Draft: Firstv2: WIP

.env.compose

@@ -0,0 +1,14 @@
+# !!! WARNING !!!  Do not put secrets in this file.
+# It is tracked in git.
+# Sensitive variables should go into .env.secret instead.
+
+# Settings specific to services running inside deploy/compose.yaml.
+# This mainly serves to set hostnames correctly for compose-managed networks.
+
+POSTGRES_DB=first_gateway_dev
+POSTGRES_USER=first_gateway
+POSTGRES_PASSWORD=password
+
+FIRST_DB_URL="postgresql+psycopg://first_gateway:password@postgres:5432/first_gateway_dev"
+FIRST_REDIS_URL="redis://redis:6379/1"
+FIRST_GATEWAY_HEALTH_URL=http://inference-gateway:7000/health

.env.default

@@ -0,0 +1,19 @@
+# !!! WARNING !!!  Do not put secrets in this file.
+# It is tracked in git.
+# Sensitive variables should go into .env.secret instead.
+
+# Baseline settings: common among local dev / compose stack / production
+
+# Auth
+FIRST_GLOBUS__POLICIES=["f7b3f89c-d8d2-453d-9fc7-3576bc27c421"]
+FIRST_GLOBUS__USER_GROUPS=[] # Not restricted by group membership
+FIRST_GLOBUS__ADMIN_GROUP="1e943dcd-32ae-11f1-b41c-0e1cdb0e3035"
+FIRST_GLOBUS__AUTHORIZED_IDP_DOMAINS=["anl.gov", "alcf.anl.gov"]
+FIRST_GLOBUS__AUTHORIZED_GROUPS_PER_IDP='
+  {
+    "alcf.anl.gov": [
+      "fa12c8aa-9352-11f0-a103-0affe2f6e001",
+      "75fc8c22-9f3d-11f0-a6ad-0afff51aa6ef"
+    ]
+  }
+'

.env.local

@@ -0,0 +1,8 @@
+# !!! WARNING !!!  Do not put secrets in this file.
+# It is tracked in git.
+# Sensitive variables should go into .env.secret instead.
+
+# Settings specific to local testing outside of the Docker Compose stack.
+# This mainly serves to set hostnames correctly for localhost.
+FIRST_DB_URL="postgresql+psycopg://first_gateway:password@localhost:5432/first_gateway_dev"
+FIRST_REDIS_URL="redis://localhost:6379/1"

.env.prod

@@ -0,0 +1,5 @@
+# !!! WARNING !!!  Do not put secrets in this file.
+# It is tracked in git.
+# Sensitive variables should go into .env.secret instead.
+
+# Non-secret settings specific to production deployment.

.github/workflows/ci.yml

@@ -0,0 +1,97 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  checks:
+    name: Checks & Tests
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:18
+        env:
+          POSTGRES_DB: first_gateway_dev
+          POSTGRES_USER: first_gateway
+          POSTGRES_PASSWORD: password
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U first_gateway"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+
+      redis:
+        image: redis:7
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 5s
+          --health-timeout 3s
+          --health-retries 10
+
+    env:
+      FIRST_GLOBUS__APP_ID: ci-dummy-app-id
+      FIRST_GLOBUS__APP_SECRET: ci-dummy-app-secret
+      FIRST_PILOT_CA_CRT: "certificate"
+      FIRST_PILOT_CA_KEY: "begin fake private key"
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version-file: ".python-version"
+
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - run: make format-check
+      - run: make lint
+      - run: make mypy
+      - run: make test
+
+  docker:
+    name: Build & Push Image
+    runs-on: ubuntu-latest
+    needs: checks
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compute short SHA
+        id: sha
+        run: echo "short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: deploy/Dockerfile
+          push: true
+          tags: ghcr.io/${{ github.repository_owner }}/first_gateway:${{ steps.sha.outputs.short }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.gitignore

@@ -1,6 +1,8 @@
 __pycache__/
 .DS_Store
 .env
+.env.secret
+docs/images/.$Diagrams.drawio.bkp
 update_batch_status_error.log
 update_batch_status_output.log
 create_pg_backup_log.log
@@ -13,7 +15,7 @@ email.out
 .vscode/
 .editorconfig
 
-#  Django 
+#  Django
 info.log
 db.sqlite3
 media/

.worktreeinclude

@@ -0,0 +1,2 @@
+.env
+.env.secret