mirror of
https://github.com/dograh-hq/dograh.git
synced 2026-06-28 08:49:42 +02:00
feat(scripts): free trusted HTTPS via sslip.io for public-IP remote i… (#460)
* feat(scripts): free trusted HTTPS via sslip.io for public-IP remote installs Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: refactor setup scripts * chore: generate sdk * chore: fix messaging for setup_remote script * fix: fix ffmpeg download url * feat: centralise and simplify the url configuration * fix: force script run as sudo * fix: fix documentation --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Abhishek
GitHub
parent
3309face2c
commit
78427817a6
30 changed files with 838 additions and 392 deletions
|
|
@ -59,56 +59,53 @@ RUN npm ci --omit=dev && npm cache clean --force
|
|||
# Stage 3: Static ffmpeg binary (avoids apt ffmpeg pulling mesa/libllvm for
|
||||
# hardware acceleration we don't use server-side).
|
||||
#
|
||||
# Resilient download: johnvansickle.com is the primary source but it's a single
|
||||
# self-hosted host with no CDN and goes down intermittently. Use bounded-timeout
|
||||
# retries, then fall back to a pinned BtbN/FFmpeg-Builds autobuild. Every archive
|
||||
# is SHA256-verified before extraction. The two sources have different internal
|
||||
# layouts, so locate the binaries with `find` rather than a fixed strip path.
|
||||
# Source: BtbN/FFmpeg-Builds, served from GitHub's release-assets CDN (fast,
|
||||
# highly available, multi-arch). We pin a specific build for reproducibility,
|
||||
# but to a *month-end* autobuild tag — not a daily one. BtbN prunes daily
|
||||
# autobuilds after ~2 weeks (the previous pin was a daily tag and started
|
||||
# 404ing once GC'd), but keeps one month-end snapshot per month long-term
|
||||
# (~2 years back). A dated tag's assets are immutable, so the per-arch sha256
|
||||
# below never rots: builds stay reproducible AND integrity-verified.
|
||||
#
|
||||
# To upgrade ffmpeg: bump BTBN_TAG + BTBN_REV to a newer month-end autobuild
|
||||
# and refresh the two sha256s. No download needed — read tag, revision and
|
||||
# per-asset sha256 straight from the GitHub release-asset metadata:
|
||||
# gh api repos/BtbN/FFmpeg-Builds/releases/tags/<tag> \
|
||||
# --jq '.assets[] | select(.name|test("(linux64|linuxarm64)-gpl\\.tar\\.xz$")) | "\(.name) \(.digest)"'
|
||||
#
|
||||
# `--speed-limit/--speed-time` aborts a *stalled* transfer after 30s of <1KB/s
|
||||
# (the cause of "stuck" builds) without killing a slow-but-progressing
|
||||
# download; `--max-time` is a hard backstop; `--retry` rides out transient CDN
|
||||
# hiccups. The archive nests binaries under bin/, so locate them with `find`.
|
||||
FROM debian:trixie-slim AS ffmpeg-static
|
||||
ARG TARGETARCH
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
curl ca-certificates xz-utils \
|
||||
&& rm -rf /var/lib/apt/lists/* \
