infra: consolidate Optovia deployment on Earth

.gitea/workflows/deploy-arangodb.yaml

@@ -11,5 +11,10 @@ jobs:
   deploy:
     runs-on: builder
     steps:
-      - name: Deploy to Dokploy
-        run: curl -fsS -X POST "https://ind.dsrptlab.com/api/deploy/UxegrxKBzx_UZYNSU9EaF"
+      - name: Deploy in Dokploy
+        env:
+          DOKPLOY_DEPLOY_WEBHOOK: ${{ secrets.DOKPLOY_WEBHOOK_ARANGODB }}
+        run: |
+          set -euo pipefail
+          test -n "$DOKPLOY_DEPLOY_WEBHOOK"
+          curl -fsS -X POST "$DOKPLOY_DEPLOY_WEBHOOK"

.gitea/workflows/deploy-hatchet.yaml

@@ -11,5 +11,11 @@ jobs:
   deploy:
     runs-on: builder
     steps:
-      - name: Deploy to Dokploy
-        run: curl -fsS -X POST "https://ind.dsrptlab.com/api/deploy/Geut4YPhbpjh05_SCwoX-"
+      - name: Deploy in Dokploy
+        env:
+          DOKPLOY_DEPLOY_WEBHOOK: ${{ secrets.DOKPLOY_DEPLOY_WEBHOOK_HATCHET }}
+        run: |
+          set -euo pipefail
+          test -n "$DOKPLOY_DEPLOY_WEBHOOK"
+          curl -fsS -X POST "$DOKPLOY_DEPLOY_WEBHOOK"
+

.gitea/workflows/deploy-logto.yaml

@@ -11,5 +11,11 @@ jobs:
   deploy:
     runs-on: builder
     steps:
-      - name: Deploy to Dokploy
-        run: curl -fsS -X POST "https://ind.dsrptlab.com/api/deploy/vStlZzdKkL8_LIXg8y7uj"
+      - name: Deploy in Dokploy
+        env:
+          DOKPLOY_DEPLOY_WEBHOOK: ${{ secrets.DOKPLOY_DEPLOY_WEBHOOK_LOGTO }}
+        run: |
+          set -euo pipefail
+          test -n "$DOKPLOY_DEPLOY_WEBHOOK"
+          curl -fsS -X POST "$DOKPLOY_DEPLOY_WEBHOOK"
+

.gitea/workflows/deploy-vault.yaml

@@ -1,6 +1,7 @@
-name: Deploy Vault compose
+name: Build and deploy Vault image
 
 on:
+  workflow_dispatch:
   push:
     branches: [main]
     paths:
@@ -8,8 +9,28 @@ on:
       - ".gitea/workflows/deploy-vault.yaml"
 
 jobs:
-  deploy:
+  build:
     runs-on: builder
+    env:
+      IMAGE: gitea.dsrptlab.com/optovia/optovia/vault
     steps:
-      - name: Deploy to Dokploy
-        run: curl -fsS -X POST "https://ind.dsrptlab.com/api/deploy/n0vB6Uw7uwPANo9qTZDFu"
+      - uses: actions/checkout@v4
+
+      - name: Build and publish
+        run: |
+          set -euo pipefail
+          docker build -f vault/Dockerfile -t "$IMAGE:latest" -t "$IMAGE:${{ gitea.sha }}" vault
+          docker push "$IMAGE:latest"
+          docker push "$IMAGE:${{ gitea.sha }}"
+
+      - name: Remove local image tags
+        run: docker image rm -f "$IMAGE:latest" "$IMAGE:${{ gitea.sha }}"
+
+      - name: Deploy in Dokploy
+        env:
+          DOKPLOY_DEPLOY_WEBHOOK: ${{ secrets.DOKPLOY_DEPLOY_WEBHOOK_VAULT }}
+        run: |
+          set -euo pipefail
+          test -n "$DOKPLOY_DEPLOY_WEBHOOK"
+          curl -fsS -X POST "$DOKPLOY_DEPLOY_WEBHOOK"
+

arangodb/docker-compose.yml

@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   arangodb:
-    image: arangodb:3.12.4
+    image: arangodb:3.12.9.4
     restart: unless-stopped
     expose:
       - "8529"

