ps # compass-teams-nhs Up (healthy) 0.0.0.0:8792->8792/tcp
|
|
```
|
|
|
|
5. Verify:
|
|
|
|
```bash
|
|
make verify-phase1
|
|
```
|
|
|
|
## Caddy (.35)
|
|
|
|
1. SSH: `ssh sam@192.168.20.35`.
|
|
2. Append `deploy/caddy/Caddyfile.snippet` to `/Docker/Containers/caddy/Caddyfile`.
|
|
3. Validate and reload (never restart):
|
|
|
|
```bash
|
|
docker exec caddy caddy validate --config /etc/caddy/Caddyfile
|
|
docker exec caddy caddy reload --config /etc/caddy/Caddyfile
|
|
```
|
|
|
|
4. Test: `curl -sS -o /dev/null -w '%{http_code}\n' https://school.lab.audasmedia.com.au/health`
|
|
|
|
## Notes
|
|
|
|
- `.13` has every default Docker address pool subnetted out. This single-container
|
|
service therefore uses `network_mode: bridge` and publishes 8792; it does not
|
|
create a project network.
|
|
- The env file is gitignored. School credentials and harness session state are
|
|
secrets (AGENTS.md §10 rule 3); they never enter git.
|
|
|
|
## Phase 7 — notifications (Apprise)
|
|
|
|
The morning briefs are delivered through the house **Apprise** API on `.35:8210`
|
|
(container `apprise`, host port 8210 → container 8000). Caddy exposes it at
|
|
`https://apprise.lab.audasmedia.com.au` behind basic auth; the service talks to
|
|
the API directly on the internal address.
|
|
|
|
1. Create (or reuse) the Apprise **stored configuration** that holds every
|
|
destination, using these tags:
|
|
|
|
| Tag | Destination |
|
|
|---|---|
|
|
| `harry_email`, `finn_email`, `joanna_email`, `sam_email` | email |
|
|
| `harry_whatsapp`, `finn_whatsapp`, `joanna_whatsapp`, `sam_whatsapp` | WhatsApp (CallMeBot) |
|
|
|
|
2. Copy its **key** into `environment.d/school-service.env` as
|
|
`SCHOOL_APPRISE_KEY`, and generate the n8n token:
|
|
|
|
```bash
|
|
docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.5.0-phase7 gen-secret
|
|
# -> SCHOOL_NOTIFY_TOKEN=<the value>
|
|
```
|
|
|
|
3. Restart the service, then prove the whole path without messaging anyone:
|
|
|
|
```bash
|
|
make preview # prints both boys + the combined brief
|
|
curl -s -X POST -H "Authorization: Bearer $SCHOOL_NOTIFY_TOKEN" \
|
|
'http://127.0.0.1:8792/notify/morning?dry_run=1' | jq .
|
|
```
|
|
|
|
4. Send for real (this messages the family):
|
|
|
|
```bash
|
|
make notify # from the latest scan
|
|
make morning-brief # scan both children, then send
|
|
docker exec compass-teams-nhs /app/school notify status
|
|
```
|
|
|
|
5. Schedule the 06:00 daily run in n8n (Phase 7a, AUD-115):
|
|
|
|
```bash
|
|
deploy/setup-n8n-scan-key.sh --apply # restricted SSH key for the trigger
|
|
deploy/import-n8n-morning-brief.sh --apply # credential + workflow + publish + restart n8n
|
|
```
|
|
|
|
The workflow is Schedule Trigger -> SSH node -> a Code check that makes a
|
|
non-zero exit red. The SSH node authenticates with the restricted key and runs
|
|
`scripts/morning-brief.sh` on the host. (n8n 2.x disables the Execute Command
|
|
node by default, so a command node cannot activate.) It needs no
|
|
`SCHOOL_NOTIFY_TOKEN` in n8n — the host script reads the project env file. See
|
|
`docs/phase-7a-n8n-schedule.md` for the design and the failure drill.
|
|
|
|
Notes:
|
|
|
|
- The destination URLs (addresses, phone numbers, SMTP passwords) live only in
|
|
the Apprise configuration. `GET /json/urls/{key}` prints `callmebot://` for a
|
|
WhatsApp entry because Apprise masks credentials in privacy mode; the entry is
|
|
real, and the container log shows `CallMeBot SUCCESS`.
|
|
- The scan stays a host step: patchright and its browser are on `.13`, not in the
|
|
service image. `scripts/morning-brief.sh` runs the scan and the send in order.
|
|
- A run that cannot deliver exits non-zero, and the endpoint answers `207`, so a
|
|
broken morning is visible in n8n instead of silent (FR-12).
|
|
- The 06:00 schedule is the n8n workflow `Compass / NHS — 6:00am morning brief`
|
|
(`deploy/n8n-morning-brief.json`), triggered over a restricted SSH key. It runs
|
|
on the shared n8n service on `.13`. Sam approved plan revision 2 and the workflow
|
|
was imported, published, and activated on 2026-10-16; the first automatic run is
|
|
06:00 on 2026-10-17. n8n 2.x disables the Execute Command node by default, so the
|
|
workflow uses the SSH node plus a Code check that fails the run on a non-zero exit.
|