|
||||
&& case "${TARGETARCH}" in \
|
||||
amd64) \
|
||||
primary_url="https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz" ; \
|
||||
primary_sha256="abda8d77ce8309141f83ab8edf0596834087c52467f6badf376a6a2a4c87cf67" ; \
|
||||
fallback_url="https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-05-30-13-19/ffmpeg-N-124681-gb8c5376eb4-linux64-gpl.tar.xz" ; \
|
||||
fallback_sha256="6cfd689ee95ff128e89080af10c93f16e48760eb2acc124c5c8258dc922cc13b" ; \
|
||||
;; \
|
||||
arm64) \
|
||||
primary_url="https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-arm64-static.tar.xz" ; \
|
||||
primary_sha256="f4149bb2b0784e30e99bdda85471c9b5930d3402014e934a5098b41d0f7201b1" ; \
|
||||
fallback_url="https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-05-30-13-19/ffmpeg-N-124681-gb8c5376eb4-linuxarm64-gpl.tar.xz" ; \
|
||||
fallback_sha256="b90a31f1d0b030f5d8a3d11cfec736e369bd5a1371b19bf65421a07f72b1d547" ; \
|
||||
;; \
|
||||
*) echo "unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
|
||||
esac \
|
||||
&& mkdir -p /tmp/ffmpeg \
|
||||
&& ok= \
|
||||
&& for source in \
|
||||
"primary ${primary_sha256} ${primary_url}" \
|
||||
"fallback ${fallback_sha256} ${fallback_url}" ; do \
|
||||
source_name="${source%% *}" ; \
|
||||
source_data="${source#* }" ; \
|
||||
sha256="${source_data%% *}" ; \
|
||||
url="${source_data#* }" ; \
|
||||
echo "Downloading ffmpeg (${source_name}) from ${url}" ; \
|
||||
if curl -fsSL --connect-timeout 20 --max-time 300 \
|
||||
--retry 3 --retry-delay 5 --retry-all-errors \
|
||||
-o /tmp/ffmpeg.tar.xz "${url}" \
|
||||
&& echo "${sha256} /tmp/ffmpeg.tar.xz" | sha256sum -c - ; then ok=1 ; break ; fi ; \
|
||||
rm -f /tmp/ffmpeg.tar.xz ; \
|
||||
echo "ffmpeg source failed, trying next: ${url}" >&2 ; \
|
||||
done \
|
||||
&& [ -n "${ok}" ] || { echo "all ffmpeg download sources failed" >&2 ; exit 1 ; } \
|
||||
&& tar -xJf /tmp/ffmpeg.tar.xz -C /tmp/ffmpeg \
|
||||
&& ffmpeg_bin="$(find /tmp/ffmpeg -type f -name ffmpeg | head -n1)" \
|
||||
&& ffprobe_bin="$(find /tmp/ffmpeg -type f -name ffprobe | head -n1)" \
|
||||
&& [ -n "${ffmpeg_bin}" ] && [ -n "${ffprobe_bin}" ] \
|
||||
&& mv "${ffmpeg_bin}" "${ffprobe_bin}" /usr/local/bin/ \
|
||||
&& chmod +x /usr/local/bin/ffmpeg /usr/local/bin/ffprobe \
|
||||
&& rm -rf /tmp/ffmpeg /tmp/ffmpeg.tar.xz
|
||||
ARG BTBN_TAG=autobuild-2026-05-31-13-22
|
||||
ARG BTBN_REV=N-124714-g49a77d37be
|
||||
RUN set -eu ; \
|
||||
apt-get update && apt-get install -y --no-install-recommends \
|
||||
curl ca-certificates xz-utils ; \
|
||||
rm -rf /var/lib/apt/lists/* ; \
|
||||
case "${TARGETARCH}" in \
|
||||
amd64) btbn_arch=linux64 ; \
|
||||
sha256=ee052121296e6479325e09c6097d48e72a4af472d18c2b94388b5405dcde6cce ;; \
|
||||
arm64) btbn_arch=linuxarm64 ; \
|
||||
sha256=e97545305043794cdf7b698d713e29291464e0c35bb8e0f3ff1f62e4c56eedd6 ;; \
|
||||