deploy-map.toml

@@ -1,22 +1,33 @@
 version = 1
 
 [services]
-"landing" = { deploy_mode = "dokploy_webhook", server = "ind", repo = "optovia/landing", dokploy_app = "landing", build_path = "/" }
-"flutter-client" = { deploy_mode = "dokploy_webhook", server = "ind", repo = "optovia/flutter-client", dokploy_app = "flutter-client", build_path = "/" }
-"flutter-admin" = { deploy_mode = "dokploy_webhook", server = "ind", repo = "optovia/flutter-admin", dokploy_app = "flutter-admin", build_path = "/" }
-hatchet = { deploy_mode = "dokploy_webhook", server = "ind", repo = "optovia/optovia", dokploy_app = "hatchet", build_path = "/hatchet/" }
-logto = { deploy_mode = "dokploy_webhook", server = "ind", repo = "optovia/optovia", dokploy_app = "logto", build_path = "/logto/" }
-arangodb = { deploy_mode = "dokploy_webhook", server = "ind", repo = "optovia/optovia", dokploy_app = "arangodb", build_path = "/arangodb/" }
-"backends/logistics" = { deploy_mode = "dokploy_webhook", server = "ind", repo = "optovia/logistics", dokploy_app = "logistics", build_path = "/" }
-"workers/logistics-graph" = { deploy_mode = "dokploy_webhook", server = "ind", repo = "optovia/logistics", dokploy_app = "logistics-graph-worker", build_path = "/", dockerfile = "Dockerfile.worker" }
-"backends/exchange" = { deploy_mode = "dokploy_webhook", server = "ind", repo = "optovia/exchange", dokploy_app = "exchange", build_path = "/" }
-"backends/geo" = { deploy_mode = "dokploy_webhook", server = "ind", repo = "optovia/geo", dokploy_app = "geo", build_path = "/" }
-"backends/orders" = { deploy_mode = "dokploy_webhook", server = "ind", repo = "optovia/orders", dokploy_app = "orders", build_path = "/" }
-"backends/teams" = { deploy_mode = "dokploy_webhook", server = "ind", repo = "optovia/teams", dokploy_app = "teams", build_path = "/" }
-"backends/kyc" = { deploy_mode = "dokploy_webhook", server = "ind", repo = "optovia/kyc", dokploy_app = "kyc", build_path = "/" }
-"backends/billing" = { deploy_mode = "dokploy_webhook", server = "ind", repo = "optovia/billing", dokploy_app = "billing", build_path = "/" }
-vault = { deploy_mode = "dokploy_webhook", server = "ind", repo = "optovia/optovia", dokploy_app = "vault", build_path = "/vault/" }
+landing = { deploy_mode = "gitea_ci_dokploy", server = "earth", repo = "optovia/landing", dokploy_service = "application", dokploy_application_id = "4BD7hR3huYbodd13cbPFU", image = "gitea.dsrptlab.com/optovia/landing/landing:latest", domain = "optovia-landing-gnkeci-b88915-84-247-183-52.sslip.io" }
+"flutter-client" = { deploy_mode = "gitea_ci_dokploy", server = "earth", repo = "optovia/flutter-client", dokploy_service = "application", dokploy_application_id = "eHIpepSnF0fJuEQLP9nit", image = "gitea.dsrptlab.com/optovia/flutter-client/flutter-client:latest", domain = "optovia-flutter-client-ndjhml-de632d-84-247-183-52.sslip.io" }
+"flutter-admin" = { deploy_mode = "gitea_ci_dokploy", server = "earth", repo = "optovia/flutter-admin", dokploy_service = "application", dokploy_application_id = "yP3aRNxiygVQ64zVYIFQA", image = "gitea.dsrptlab.com/optovia/flutter-admin/flutter-admin:latest", domain = "optovia-flutter-admin-hkznh6-1b437d-84-247-183-52.sslip.io" }
+hatchet = { deploy_mode = "dokploy_webhook", server = "earth", repo = "optovia/optovia", dokploy_service = "compose", dokploy_compose_id = "GRtnRFl-iUpIU5Pljb2G2", compose_path = "./hatchet/docker-compose.yml", domain = "optovia-hatchet-4b7e21-84-247-183-52.sslip.io" }
+logto = { deploy_mode = "dokploy_webhook", server = "earth", repo = "optovia/optovia", dokploy_service = "compose", dokploy_compose_id = "bKzSt8Ezczy5CQ3dS2Q51", compose_path = "./logto/docker-compose.yml", domain = "optovia-logto-2f7c8a-84-247-183-52.sslip.io", admin_domain = "optovia-logto-admin-2f7c8a-84-247-183-52.sslip.io" }
