Integrate R2 (or similar S3 apis)

.env.example

@@ -1,11 +1,17 @@
 # Set to 1 to run using 1 thread
 APP_DEBUG=0
 # Used for URL generation in downloads
-APP_URL=http://localhost
-FRONT_URL=http://localhost
+APP_URL=http://localhost:3000
+FRONT_URL=http://localhost:5173
 DATABASE_URL=postgres://user:password@localhost/schema
 PORT=8080
 
+# Logging (see tracing/tracing-subscriber docs)
+# RUST_LOG controls verbosity, e.g. "info", "debug", "info,sqlx=warn", "geode_index=debug"
+RUST_LOG=info
+# LOG_FORMAT: "text" (default, human-readable) or "json" (structured, for log aggregation)
+LOG_FORMAT=text
+
 # GitHub
 
 GITHUB_CLIENT_ID=
@@ -14,6 +20,7 @@ GITHUB_CLIENT_SECRET=
 # Discord
 
 DISCORD_WEBHOOK_URL=
+INDEX_ADMIN_DISCORD_WEBHOOK_URL=
 
 # Config
 
@@ -22,9 +29,13 @@ MAX_MOD_FILESIZE_MB=250
 # Globally disables download counting, in the event of abuse
 DISABLE_DOWNLOAD_COUNTS=0
 
+# Path where uploaded files are stored on disk (default: ./storage)
+# The reverse proxy must serve {STORAGE_PATH}/submission_attachments/ at /storage/submission-attachments/
+STORAGE_PATH=./storage
+
 # Used for S3-compatible APIs (R2). Automatically disabled if S3_ENDPOINT_URL is not set.
 S3_ENDPOINT_URL=
 S3_BUCKET_NAME=
 S3_REGION=
 AWS_ACCESS_KEY_ID=
-AWS_SECRET_ACCESS_KEY=
+AWS_SECRET_ACCESS_KEY=

.github/workflows/deploy.yaml

@@ -1,57 +1,23 @@
 name: Deploy Index
 
 on:
-  release:
-    types: [published]
+  workflow_run:
+    workflows: ["Publish Docker Image"]
+    types: [completed]
   workflow_dispatch:
 
 jobs:
   deploy:
+    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-24.04
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Get release tag
-        id: get_tag
-        run: |
-          if [ "${{ github.event_name }}" == "release" ]; then
-            echo "tag=${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT
-          else
-            # For workflow_dispatch, get the latest release tag
-            echo "tag=$(gh release list --limit 1 --json tagName --jq '.[0].tagName')" >> $GITHUB_OUTPUT
-          fi
-        env:
-          GH_TOKEN: ${{ github.token }}
-
-      - name: Download release assets
-        run: |
-          mkdir -p ./artifacts/x86_64 ./artifacts/aarch64
-          gh release download ${{ steps.get_tag.outputs.tag }} \
-            --pattern "geode-index-${{ steps.get_tag.outputs.tag }}-linux-x86_64" \
-            --dir ./artifacts/x86_64
-          gh release download ${{ steps.get_tag.outputs.tag }} \
-            --pattern "geode-index-${{ steps.get_tag.outputs.tag }}-linux-aarch64" \
-            --dir ./artifacts/aarch64
-          chmod +x ./artifacts/x86_64/geode-index-${{ steps.get_tag.outputs.tag }}-linux-x86_64
-          chmod +x ./artifacts/aarch64/geode-index-${{ steps.get_tag.outputs.tag }}-linux-aarch64
-        env:
-          GH_TOKEN: ${{ github.token }}
-
       - name: Create ssh key
         run: |
           install -m 600 -D /dev/null ~/.ssh/id_rsa
           echo "${{ secrets.PRIVATE_KEY }}" > ~/.ssh/id_rsa
           ssh-keyscan -p ${{ secrets.INDEX_SSH_PORT }} -H ${{ secrets.INDEX_SERVER }} > ~/.ssh/known_hosts
 
-      - name: Upload target to server
-        id: upload
-        run: |
-          rsync -avz -e "ssh -p ${{ secrets.INDEX_SSH_PORT }} -i ~/.ssh/id_rsa" --owner --group --chmod=775 --chown=${{ secrets.INDEX_RUN_USER }}:${{ secrets.INDEX_RUN_GROUP }} ./artifacts/${{ secrets.INDEX_DEPLOY_ARCH }}/geode-index-${{ steps.get_tag.outputs.tag }}-linux-${{ secrets.INDEX_DEPLOY_ARCH }} ${{ secrets.INDEX_USER }}@${{ secrets.INDEX_SERVER }}:${{ secrets.INDEX_COPY_LOCATION }}
-          rsync -avz -e "ssh -p ${{ secrets.INDEX_SSH_PORT }} -i ~/.ssh/id_rsa" --owner --group --chmod=775 --chown=${{ secrets.INDEX_RUN_USER }}:${{ secrets.INDEX_RUN_GROUP }} ./migrations/* ${{ secrets.INDEX_USER }}@${{ secrets.INDEX_SERVER }}:${{ secrets.MIGRATIONS_COPY_LOCATION }}
-          rsync -avz -e "ssh -p ${{ secrets.INDEX_SSH_PORT }} -i ~/.ssh/id_rsa" --owner --group --chmod=775 --chown=${{ secrets.INDEX_RUN_USER }}:${{ secrets.INDEX_RUN_GROUP }} ./storage/static ${{ secrets.INDEX_USER }}@${{ secrets.INDEX_SERVER }}:${{ secrets.STORAGE_STATIC_COPY_LOCATION }}
-
-      - name: Run update script
+      - name: Deploy
         run: |
-          ssh -p ${{ secrets.INDEX_SSH_PORT }} ${{ secrets.INDEX_USER }}@${{ secrets.INDEX_SERVER }} "cd ${{ secrets.INDEX_UPDATE_SCRIPT_PATH }} && ./update.sh"
-        if: steps.upload.outcome == 'success'
+          ssh -p ${{ secrets.INDEX_SSH_PORT }} -i ~/.ssh/id_rsa ${{ secrets.INDEX_USER }}@${{ secrets.INDEX_SERVER }} \
+            "cd ${{ secrets.INDEX_DIR }} && docker compose pull && docker compose up -d --wait"

.github/workflows/publish-docker-image.yaml

@@ -83,14 +83,24 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Resolve build metadata
+        id: meta
+        run: |
+          echo "date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_OUTPUT"
+          echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
       - name: Build and push by digest
         id: build
         uses: docker/build-push-action@v6
         with:
           context: .
           push: true
           platforms: ${{ matrix.platform }}
-          build-args: LIBC=${{ matrix.libc }}
+          build-args: |
+            LIBC=${{ matrix.libc }}
+            VERSION=${{ needs.resolve-tag.outputs.tag }}
+            REVISION=${{ steps.meta.outputs.revision }}
+            BUILD_DATE=${{ steps.meta.outputs.date }}
           # Push to a digest-only ref (no tag) so the merge job can assemble
           # the final multi-arch manifest cleanly
           outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true