*) echo "unsupported TARGETARCH: ${TARGETARCH}" >&2 ; exit 1 ;; \
|
||||
esac ; \
|
||||
url="https://github.com/BtbN/FFmpeg-Builds/releases/download/${BTBN_TAG}/ffmpeg-${BTBN_REV}-${btbn_arch}-gpl.tar.xz" ; \
|
||||
mkdir -p /tmp/ffmpeg ; cd /tmp/ffmpeg ; \
|
||||
echo "Downloading ffmpeg (${BTBN_TAG}) from ${url}" ; \
|
||||
curl -fsSL --connect-timeout 20 --speed-limit 1024 --speed-time 30 \
|
||||
--max-time 600 --retry 3 --retry-delay 5 --retry-all-errors \
|
||||
-o ffmpeg.tar.xz "${url}" ; \
|
||||
echo "${sha256} ffmpeg.tar.xz" | sha256sum -c - ; \
|
||||
tar -xJf ffmpeg.tar.xz ; \
|
||||
ffmpeg_bin="$(find /tmp/ffmpeg -type f -name ffmpeg | head -n1)" ; \
|
||||
ffprobe_bin="$(find /tmp/ffmpeg -type f -name ffprobe | head -n1)" ; \
|
||||
[ -n "${ffmpeg_bin}" ] && [ -n "${ffprobe_bin}" ] ; \
|
||||
mv "${ffmpeg_bin}" "${ffprobe_bin}" /usr/local/bin/ ; \
|
||||
chmod +x /usr/local/bin/ffmpeg /usr/local/bin/ffprobe ; \
|
||||
rm -rf /tmp/ffmpeg
|
||||
|
||||
# Stage 4: Runtime - Minimal image with only runtime dependencies
|
||||
FROM python:3.13-slim AS runner
|
||||
|
|
|
|||
|
|
@ -19,7 +19,23 @@ LANGFUSE_PUBLIC_KEY = os.getenv("LANGFUSE_PUBLIC_KEY")
|
|||
LANGFUSE_SECRET_KEY = os.getenv("LANGFUSE_SECRET_KEY")
|
||||
|
||||
# URLs for deployment
|
||||
BACKEND_API_ENDPOINT = os.getenv("BACKEND_API_ENDPOINT", "http://localhost:8000")
|
||||
#
|
||||
# PUBLIC_BASE_URL is the single canonical origin a deployment is reached at
|
||||
# (scheme + host, e.g. https://203-0-113-10.sslip.io). For a standard single-host
|
||||
# install it is the only endpoint value an operator sets — the per-subsystem URLs
|
||||
# below derive from it (and from PUBLIC_HOST for the TURN/ICE host). Each derived
|
||||
# var can still be set explicitly to override it for a split deployment.
|
||||
PUBLIC_BASE_URL = os.getenv("PUBLIC_BASE_URL") or None
|
||||
PUBLIC_HOST = os.getenv("PUBLIC_HOST") or None
|
||||
|
||||
# Public URL the backend builds webhook/callback/embed links from. Derives from
|
||||
# PUBLIC_BASE_URL (public IP / domain), falling back to localhost for local dev.
|
||||
# When this is a non-public address (localhost or a private/reserved IP) the host
|
||||
# isn't reachable from the internet, so get_backend_endpoints() resolves a running
|
||||
# Cloudflare tunnel's URL at runtime instead (see api/utils/common.py).
|
||||
BACKEND_API_ENDPOINT = (
|
||||
os.getenv("BACKEND_API_ENDPOINT") or PUBLIC_BASE_URL or "http://localhost:8000"
|
||||
)
|
||||
UI_APP_URL = os.getenv("UI_APP_URL", "http://localhost:3010")
|
||||
|
||||
DATABASE_URL = os.environ["DATABASE_URL"]
|
||||
|
|
@ -44,7 +60,12 @@ ENABLE_AWS_S3 = os.getenv("ENABLE_AWS_S3", "false").lower() == "true"
|
|||
|
||||
# MinIO Configuration
|
||||
MINIO_ENDPOINT = os.getenv("MINIO_ENDPOINT", "localhost:9000")
|
||||
MINIO_PUBLIC_ENDPOINT = os.getenv("MINIO_PUBLIC_ENDPOINT")
