Infra

compose.yaml

@@ -1,3 +1,24 @@
+# The deploy tools are here too, pinned, so nothing gets installed on the
+# host. They sit in the "tools" profile: `docker compose up -d` still starts
+# only the site, and `docker compose run --rm terraform ...` /
+# `... railway ...` runs them.
+
+x-tool: &tool
+  profiles: [tools]
+  # As you, so what they write into the repo (.terraform/, state, lock files)
+  # is yours and not root's.
+  user: "${UID:-1000}:${GID:-1000}"
+  working_dir: /work
+  volumes:
+    - .:/work
+  environment:
+    # The Terraform provider reads RAILWAY_TOKEN; the CLI reads a workspace
+    # token only as RAILWAY_API_TOKEN (RAILWAY_TOKEN is a project token to it).
+    - RAILWAY_TOKEN=${RAILWAY_API_TOKEN:-}
+    - RAILWAY_API_TOKEN
+    - CLOUDFLARE_API_TOKEN
+    - HOME=/tmp
+
 services:
   bible:
     build: .
@@ -7,11 +28,25 @@ services:
       # Host port is overridable: BIBLE_PORT=9000 docker compose up -d
       - "${BIBLE_PORT:-8085}:8080"
     volumes:
-      # Live edits without rebuilding. server.py is mounted too: leaving it
-      # baked into the image is how an old copy of it once kept running for
-      # days after the file on disk had changed. Drop these lines to serve the
-      # copy baked into the image instead.
+      # Live edits without rebuilding. server.py and worker.py are mounted
+      # too: leaving them baked into the image is how an old copy once kept
+      # running for days after the file on disk had changed. Drop these lines
+      # to serve the copy baked into the image instead.
       - ./server.py:/srv/server.py:ro
+      - ./worker.py:/srv/worker.py:ro
       - ./assets:/srv/assets:ro
       - ./bible:/srv/bible:ro
     restart: unless-stopped
+
+  terraform:
+    <<: *tool
+    image: hashicorp/terraform:1.16.3
+
+  railway:
+    <<: *tool
+    build: infra/railway-cli
+    image: railway-cli:5.57.12
+    # The CLI takes RAILWAY_TOKEN as a project token if it is set at all.
+    environment:
+      - RAILWAY_API_TOKEN
+      - HOME=/tmp