+arangodb = { deploy_mode = "dokploy_webhook", server = "earth", repo = "optovia/optovia", dokploy_service = "compose", dokploy_compose_id = "pWhd_1AnWkk2VcpD2GQXs", compose_path = "./arangodb/docker-compose.yml" }
+"backends/logistics" = { deploy_mode = "gitea_ci_dokploy", server = "earth", repo = "optovia/logistics", dokploy_service = "application", dokploy_application_id = "ctdkd1ASBMi-oUWVa1zq-", image = "gitea.dsrptlab.com/optovia/logistics/logistics:latest", domain = "optovia-logistics-hp1qcw-ef5762-84-247-183-52.sslip.io" }
+"workers/logistics-graph" = { deploy_mode = "gitea_ci_dokploy", server = "earth", repo = "optovia/logistics", dokploy_service = "application", dokploy_application_id = "8oS4ovLY6IeymC21R-yzF", image = "gitea.dsrptlab.com/optovia/logistics/logistics-graph-worker:latest", dockerfile = "Dockerfile.worker" }
+"backends/exchange" = { deploy_mode = "gitea_ci_dokploy", server = "earth", repo = "optovia/exchange", dokploy_service = "application", dokploy_application_id = "KB23Tmvtg9Ir71pruvmq9", image = "gitea.dsrptlab.com/optovia/exchange/exchange:latest", domain = "optovia-exchange-uql51z-7c1de8-84-247-183-52.sslip.io" }
+"backends/geo" = { deploy_mode = "gitea_ci_dokploy", server = "earth", repo = "optovia/geo", dokploy_service = "application", dokploy_application_id = "-d4WgbtlQEzWgdtx1GSmx", image = "gitea.dsrptlab.com/optovia/geo/geo:latest", domain = "optovia-geo-d53zh4-369676-84-247-183-52.sslip.io" }
+"backends/orders" = { deploy_mode = "gitea_ci_dokploy", server = "earth", repo = "optovia/orders", dokploy_service = "application", dokploy_application_id = "DfZiP6i80KibCfsryAjIK", image = "gitea.dsrptlab.com/optovia/orders/orders:latest", domain = "optovia-orders-eqaehq-674185-84-247-183-52.sslip.io" }
+"backends/teams" = { deploy_mode = "gitea_ci_dokploy", server = "earth", repo = "optovia/teams", dokploy_service = "application", dokploy_application_id = "RW5bqNvbO6_sktOBcgGIb", image = "gitea.dsrptlab.com/optovia/teams/teams:latest", domain = "optovia-teams-zaclti-41a457-84-247-183-52.sslip.io" }
+"backends/kyc" = { deploy_mode = "gitea_ci_dokploy", server = "earth", repo = "optovia/kyc", dokploy_service = "application", dokploy_application_id = "V0ORbyY_pI3bS2pFTlFR4", image = "gitea.dsrptlab.com/optovia/kyc/kyc:latest", domain = "optovia-kyc-ulbkrr-98703e-84-247-183-52.sslip.io" }
+"backends/billing" = { deploy_mode = "gitea_ci_dokploy", server = "earth", repo = "optovia/billing", dokploy_service = "application", dokploy_application_id = "DiAKSGTCYOhFKt-EOaNeM", image = "gitea.dsrptlab.com/optovia/billing/billing:latest", domain = "optovia-billing-iarnzb-fd77f3-84-247-183-52.sslip.io" }
+vault = { deploy_mode = "gitea_ci_dokploy", server = "earth", repo = "optovia/optovia", dokploy_service = "application", dokploy_application_id = "1Y9KedlVOPxbtFlh2AtiS", image = "gitea.dsrptlab.com/optovia/optovia/vault:latest" }
+
+[databases]
+billing = { server = "earth", type = "postgres", dokploy_id = "pVuA844_Bzl8HcuiSp3kc", version = "18" }
+exchange = { server = "earth", type = "postgres", dokploy_id = "4nWEYYf1JGHabInA8-qAs", version = "18" }
+kyc = { server = "earth", type = "postgres", dokploy_id = "ciZFd1pjL2085am4QHy95", version = "18" }
+orders = { server = "earth", type = "postgres", dokploy_id = "iOKQBdFXCyYMq29fBWSpj", version = "18" }
+teams = { server = "earth", type = "postgres", dokploy_id = "55lVwhnWtmYZnE8eWpfXg", version = "18" }
+logto = { server = "earth", type = "postgres", dokploy_id = "GMbuNJAwuby2OZg_6srWh", version = "18" }
+
+[dokploy]
+project_id = "zrJl5NcD0VN31pS6RJkWB"
+environment_id = "5DZoUct4aqa9St7iE8K8M"
 
