1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

[container]
name        = "frq-web"
description = "the web bundle CI built, served at a URL"
# Nothing is built here. `registry` is an image CI already made -- the
# Dockerfile beside this file -- and `${FRQ_WEB_IMAGE}` is expanded when this
# spec is read, so the tag is whatever commit the deploy job is deploying.
# Unset, it fails loudly rather than deploying something stale.
registry    = "${FRQ_WEB_IMAGE}"
# No registry_secret, which is a decision and not an omission. Images on
# registry.rickub.com are private by default and Modal pulls on every cold
# start -- not once at deploy time -- so a private image here would need a
# long-lived rickub deploy token kept as a Modal Secret, since the workflow's
# own registry token is short-lived by design. The image is made public
# instead. It holds `build/web` and a python to serve it, and that bundle is
# what the URL hands to anyone who opens it, so there is nothing in there to
# keep: a credential to rotate would be guarding a copy of the public site.
#
# To go the other way, set the image private on rickub and add:
#   registry_secret = "rickub-registry"
# naming a Modal Secret with REGISTRY_USERNAME / REGISTRY_PASSWORD for a
# pull-only deploy token (rickub Settings -> Packages; the username is any
# label).
# Not a Sandbox: a Sandbox is a run that ends, and this is meant to stay up
# between pushes. `web` is a Function that Modal fronts with a stable https
# URL and `modal deploy` leaves running.
runtime     = "web"

[build]
# Empty, and that is the whole point of this container: the image is already
# what it should be. A copy here would add a layer to CI's image -- rebuilt
# and re-pushed at deploy time -- and the tree it copied would be the
# deploying machine's rather than the one that was built and tested.
include = []

[network]
ports = [8000]

[resources]
# A static bundle over http.server. The cost is the pull, not the serving.
cpu     = 1
memory  = 1024
timeout = 3600
# One container kept warm, so the URL answers without a cold pull after a
# quiet spell. Set it to 0 to pay that second or two instead.
min_containers = 1

[run]
workdir = "/srv"
# The image's own CMD, said again here because `web` starts the [run] command
# and not the CMD: one place says what runs, and `--shell` into this
# container gets the same line.
command = "python3 -m http.server 8000 --directory /srv/web"