ConusAI vendor v0.1.0-dev.20261027+9b1131fb

2026-10-27 18:05:17 +00:00
commit 3102273ec7
538 changed files with 80203 additions and 0 deletions
@@ -0,0 +1,142 @@
+# SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
+# The Convex provider provisions a backend and injects its URL/admin key; it does not deploy this
+# app's functions. The one-shot `convex-deploy` service does that from the app image, and web and
+# backup wait for it to succeed. The app's server-side BFF is the only client of the admin key.
+#
+# The tenant wall on this profile is the repository predicate plus the custom functions the
+# generated wrappers are built with (spec §5.3), proven by the kit's contract and isolation
+# suites under convex-test (@conusai-kit/data-convex).
+services:
+  web:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: runtime
+    working_dir: /app/apps/web
+    command: ["node", "node_modules/next/dist/bin/next", "start"]
+    environment:
+      NODE_ENV: production
+      PORT: "3000"
+      CONUSAI_API_URL: ${CONUSAI_API_URL}
+      CONUSAI_API_TOKEN: ${CONUSAI_API_TOKEN}
+      CONUSAI_PROJECT_ID: ${CONUSAI_PROJECT_ID}
+      CONUSAI_PUBLIC_URL: ${CONUSAI_PUBLIC_URL}
+      CONUSAI_ORG_ID: ${CONUSAI_ORG_ID}
+      CONUSAI_ORG_SLUG: ${CONUSAI_ORG_SLUG}
+      CONUSAI_RELEASE: ${CONUSAI_RELEASE}
+      CONUSAI_ENVIRONMENT: ${CONUSAI_ENVIRONMENT:-}
+      CONUSAI_DSN: ${CONUSAI_DSN:-}
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
+      OTEL_EXPORTER_OTLP_PROTOCOL: ${OTEL_EXPORTER_OTLP_PROTOCOL:-}
+      OTEL_EXPORTER_OTLP_HEADERS: ${OTEL_EXPORTER_OTLP_HEADERS:-}
+      OTEL_SERVICE_NAME: ${OTEL_SERVICE_NAME:-}
+      OTEL_SERVICE_VERSION: ${OTEL_SERVICE_VERSION:-}
+      AI_MODEL: ${AI_MODEL:-}
+      LOG_LEVEL: ${LOG_LEVEL:-}
+      CONVEX_SELF_HOSTED_URL: ${CONVEX_SELF_HOSTED_URL}
+      CONVEX_SELF_HOSTED_ADMIN_KEY: ${CONVEX_SELF_HOSTED_ADMIN_KEY}
+      AUTH_SESSION_SECRET: ${AUTH_SESSION_SECRET}
+      OIDC_ISSUER: ${OIDC_ISSUER:-}
+      OIDC_WEB_CLIENT_ID: ${OIDC_WEB_CLIENT_ID:-}
+      OIDC_WEB_CLIENT_SECRET: ${OIDC_WEB_CLIENT_SECRET:-}
+      OIDC_RESOURCE: ${OIDC_RESOURCE:-}
+      OIDC_INTROSPECTION_CLIENT_ID: ${OIDC_INTROSPECTION_CLIENT_ID:-}
+      OIDC_INTROSPECTION_CLIENT_SECRET: ${OIDC_INTROSPECTION_CLIENT_SECRET:-}
+      OIDC_RESOURCE_STATUS_URL: ${OIDC_RESOURCE_STATUS_URL:-}
+      OIDC_SCOPES: ${OIDC_SCOPES:-}
+      AUTH_PROVIDER_GENERATION: ${AUTH_PROVIDER_GENERATION:-}
+      AUTH_COOKIE_NAME: ${AUTH_COOKIE_NAME:-}
+      AUTH_SESSION_IDLE_SECONDS: ${AUTH_SESSION_IDLE_SECONDS:-}
+      AUTH_SESSION_ABSOLUTE_SECONDS: ${AUTH_SESSION_ABSOLUTE_SECONDS:-}
+      OIDC_AUDIENCE: ${OIDC_AUDIENCE:-}
+      AUTH_PROVIDER: ${AUTH_PROVIDER:-}
+      AUTH_IDENTITY_NAMESPACE: ${AUTH_IDENTITY_NAMESPACE:-}
+      # kit:convex-better-auth:begin -- Better Auth's own Convex deployment, beside the app's
+      BETTER_AUTH_CONVEX_URL: ${BETTER_AUTH_CONVEX_URL:-}
+      BETTER_AUTH_CONVEX_SITE_URL: ${BETTER_AUTH_CONVEX_SITE_URL:-}
+      BETTER_AUTH_CONVEX_ADMIN_KEY: ${BETTER_AUTH_CONVEX_ADMIN_KEY:-}
+      BETTER_AUTH_RELAY_INTERVAL_MS: ${BETTER_AUTH_RELAY_INTERVAL_MS:-}
+      # kit:convex-better-auth:end
+    expose: ["3000"]
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/api/ready').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+    init: true
+    stop_grace_period: 20s
+    depends_on:
+      convex-deploy:
+        condition: service_completed_successfully
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 768M
+
+  # The provider only provisions Convex. Push this app's schema and functions before web and
+  # backup start, and make failure block traffic instead of reporting a healthy empty backend.
