feat(firehose): websocket firehose service

.dockerignore

@@ -1,2 +1,17 @@
+# never copy secrets
+.env
+
+# local environments / build artifacts
 **/.venv
-.env
+.venv-docker
+**/node_modules
+**/dist
+**/__pycache__
+**/.pytest_cache
+**/.mypy_cache
+
+# not needed inside images
+.git
+spec/
+test/
+development/

.github/workflows/firehose.yml

@@ -0,0 +1,60 @@
+name: firehose
+
+on:
+  push:
+    paths:
+      - bases/bot_detector/firehose/**
+      - components/bot_detector/event_queue/**
+      - components/bot_detector/structs/**
+      - components/bot_detector/database/**
+      - projects/firehose/**
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: "Deploy environment"
+        required: true
+        default: "test"
+        type: choice
+        options:
+          - test
+          - deploy to prd
+env:
+  QUAY_REGISTERY: quay.io/bot_detector/firehose
+  DOCKERFILE: ./projects/firehose/Dockerfile
+  PROJECT_DIR: projects/firehose
+
+jobs:
+  # messy AF
+  env_vars:
+    runs-on: [self-hosted, "hetzner"]
+    outputs:
+      QUAY_REGISTERY: ${{ env.QUAY_REGISTERY }}
+      DOCKERFILE: ${{ env.DOCKERFILE }}
+      PROJECT_DIR: ${{ env.PROJECT_DIR }}
+    steps:
+      - run: |
+          echo "Exposing env vars to other jobs"
+          echo "QUAY_REGISTERY=${{ env.QUAY_REGISTERY }}"
+          echo "DOCKERFILE=${{ env.DOCKERFILE }}"
+          echo "PROJECT_DIR=${{ env.PROJECT_DIR }}"
+
+  common:
+    uses: ./.github/workflows/_common.yml
+    needs: [env_vars]
+    with:
+      project_dir: ${{ needs.env_vars.outputs.PROJECT_DIR }}
+
+  build:
+    if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'deploy to prd' }}
+    uses: ./.github/workflows/_build.yml
+    needs: [common, env_vars]
+    with:
+      registry: ${{ needs.env_vars.outputs.QUAY_REGISTERY }}
+      environment: ${{ (github.event.inputs.environment == 'deploy to prd' && 'prd') }}
+      BUILD_ARGS: "--target=prod"
+      DOCKERFILE: ${{ needs.env_vars.outputs.DOCKERFILE }}
+    secrets:
+      QUAY_REGISTERY_PASSWORD: ${{ secrets.QUAY_REGISTERY_PASSWORD }}
+
+  # TODO: add deploy job once a firehose deployment.yaml exists
+  # (see _deploy.yml usage in other workflows)

.gitignore

@@ -177,3 +177,11 @@ _infra/_minio_data/*
 !_infra/_minio_data/.gitkeep
 */*spec*.md
 /spec/*
+
+# firehose dev frontend
+_infra/_firehose_frontend/node_modules/
+_infra/_firehose_frontend/dist/
+
+# local mysql init (personal firehose allowlist, not for git)
+_infra/_mysql/docker-entrypoint-initdb.d/99_*.sql
+

Dockerfile

@@ -7,7 +7,7 @@ ENV UV_COMPILE_BYTECODE=1
 WORKDIR /app
 
 FROM base AS builder
-COPY --from=ghcr.io/astral-sh/uv:0.5.4 /uv /bin/
+COPY --from=ghcr.io/astral-sh/uv:0.5.13 /uv /bin/
 
 COPY ./pyproject.toml ./uv.lock ./README.md ./
 COPY ./bases ./bases
@@ -17,7 +17,7 @@ RUN --mount=type=cache,id=uv_cache,target=/root/.cache/uv \
     uv sync --frozen --no-dev --no-install-project
 
 FROM base AS dev
-COPY --from=ghcr.io/astral-sh/uv:0.5.4 /uv uvx/ /bin/
+COPY --from=ghcr.io/astral-sh/uv:0.5.13 /uv /uvx /bin/
 
 WORKDIR /app
 

_infra/_firehose_frontend/.env.example

@@ -0,0 +1,3 @@
+# discord oauth2 application id (dev portal -> application -> oauth2)
+# public by design: the pkce flow never uses a client secret
+VITE_DISCORD_CLIENT_ID=825139932817129613