deploy_skill: soporte para Coolify v4.1.2 (API /applications 404) + flujo UI Playwright

Aprendido desplegando cotizador (Next.js+FastAPI+Postgres, Docker Compose, repo privado) en coolify.urieljareth.org (v4.1.2): - Documenta que /applications/* devuelve 404 en esta instancia y que configurar apps git build-from-source solo es posible por la UI web. - Nuevos scripts scripts/coolify-ui/: coolify-login.mjs (guarda storageState) y Configure-CoolifyComposeApp.mjs (build pack -> Docker Compose, Reload Compose File, env vars por Developer view, dominios por servicio). - references/coolify-4.1.2-notes.md: mapa de API funcional/404, gotchas (BOM UTF-8 rompe el parser YAML de Coolify; Reload Compose File obligatorio; pin de dominios por servicio o 503; no encolar deploys concurrentes; PowerShell [IO.File]::ReadAllText para payloads de llaves). - env.local.template.ps1: COOLIFY_EMAIL/COOLIFY_PASSWORD para la UI. - SKILL.md/TOOLS.md: seccion "instance reality" y flujo UI paso a paso. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-07-08 00:42:12 -06:00
parent cd998ce6b0
commit e7d1c33cd5
22 changed files with 2935 additions and 0 deletions
@@ -0,0 +1,26 @@
+# Minimal compliant Dockerfile for a Node app deployed to this Coolify instance.
+#
+# Hard rules followed (see docs/AGENTS-coolify-apps.md):
+#   - No published host ports 80/443 (Traefik routes them).
+#   - Real listening port is set via ports_exposes in Coolify (here 8080).
+#   - Healthcheck endpoint must NOT depend on the DB being reachable at boot.
+#
+# Replace the build/run commands with the ones that match your framework.
+
+FROM node:20-alpine AS build
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+FROM node:20-alpine AS run
+WORKDIR /app
+ENV NODE_ENV=production
+ENV PORT=8080
+COPY --from=build /app /app
+# Cheap endpoint; implement /health in your app to return 200 without DB.
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 --start-period=20s \
+  CMD wget -qO- http://localhost:8080/health || exit 1
+EXPOSE 8080
+CMD ["npm", "start"]
@@ -0,0 +1,24 @@
+# Minimal compliant Dockerfile for a Python app deployed to this Coolify instance.
+#
+# Hard rules followed (see docs/AGENTS-coolify-apps.md):
+#   - No published host ports 80/443 (Traefik routes them).
+#   - Real listening port is set via ports_exposes in Coolify (here 8080).
+#   - Healthcheck endpoint must NOT depend on the DB being reachable at boot.
+
+FROM python:3.12-slim AS build
+WORKDIR /app
+ENV PIP_NO_CACHE_DIR=1
+COPY requirements.txt .
+RUN pip install --prefix=/install -r requirements.txt
+
+FROM python:3.12-slim AS run
+WORKDIR /app
+ENV PYTHONUNBUFFERED=1
+ENV PORT=8080
+COPY --from=build /install /usr/local
+COPY . .
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 --start-period=20s \
+  CMD python -c "import urllib.request,sys; urllib.request.urlopen('http://localhost:8080/health'); sys.exit(0)" || exit 1
+EXPOSE 8080
+# Adjust to your framework: gunicorn, uvicorn, fastapi, etc.
+CMD ["gunicorn", "-b", "0.0.0.0:8080", "app:app"]
@@ -0,0 +1,52 @@
+# Reference docker-compose for a multi-container app on this Coolify instance.
+#
+# Implements EVERY hard rule from docs/AGENTS-coolify-apps.md:
+#   2.1 App reaches DB by Docker service name (app-db), never localhost.
+#   2.2 Joins the external 'coolify' network so it can resolve shared services.
+#   2.3 Does NOT publish 80/443 (owned by coolify-proxy). Traefik routes.
+#   2.4 FQDN is set in Coolify (https://<name>.urieljareth.org) before deploy.
+#   2.5 Secrets come as env vars from Coolify. None are baked in here.
+#   4   Healthcheck on a DB-independent endpoint.
+#   5   Named volumes for data that must survive redeploys.
+
+services:
+  app:
+    build: .
+    environment:
+      DB_HOST: app-db
+      DB_PORT: "5432"
+      DB_NAME: ${DB_NAME}
+      DB_USER: ${DB_USER}
+      DB_PASSWORD: ${DB_PASSWORD}
+      APP_PUBLIC_URL: https://app.urieljareth.org
+    expose:
+      - "8080"
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:8080/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+    networks:
+      - coolify
+    depends_on:
+      - app-db
+
+  app-db:
+    image: postgres:16
+    environment:
+      POSTGRES_DB: ${DB_NAME}
+      POSTGRES_USER: ${DB_USER}
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+    volumes:
+      - app-db-data:/var/lib/postgresql/data
+    networks:
+      - coolify
+
+volumes:
+  app-db-data: {}
+
+networks:
+  coolify:
+    name: coolify
+    external: true
@@ -0,0 +1,31 @@
+# Reference .env file. Copy to .env.local.ps1 and fill values.
+#
+# IMPORTANT: .env.local.ps1 is gitignored (see .gitignore). NEVER commit it.
+#           The .env.example file in the repo root shows the publicly-safe keys.
+
+# Proxmox (already configured)
+$env:PROXMOX_HOST = "192.168.0.200"
+$env:PROXMOX_NODE = "thinkcentre"
+$env:PROXMOX_USER = "root"
+$env:PROXMOX_SSH_KEY = "C:\Users\Uriel Jareth\.openclaw\workspace\proxmox_key_win"
+$env:PROXMOX_API_BASE_URL = "https://192.168.0.200:8006/api2/json"
+$env:PROXMOX_API_TOKEN_ID = "root@pam!openclaw"
+$env:PROXMOX_API_TOKEN_SECRET = "REPLACE_WITH_TOKEN_SECRET"
+$env:PROXMOX_COOLIFY_LXC = "102"
+
+# Coolify
+$env:COOLIFY_API_URL = "https://coolify.urieljareth.org/api/v1"
+$env:COOLIFY_TOKEN = "REPLACE_WITH_COOLIFY_TOKEN"
+# Coolify UI login (email/password) — REQUIRED for Playwright-driven UI operations.
+# This instance (v4.1.2) does NOT expose the /applications/* REST API (all 404),
+# so configuring a git-based / Docker-Compose application (build pack, env vars,
+# domains) can ONLY be done through the web UI. See deploy_skill/references/coolify-4.1.2-notes.md.
+$env:COOLIFY_EMAIL = "REPLACE_WITH_COOLIFY_UI_EMAIL"
+$env:COOLIFY_PASSWORD = "REPLACE_WITH_COOLIFY_UI_PASSWORD"
+
+# GitHub (for deploy_skill: New-GitHubRepo.ps1, Invoke-GitHubApi.ps1)
+# Generate at: https://github.com/settings/tokens
+# Scopes needed: repo (classic) OR Contents:Read+Write, Metadata:Read (fine-grained).
+# The token is used ONLY for API calls (create repo, set deploy key, etc.).
+# git push/pull uses Windows Credential Manager (wincred) instead.
+$env:GITHUB_TOKEN = "REPLACE_WITH_GITHUB_PAT"