|
||||
# Full URL (scheme + host) browsers use to reach object storage. Derives from
|
||||
# PUBLIC_BASE_URL (remote nginx proxies /voice-audio/ to MinIO); set explicitly
|
||||
# only to point object storage at a separate origin.
|
||||
MINIO_PUBLIC_ENDPOINT = (
|
||||
os.getenv("MINIO_PUBLIC_ENDPOINT") or PUBLIC_BASE_URL or "http://localhost:9000"
|
||||
)
|
||||
MINIO_ACCESS_KEY = os.getenv("MINIO_ACCESS_KEY", "minioadmin")
|
||||
MINIO_SECRET_KEY = os.getenv("MINIO_SECRET_KEY", "minioadmin")
|
||||
MINIO_BUCKET = os.getenv("MINIO_BUCKET", "voice-audio")
|
||||
|
|
@ -84,7 +105,7 @@ LOG_LEVEL = os.getenv("LOG_LEVEL", "DEBUG").upper()
|
|||
LOG_ROTATION_SIZE = os.getenv("LOG_ROTATION_SIZE", "100 MB")
|
||||
LOG_RETENTION = os.getenv("LOG_RETENTION", "7 days")
|
||||
LOG_COMPRESSION = os.getenv("LOG_COMPRESSION", "gz")
|
||||
ENABLE_TELEMETRY = os.getenv("ENABLE_TELEMETRY", "false").lower() == "true"
|
||||
ENABLE_TELEMETRY = os.getenv("ENABLE_TELEMETRY", "true").lower() == "true"
|
||||
|
||||
|
||||
def _get_version() -> str:
|
||||
|
|
@ -149,7 +170,9 @@ DEFAULT_CIRCUIT_BREAKER_CONFIG = {
|
|||
|
||||
|
||||
TURN_SECRET = os.getenv("TURN_SECRET")
|
||||
TURN_HOST = os.getenv("TURN_HOST", "localhost")
|
||||
# Host browsers dial for TURN/ICE. Derives from PUBLIC_HOST; set explicitly only
|
||||
# when the TURN server runs on a separate host from the app.
|
||||
TURN_HOST = os.getenv("TURN_HOST") or PUBLIC_HOST or "localhost"
|
||||
TURN_PORT = int(os.getenv("TURN_PORT", "3478"))
|
||||
TURN_TLS_PORT = int(os.getenv("TURN_TLS_PORT", "5349"))
|
||||
TURN_CREDENTIAL_TTL = int(os.getenv("TURN_CREDENTIAL_TTL", "86400"))
|
||||
|
|
|
|||
|
|
@ -68,6 +68,10 @@ class HealthResponse(BaseModel):
|
|||
status: str
|
||||
version: str
|
||||
backend_api_endpoint: str
|
||||
# Public URL the deployment is reachable at when it sits behind a Cloudflare
|
||||
# tunnel (the host has no public IP). null for a directly-reachable deployment.
|
||||
# The UI shows this so operators know the URL telephony providers should call.
|
||||
tunnel_url: str | None = None
|
||||
deployment_mode: str
|
||||
auth_provider: str
|
||||
turn_enabled: bool
|
||||
|
|
@ -84,21 +88,34 @@ async def health() -> HealthResponse:
|
|||
from api.constants import (
|
||||
APP_VERSION,
|
||||
AUTH_PROVIDER,
|
||||
BACKEND_API_ENDPOINT,
|
||||
DEPLOYMENT_MODE,
|
||||
FORCE_TURN_RELAY,
|
||||
STACK_AUTH_PROJECT_ID,
|
||||
STACK_PUBLISHABLE_CLIENT_KEY,
|
||||
TURN_SECRET,
|
||||
)
|
||||
from api.utils.common import get_backend_endpoints
|
||||
from api.utils.common import get_backend_endpoints, is_local_or_private_url
|
||||
|
||||
logger.debug("Health endpoint called")
|
||||
backend_endpoint, _ = await get_backend_endpoints()
