glitch_automata_lab/DEPLOY.md

Deploy CA Lab Studio

Deploy this CA Lab Studio app into /opt/glitch_automata_lab on the server.

This app is the CA Lab Studio service:

• Express API at /api/ca/*
• React admin app at /admin
• React viewer/recorder routes at /view/*
• Postgres database via DATABASE_URL
• Cross-subdomain lab access via the shared gnommoweb auth_token JWT cookie

Lab Access

In production, the lab expects gnommoweb to be the identity issuer:

JWT_SECRET=...                         # same value as gnommoweb
LAB_AUTH_ENABLED=true
LAB_KEYCARD_REQUIRED=true
GNOMMOWEB_URL=https://glitch.university
LAB_KEYCARD_MERIT_SLUG=lab-keycard
LAB_USER_PROFILE_URL=https://glitch.university/api/user/profile
LAB_SIGN_IN_URL=https://glitch.university/auth/google?returnTo={returnTo}

The gnommoweb side should set auth_token with Domain=.glitch.university and expose LAB_USER_PROFILE_URL. Access is granted immediately if the verified JWT contains:

{ "merit_slug": "lab-keycard" }

If the JWT does not contain that claim, the lab calls the user profile endpoint with the same auth_token cookie and expects the profile to include:

{
  "merits": [
    { "slug": "lab-keycard" }
  ]
}

Local development keeps auth disabled unless LAB_AUTH_ENABLED=true is set.

Build

nvm use 20
npm --prefix backend ci
npm run build

The build creates:

backend/dist/server.js
backend/public/admin/index.html
backend/public/admin/assets/*

Start

DATABASE_URL=postgres://... PORT=3100 npm start

Run migrations before starting or during release:

DATABASE_URL=postgres://... npm run migrate

Docker

docker build -t ca-lab-studio .
docker run --rm -p 3100:3100 \
  -e DATABASE_URL=postgres://... \
  ca-lab-studio

The container serves the app at:

http://localhost:3100/admin
http://localhost:3100/view/decks/:deckId