+  convex-deploy:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: runtime
+    working_dir: /app
+    command: ["node", "profiles/convex/deploy.mjs"]
+    environment:
+      NODE_ENV: production
+      CONUSAI_API_URL: ${CONUSAI_API_URL}
+      CONUSAI_API_TOKEN: ${CONUSAI_API_TOKEN}
+      CONUSAI_PROJECT_ID: ${CONUSAI_PROJECT_ID}
+      CONUSAI_ORG_SLUG: ${CONUSAI_ORG_SLUG}
+      AI_MODEL: ${AI_MODEL:-}
+      DOCUMENTS_EXCLUDED_PAGE_CLASSES: ${DOCUMENTS_EXCLUDED_PAGE_CLASSES:-}
+      CONVEX_SELF_HOSTED_URL: ${CONVEX_SELF_HOSTED_URL}
+      CONVEX_SELF_HOSTED_ADMIN_KEY: ${CONVEX_SELF_HOSTED_ADMIN_KEY}
+      # kit:convex-better-auth:begin -- this job also deploys the Better Auth functions, and alone holds the secret;
+      # it installs the deployment's URL, admin key and namespace in the app's backend for the account actions
+      AUTH_PROVIDER: ${AUTH_PROVIDER:-}
+      AUTH_IDENTITY_NAMESPACE: ${AUTH_IDENTITY_NAMESPACE:-}
+      CONUSAI_PUBLIC_URL: ${CONUSAI_PUBLIC_URL}
+      BETTER_AUTH_CONVEX_URL: ${BETTER_AUTH_CONVEX_URL:-}
+      BETTER_AUTH_CONVEX_ADMIN_KEY: ${BETTER_AUTH_CONVEX_ADMIN_KEY:-}
+      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET:-}
+      # kit:convex-better-auth:end
+    restart: "no"
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 768M
+
+  # convex export is a CLI operation and cannot run from a Convex query/mutation/cron. This small
+  # sidecar schedules it outside the backend and stores archives in the platform Blob service.
+  backup:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: runtime
+    working_dir: /app
+    command: ["node", "profiles/convex/backup/runner.mjs"]
+    environment:
+      NODE_ENV: production
+      CONUSAI_API_URL: ${CONUSAI_API_URL}
+      CONUSAI_API_TOKEN: ${CONUSAI_API_TOKEN}
+      CONUSAI_PROJECT_ID: ${CONUSAI_PROJECT_ID}
+      CONVEX_SELF_HOSTED_URL: ${CONVEX_SELF_HOSTED_URL}
+      CONVEX_SELF_HOSTED_ADMIN_KEY: ${CONVEX_SELF_HOSTED_ADMIN_KEY}
+      CONVEX_BACKUP_INTERVAL_HOURS: ${CONVEX_BACKUP_INTERVAL_HOURS:-24}
+      CONVEX_BACKUP_RETENTION: ${CONVEX_BACKUP_RETENTION:-30}
+    init: true
+    stop_grace_period: 30s
+    restart: unless-stopped
+    depends_on:
+      convex-deploy:
+        condition: service_completed_successfully
+    deploy:
+      resources:
+        limits:
+          cpus: "0.5"
+          memory: 256M