 [servers]
-main = { tailscale_user = "root", tailscale_name = "dsrptlab", dokploy_environment_id = "CtFrl9k1kpYrNrAMc1Fnf" }
-ind = { tailscale_user = "root", tailscale_name = "ind", dokploy_environment_id = "hQO7byqFgbXe62dYDJIbI" }
+earth = { tailscale_user = "root", tailscale_name = "earth", dokploy_url = "https://earth.dsrptlab.com" }

hatchet/docker-compose.yml

@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   postgres:
-    image: postgres:15.6
+    image: postgres:18.6
     command: postgres -c 'max_connections=200'
     restart: unless-stopped
     environment:
@@ -12,7 +12,7 @@ services:
     expose:
       - "5432"
     volumes:
-      - postgres_data:/var/lib/postgresql/data
+      - postgres_data:/var/lib/postgresql
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -d hatchet -U hatchet"]
       interval: 10s

logto/docker-compose.yml

@@ -7,7 +7,7 @@ volumes:
 
 services:
   logto:
-    image: ghcr.io/logto-io/logto:1.40.0
+    image: ghcr.io/logto-io/logto:1.41.0
     restart: unless-stopped
     entrypoint: ["sh", "-c", "npm run cli db seed -- --swe && npm start"]
     expose:

vault/entrypoint.sh

@@ -4,7 +4,11 @@ set -e
 export VAULT_ADDR="http://127.0.0.1:8200"
 
 get_status_json() {
-  vault status -format=json 2>/dev/null || true
+  status_code=0
+  vault status -format=json 2>/dev/null || status_code=$?
+  if [ "${status_code:-0}" -ne 0 ] && [ "${status_code:-0}" -ne 2 ]; then
+    return "$status_code"
+  fi
 }
 
 read_flag() {
@@ -13,18 +17,6 @@ read_flag() {
   printf '%s' "$json" | tr -d '\n' | sed -n "s/.*\"$key\":[[:space:]]*\\(true\\|false\\).*/\\1/p" | head -n1
 }
 
-extract_unseal_from_init_json() {
-  file="$1"
-  [ -f "$file" ] || return 0
-  tr -d '\n' < "$file" | sed -n 's/.*"unseal_keys_b64":[[:space:]]*\[[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1
-}
-
-extract_root_from_init_json() {
-  file="$1"
-  [ -f "$file" ] || return 0
-  tr -d '\n' < "$file" | sed -n 's/.*"root_token"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1
-}
-
 ensure_secret_mount() {
   token="$1"
   if VAULT_TOKEN="$token" vault secrets list -format=json | tr -d '\n' | grep -q '"secret/"'; then
@@ -51,10 +43,10 @@ if [ "$INIT_FLAG" = "false" ]; then
   echo "Vault is not initialized, running operator init..."
   INIT_JSON="$(vault operator init -key-shares=1 -key-threshold=1 -format=json)"
   printf '%s' "$INIT_JSON" > /vault/data/init.json
-  chmod 600 /vault/data/init.json || true
+  chmod 600 /vault/data/init.json
 
   UNSEAL_KEY="$(printf '%s' "$INIT_JSON" | tr -d '\n' | sed -n 's/.*"unseal_keys_b64":[[:space:]]*\[[[:space:]]*"\([^"]*\)".*/\1/p')"
-  ROOT_TOKEN="$(printf '%s' "$INIT_JSON" | tr -d '\n' | sed -n 's/.*"root_token":"\([^"]*\)".*/\1/p')"
+  ROOT_TOKEN="$(printf '%s' "$INIT_JSON" | tr -d '\n' | sed -n 's/.*"root_token"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
 
   if [ -n "$UNSEAL_KEY" ]; then
     vault operator unseal "$UNSEAL_KEY" >/dev/null
@@ -65,35 +57,25 @@ if [ "$INIT_FLAG" = "false" ]; then
     exit 1
   fi
 
