| CI builds the image, Modal serves it 5693bd5 nandi 10h ago | 1 | [container] |
| 2 | name = "frq-web" |
| 3 | description = "the web bundle CI built, served at a URL" |
| 4 | # Nothing is built here. `registry` is an image CI already made -- the |
| 5 | # Dockerfile beside this file -- and `${FRQ_WEB_IMAGE}` is expanded when this |
| 6 | # spec is read, so the tag is whatever commit the deploy job is deploying. |
| 7 | # Unset, it fails loudly rather than deploying something stale. |
| 8 | registry = "${FRQ_WEB_IMAGE}" |
| Nothing to guard, so no credential to keep 5581b0f nandi 10h ago | 9 | # No registry_secret, which is a decision and not an omission. Images on |
| 10 | # registry.rickub.com are private by default and Modal pulls on every cold |
| 11 | # start -- not once at deploy time -- so a private image here would need a |
| 12 | # long-lived rickub deploy token kept as a Modal Secret, since the workflow's |
| 13 | # own registry token is short-lived by design. The image is made public |
| 14 | # instead. It holds `build/web` and a python to serve it, and that bundle is |
| 15 | # what the URL hands to anyone who opens it, so there is nothing in there to |
| 16 | # keep: a credential to rotate would be guarding a copy of the public site. |
| 17 | # |
| 18 | # To go the other way, set the image private on rickub and add: |
| 19 | # registry_secret = "rickub-registry" |
| 20 | # naming a Modal Secret with REGISTRY_USERNAME / REGISTRY_PASSWORD for a |
| 21 | # pull-only deploy token (rickub Settings -> Packages; the username is any |
| 22 | # label). |
| CI builds the image, Modal serves it 5693bd5 nandi 10h ago | 23 | # Not a Sandbox: a Sandbox is a run that ends, and this is meant to stay up |
| 24 | # between pushes. `web` is a Function that Modal fronts with a stable https |
| 25 | # URL and `modal deploy` leaves running. |
| 26 | runtime = "web" |
| 27 | |
| 28 | [build] |
| 29 | # Empty, and that is the whole point of this container: the image is already |
| 30 | # what it should be. A copy here would add a layer to CI's image -- rebuilt |
| 31 | # and re-pushed at deploy time -- and the tree it copied would be the |
| 32 | # deploying machine's rather than the one that was built and tested. |
| 33 | include = [] |
| 34 | |
| 35 | [network] |
| 36 | ports = [8000] |
| 37 | |
| 38 | [resources] |
| 39 | # A static bundle over http.server. The cost is the pull, not the serving. |
| 40 | cpu = 1 |
| 41 | memory = 1024 |
| 42 | timeout = 3600 |
| 43 | # One container kept warm, so the URL answers without a cold pull after a |
| 44 | # quiet spell. Set it to 0 to pay that second or two instead. |
| 45 | min_containers = 1 |
| 46 | |
| 47 | [run] |
| 48 | workdir = "/srv" |
| 49 | # The image's own CMD, said again here because `web` starts the [run] command |
| 50 | # and not the CMD: one place says what runs, and `--shell` into this |
| 51 | # container gets the same line. |
| 52 | command = "python3 -m http.server 8000 --directory /srv/web" |