DorianandClaude Fable 5
51678b4315
CI / check (push) Has been cancelled
- docker-compose.arena.yml: image tag 1.1.0 -> 1.2.0, refreshed the TRUSTED_PROXY comment to reflect the live NPM+TLS front-end (no longer "no DNS/TLS this phase" — that shipped mid-phase). - Deployed on VPS2: docker compose pull + up -d, container recreated, healthy, data volume untouched. - Verified end-to-end through the public HTTPS URL: health, unified prompt (ARENA_URL substituted, zero leftover template tokens), a freshly registered test bot visible in GET /api/bots, bot auth via the now-fixed GET /api/fights/poll, and data integrity (100 + 15 classic bots, unchanged from before the roll). - docs/arena-deployment.md: recorded the second (post-poll-fix) image digest and the fix. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
64 lines
3.0 KiB
YAML
64 lines
3.0 KiB
YAML
# docker-compose.arena.yml — the CANONICAL public BotFights arena
|
|
#
|
|
# This is the counterpart to docker-compose.yml (the local/dev stack). It runs
|
|
# ONLY the published registry image (no `build:` section — the arena runs exactly
|
|
# what nodes run, never a locally-built variant), with payments deliberately
|
|
# unconfigured and no reverse proxy in front (direct exposure on :9100, so the
|
|
# app's own rate limiter must see the real socket peer IP — see TRUSTED_PROXY note
|
|
# below).
|
|
#
|
|
# Deploy notes live in docs/arena-deployment.md — this file has no secrets. The
|
|
# JWT_SECRET value is generated on the host into /opt/botfights-arena/.env (0600,
|
|
# never committed).
|
|
#
|
|
# Arena-as-relay: this compose file is not special — it is the SAME image any
|
|
# node can run standalone (no ARENA_UPSTREAM_URL) to host its own public arena.
|
|
# The Foundation's VPS2 instance below is just the well-known default rendezvous,
|
|
# not a hardcoded authority. See docs/arena-deployment.md "Hosting your own arena".
|
|
|
|
services:
|
|
botfights-arena:
|
|
image: localhost:3000/lfg2025/botfights:1.2.0
|
|
container_name: botfights-arena
|
|
restart: unless-stopped
|
|
ports:
|
|
- "9100:9100"
|
|
volumes:
|
|
- botfights-arena-data:/app/server/data
|
|
# Explicit override (not just relying on the image's baked-in HEALTHCHECK):
|
|
# the currently published 1.1.0 tag predated the Dockerfile's HEALTHCHECK
|
|
# directive; kept for continuity across image rolls.
|
|
healthcheck:
|
|
test: ["CMD", "node", "-e", "fetch('http://localhost:9100/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
start_period: 10s
|
|
retries: 3
|
|
environment:
|
|
- NODE_ENV=production
|
|
- PORT=9100
|
|
- FIGHT_LOOP_ENABLED=true
|
|
- PUBLIC_ARENA_URL=https://botfights.archipelago-foundation.org
|
|
# TRUSTED_PROXY=1 since 2026-07-30: the arena now sits behind
|
|
# nginx-proxy-manager at https://botfights.archipelago-foundation.org
|
|
# (Let's Encrypt cert, live). The app trusts X-Forwarded-For from NPM
|
|
# for its per-IP rate limiting instead of the raw socket peer (which
|
|
# would otherwise see every request as coming from NPM's own IP).
|
|
- TRUSTED_PROXY=1
|
|
# Auth — value comes from the host .env, never hardcoded here.
|
|
# Generated on VPS2 with: openssl rand -hex 32 (see docs/arena-deployment.md)
|
|
- JWT_SECRET=${JWT_SECRET}
|
|
- BOTFIGHTS_CREATOR_PUBKEYS=${BOTFIGHTS_CREATOR_PUBKEYS:-da5e0c1b646bdb13c2300f805b0ca3e5afe5b052c594ce78bac8978d21c3fa39}
|
|
# Deliberately OMITTED: this instance IS the upstream — never point it at
|
|
# another arena.
|
|
# - ARENA_UPSTREAM_URL=
|
|
# ── Payments are OUT OF SCOPE for this deployment (phase 09 CONTEXT.md
|
|
# scope fence: "OUT: Lightning/cashu payment changes"). Do not set:
|
|
# - BOTFIGHTS_WALLET_ENCRYPTION_KEY=
|
|
# - BOTFIGHTS_NWC_URL=
|
|
# - BOTFIGHTS_CASHU_MINT_URL=
|
|
# - BOTFIGHTS_DEV_PAYOUT_LNADDRESS=
|
|
|
|
volumes:
|
|
botfights-arena-data:
|