91 lines
1.9 KiB
Markdown
91 lines
1.9 KiB
Markdown
# Deploy CA Lab Studio
|
|
|
|
Deploy this CA Lab Studio app into `/opt/glitch_automata_lab` on the server.
|
|
|
|
This app is the CA Lab Studio service:
|
|
|
|
- Express API at `/api/ca/*`
|
|
- React admin app at `/admin`
|
|
- React viewer/recorder routes at `/view/*`
|
|
- Postgres database via `DATABASE_URL`
|
|
- Cross-subdomain lab access via the shared gnommoweb `auth_token` JWT cookie
|
|
|
|
## Lab Access
|
|
|
|
In production, the lab expects gnommoweb to be the identity issuer:
|
|
|
|
```env
|
|
JWT_SECRET=... # same value as gnommoweb
|
|
LAB_AUTH_ENABLED=true
|
|
LAB_KEYCARD_REQUIRED=true
|
|
GNOMMOWEB_URL=https://glitch.university
|
|
LAB_KEYCARD_MERIT_SLUG=lab-keycard
|
|
LAB_USER_PROFILE_URL=https://glitch.university/api/user/profile
|
|
LAB_SIGN_IN_URL=https://glitch.university/auth/google?returnTo={returnTo}
|
|
```
|
|
|
|
The gnommoweb side should set `auth_token` with `Domain=.glitch.university`
|
|
and expose `LAB_USER_PROFILE_URL`. Access is granted immediately if the verified
|
|
JWT contains:
|
|
|
|
```json
|
|
{ "merit_slug": "lab-keycard" }
|
|
```
|
|
|
|
If the JWT does not contain that claim, the lab calls the user profile endpoint
|
|
with the same `auth_token` cookie and expects the profile to include:
|
|
|
|
```json
|
|
{
|
|
"merits": [
|
|
{ "slug": "lab-keycard" }
|
|
]
|
|
}
|
|
```
|
|
|
|
Local development keeps auth disabled unless `LAB_AUTH_ENABLED=true` is set.
|
|
|
|
## Build
|
|
|
|
```bash
|
|
nvm use 20
|
|
npm --prefix backend ci
|
|
npm run build
|
|
```
|
|
|
|
The build creates:
|
|
|
|
```txt
|
|
backend/dist/server.js
|
|
backend/public/admin/index.html
|
|
backend/public/admin/assets/*
|
|
```
|
|
|
|
## Start
|
|
|
|
```bash
|
|
DATABASE_URL=postgres://... PORT=3100 npm start
|
|
```
|
|
|
|
Run migrations before starting or during release:
|
|
|
|
```bash
|
|
DATABASE_URL=postgres://... npm run migrate
|
|
```
|
|
|
|
## Docker
|
|
|
|
```bash
|
|
docker build -t ca-lab-studio .
|
|
docker run --rm -p 3100:3100 \
|
|
-e DATABASE_URL=postgres://... \
|
|
ca-lab-studio
|
|
```
|
|
|
|
The container serves the app at:
|
|
|
|
```txt
|
|
http://localhost:3100/admin
|
|
http://localhost:3100/view/decks/:deckId
|
|
```
|