|
||||
# tunnel_url is set only when a Cloudflare tunnel was actually resolved: the
|
||||
# configured address isn't publicly reachable, but get_backend_endpoints found
|
||||
# a public tunnel URL for it. This is the URL the UI shows for inbound webhooks.
|
||||
# It stays null for a directly-reachable (public IP / domain) deployment, where
|
||||
# backend_api_endpoint itself is the public URL.
|
||||
tunnel_url = (
|
||||
backend_endpoint
|
||||
if is_local_or_private_url(BACKEND_API_ENDPOINT)
|
||||
and not is_local_or_private_url(backend_endpoint)
|
||||
else None
|
||||
)
|
||||
is_stack = AUTH_PROVIDER == "stack"
|
||||
return HealthResponse(
|
||||
status="ok",
|
||||
version=APP_VERSION,
|
||||
backend_api_endpoint=backend_endpoint,
|
||||
backend_api_endpoint=BACKEND_API_ENDPOINT,
|
||||
tunnel_url=tunnel_url,
|
||||
deployment_mode=DEPLOYMENT_MODE,
|
||||
auth_provider=AUTH_PROVIDER,
|
||||
turn_enabled=bool(TURN_SECRET),
|
||||
|
|
|
|||
|
|
@ -3,6 +3,7 @@ Common utilities.
|
|||
Shared functions used across the application.
|
||||
"""
|
||||
|
||||
import ipaddress
|
||||
import re
|
||||
|
||||
from loguru import logger
|
||||
|
|
@ -22,6 +23,43 @@ def get_scheme(url: str) -> str | None:
|
|||
return url[:idx]
|
||||
|
||||
|
||||
def is_local_or_private_url(url: str) -> bool:
|
||||
"""True when the URL's host is localhost or a private/reserved/loopback IP.
|
||||
|
||||
Such an address is not reachable from the public internet, so external callers
|
||||
(telephony webhooks/callbacks) can't reach it directly — the backend resolves a
|
||||
Cloudflare tunnel URL at runtime instead. A public IP or a hostname/domain
|
||||
returns False (assumed publicly reachable).
|
||||
"""
|
||||
host = url
|
||||
if "://" in host:
|
||||
host = host.split("://", 1)[1]
|
||||
host = host.split("/", 1)[0]
|
||||
# Strip a :port suffix (skip bare IPv6, which contains multiple colons).
|
||||
if host.count(":") == 1:
|
||||
host = host.rsplit(":", 1)[0]
|
||||
|
||||
if host == "localhost" or host.endswith(".localhost"):
|
||||
return True
|
||||
try:
|
||||
ip = ipaddress.ip_address(host)
|
||||
except ValueError:
|
||||
return False # hostname / domain -> assume publicly reachable
|
||||
if (
|
||||
ip.is_private
|
||||
or ip.is_loopback
|
||||
or ip.is_link_local
|
||||
or ip.is_reserved
|
||||
or ip.is_unspecified
|
||||
):
|
||||
return True
|
||||
# Carrier-grade NAT (RFC 6598) — behind NAT, not publicly reachable. Kept in
|
||||
# sync with scripts/lib/setup_common.sh:dograh_is_local_ipv4.
|
||||
return isinstance(ip, ipaddress.IPv4Address) and ip in ipaddress.ip_network(
|
||||
"100.64.0.0/10"
|
||||
)
|
||||
|
||||
|
||||
def _validate_url(url: str) -> None:
|
||||
"""
|
||||
Validate URL format and raise ValueError for invalid URLs.
|
||||
|
|
@ -119,10 +157,11 @@ async def get_backend_endpoints() -> tuple[str, str]:
|
|||
_validate_url(BACKEND_API_ENDPOINT)
|
||||
|
||||
if BACKEND_API_ENDPOINT:
|
||||
# Handle localhost/127.0.0.1 special case - use tunnel URL if available
|
||||
if "localhost" in BACKEND_API_ENDPOINT or "127.0.0.1" in BACKEND_API_ENDPOINT:
|
||||
# Non-public address (localhost or a private/reserved IP) - the host isn't
|
||||
# reachable from the internet, so prefer a running Cloudflare tunnel's URL.
|
||||
if is_local_or_private_url(BACKEND_API_ENDPOINT):
|
||||
logger.debug(
|
||||
f"BACKEND_API_ENDPOINT is local ({BACKEND_API_ENDPOINT}), checking tunnel URL"
|
||||
f"BACKEND_API_ENDPOINT is not publicly reachable ({BACKEND_API_ENDPOINT}), checking tunnel URL"
|
||||
)
|
||||
try:
|
||||
tunnel_urls = await TunnelURLProvider.get_tunnel_urls()
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue