Phase 1e — Ops & Containers #6

New issue

Closed

opened 2026-10-08 07:30:18 +00:00 by agent-pi · 1 comment

agent-pi commented

2026-10-08 07:30:18 +00:00

Collaborator

Xique needs to run as a deployable service rather than a dev checkout.

This issue adds the Containerfile, the two container entry points (web and worker) sharing one sqlite volume, rootless podman deployment, WAL checkpointing and backup guidance, and the operator documentation.

Xique needs to run as a deployable service rather than a dev checkout. This issue adds the Containerfile, the two container entry points (web and worker) sharing one sqlite volume, rootless podman deployment, WAL checkpointing and backup guidance, and the operator documentation.

agent-pi added this to the Phase 1 — Core milestone

2026-10-08 07:30:18 +00:00

agent-pi referenced this issue

2026-10-16 20:05:23 +00:00

Operator documentation and docs site #16

agent-pi commented

2026-10-16 20:05:42 +00:00

Author

Collaborator

Scope confirmed container-only: the WAL/backup guidance and operator docs moved to #16.

Findings from design:

The disabled container/publish-container CI jobs already encode the image contract (buildah chroot on zhuiri, /app/src + PYTHONPATH, venv metadata, container-entrypoint.sh web, PORT). The Containerfile implements that contract rather than inventing a new one.
server.py currently calls bare uvicorn.run() (loopback, port 8000) — needs XIQUE_HOST/XIQUE_PORT settings so the in-pod proxy path works.
The smoke test as written can never pass: it boots web against a virgin /data/db with no secret. Amendment (within the job, contract intact): boot worker once first (production first-boot order), throwaway XIQUE_SECRET_KEY in CI env only.
database_path default moves /data/xique.db → /data/db/xique.db.

Plan of attack:

TDD: XIQUE_HOST (default 127.0.0.1), XIQUE_PORT (default 8000, validated), database_path default move; server.py binds via settings; README table synced.
Containerfile (python:3.14-slim, uv pinned to the CI-parsed floor, uv sync --frozen --no-dev, non-root appuser uid 1000, pre-created /data/db + /data/imports-temp, OCI revision label, tag-baked version for releases), container-entrypoint.sh (web/worker subcommands, PORT → XIQUE_PORT, host default 0.0.0.0), .containerignore.
Enable container + publish-container jobs; amended smoke (worker→web with CI-only secret). deploy-docs stays off (#16).
deploy/ quadlets: xique.pod (web + worker + tailscale sidecar, shared netns), web/worker mounts ~/docker/xique/data/db → /data/db plus named volume xique-imports-volume → /data/imports-temp, env via EnvironmentFile, XIQUE_TRUSTED_PROXIES=127.0.0.1 (serve proxies over pod loopback); tailscale quadlet mirrors the operator's proven changedetection shape (interactive login, TS_HOSTNAME=xique, serve JSON proxying 443 → 127.0.0.1:8000, funnel off).

Branch feat/issue-6-phase-1e-ops-containers, PR into main when the work is done.

Scope confirmed container-only: the WAL/backup guidance and operator docs moved to #16. **Findings from design:** - The disabled `container`/`publish-container` CI jobs already encode the image contract (buildah chroot on zhuiri, `/app/src` + `PYTHONPATH`, venv metadata, `container-entrypoint.sh web`, `PORT`). The Containerfile implements that contract rather than inventing a new one. - `server.py` currently calls bare `uvicorn.run()` (loopback, port 8000) — needs `XIQUE_HOST`/`XIQUE_PORT` settings so the in-pod proxy path works. - The smoke test as written can never pass: it boots web against a virgin `/data/db` with no secret. Amendment (within the job, contract intact): boot worker once first (production first-boot order), throwaway `XIQUE_SECRET_KEY` in CI env only. - `database_path` default moves `/data/xique.db` → `/data/db/xique.db`. **Plan of attack:** 1. TDD: `XIQUE_HOST` (default `127.0.0.1`), `XIQUE_PORT` (default 8000, validated), `database_path` default move; `server.py` binds via settings; README table synced. 2. `Containerfile` (python:3.14-slim, uv pinned to the CI-parsed floor, `uv sync --frozen --no-dev`, non-root appuser uid 1000, pre-created `/data/db` + `/data/imports-temp`, OCI revision label, tag-baked version for releases), `container-entrypoint.sh` (web/worker subcommands, `PORT` → `XIQUE_PORT`, host default `0.0.0.0`), `.containerignore`. 3. Enable `container` + `publish-container` jobs; amended smoke (worker→web with CI-only secret). `deploy-docs` stays off (#16). 4. `deploy/` quadlets: `xique.pod` (web + worker + tailscale sidecar, shared netns), web/worker mounts `~/docker/xique/data/db` → `/data/db` plus named volume `xique-imports-volume` → `/data/imports-temp`, env via `EnvironmentFile`, `XIQUE_TRUSTED_PROXIES=127.0.0.1` (serve proxies over pod loopback); tailscale quadlet mirrors the operator's proven changedetection shape (interactive login, `TS_HOSTNAME=xique`, serve JSON proxying 443 → `127.0.0.1:8000`, funnel off). Branch `feat/issue-6-phase-1e-ops-containers`, PR into `main` when the work is done.

agent-pi referenced this issue from a pull request that will close it,

2026-10-16 21:16:49 +00:00

Phase 1e — container image, entrypoint, and podman quadlets #17

agent-pi closed this issue

2026-10-16 23:18:13 +00:00