-  BOOTSTRAP_TOKEN="${VAULT_BOOTSTRAP_TOKEN:-}"
+  BOOTSTRAP_TOKEN="${VAULT_BOOTSTRAP_TOKEN:?VAULT_BOOTSTRAP_TOKEN is required}"
+  [ -n "$ROOT_TOKEN" ] || { echo "Vault initialized, but failed to parse root token."; exit 1; }
   ensure_secret_mount "$ROOT_TOKEN"
-  if [ -n "$BOOTSTRAP_TOKEN" ] && [ -n "$ROOT_TOKEN" ]; then
   echo "Ensuring bootstrap token exists..."
   if ! VAULT_TOKEN="$ROOT_TOKEN" vault token lookup "$BOOTSTRAP_TOKEN" >/dev/null 2>&1; then
     VAULT_TOKEN="$ROOT_TOKEN" vault token create -id="$BOOTSTRAP_TOKEN" -policy=root -orphan >/dev/null
   fi
-  fi
 
   wait $VAULT_PID
   exit $?
 fi
 
 if [ "$SEALED_FLAG" = "true" ]; then
-  UNSEAL_KEYS_RAW="${VAULT_UNSEAL_KEYS:-${VAULT_UNSEAL_KEY:-}}"
-  if [ -z "$UNSEAL_KEYS_RAW" ] && [ -f /vault/data/init.json ]; then
-    UNSEAL_KEYS_RAW="$(extract_unseal_from_init_json /vault/data/init.json)"
-  fi
-
-  if [ -z "$UNSEAL_KEYS_RAW" ]; then
-    echo "Vault is sealed but no unseal keys were found (env or /vault/data/init.json)."
-    kill $VAULT_PID || true
-    exit 1
-  fi
+  UNSEAL_KEYS_RAW="${VAULT_UNSEAL_KEYS:-${VAULT_UNSEAL_KEY:?VAULT_UNSEAL_KEY or VAULT_UNSEAL_KEYS is required}}"
 
   echo "Vault is sealed; applying unseal keys..."
   for key in $(printf '%s' "$UNSEAL_KEYS_RAW" | tr ',;' ' '); do
     [ -n "$key" ] || continue
-    vault operator unseal "$key" >/dev/null || true
+    vault operator unseal "$key" >/dev/null
     STATUS_JSON="$(get_status_json)"
     SEALED_FLAG="$(read_flag "$STATUS_JSON" sealed)"
     if [ "$SEALED_FLAG" = "false" ]; then
@@ -113,20 +95,12 @@ else
   echo "Vault is already unsealed."
 fi
 
-ROOT_TOKEN=""
-if [ -f /vault/data/init.json ]; then
-  ROOT_TOKEN="$(extract_root_from_init_json /vault/data/init.json)"
-fi
-BOOTSTRAP_TOKEN="${VAULT_BOOTSTRAP_TOKEN:-}"
-if [ -n "$ROOT_TOKEN" ]; then
+ROOT_TOKEN="${VAULT_ROOT_TOKEN:?VAULT_ROOT_TOKEN is required}"
+BOOTSTRAP_TOKEN="${VAULT_BOOTSTRAP_TOKEN:?VAULT_BOOTSTRAP_TOKEN is required}"
 ensure_secret_mount "$ROOT_TOKEN"
-  if [ -n "$BOOTSTRAP_TOKEN" ]; then
 echo "Ensuring bootstrap token exists..."
-    if VAULT_TOKEN="$ROOT_TOKEN" vault token lookup "$BOOTSTRAP_TOKEN" >/dev/null 2>&1; then
-      VAULT_TOKEN="$ROOT_TOKEN" vault token revoke "$BOOTSTRAP_TOKEN" >/dev/null
-    fi
+if ! VAULT_TOKEN="$ROOT_TOKEN" vault token lookup "$BOOTSTRAP_TOKEN" >/dev/null 2>&1; then
   VAULT_TOKEN="$ROOT_TOKEN" vault token create -id="$BOOTSTRAP_TOKEN" -policy=root -orphan >/dev/null
 fi
-fi
 
 wait $VAULT_PID