Deployement demo

[vgtray]

No description provided.

[Copilot]

Pull request overview

Converts the existing dev-oriented docker-compose.yml and .env.example into a "production" deployment targeting Dokploy + Traefik + Let's Encrypt: removes host port bindings, drops the Cloudflare tunnel side-car, adds Traefik labels for the backend (BACKEND_HOST) and frontend (FRONTEND_HOST) on an external dokploy-network, and rewrites the env template around two public hostnames plus auto-derived MCP URL / CORS origins. .gitignore also adds graphify-out/.

Changes:

• Replace host-port + bind-mount dev setup with Traefik-labelled services on dokploy-network, removing the tunnel service and all container_name fields.
• Switch backend to --proxy-headers --forwarded-allow-ips=*, derive ARIA_MCP_PUBLIC_URL from BACKEND_HOST + path secret, and pin CORS to https://${FRONTEND_HOST}.
• Rewrite .env.example around FRONTEND_HOST / BACKEND_HOST, default INVESTIGATOR_USE_MANAGED=true and ARIA_DEMO_ENABLED=true, drop POSTGRES_PORT, BACKEND_PORT, FRONTEND_PORT, VITE_API_BASE_URL, CF_TUNNEL_TOKEN, and SIMULATOR_SCENARIO.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.

File	Description
docker-compose.yml	Production-style Traefik wiring; removes host ports/dev bind-mounts; frontend still runs Vite dev server; new MCP URL + CORS interpolation; new external dokploy-network.
.env.example	Simplified production template; new FRONTEND_HOST/BACKEND_HOST; defaults INVESTIGATOR_USE_MANAGED=true, ARIA_DEMO_ENABLED=true; removes dev/port/tunnel/scenario variables.
.gitignore	Ignore the per-developer graphify-out/ knowledge-graph directory.

Comments suppressed due to low confidence (5)

docker-compose.yml:175

• The frontend uses relative URLs (/api/v1/... via apiFetch in frontend/src/lib/api/api.client.ts and the WebSocket clients in frontend/src/features/**/use*Stream.ts). In this production setup FRONTEND_HOST (aria.vgtray.fr) and BACKEND_HOST (aria-backend.vgtray.fr) are different Traefik routers, and the frontend router rule Host(\${FRONTEND_HOST}`)catches every path on the frontend host — including/api/v1/.... As a result, browser API/WebSocket calls hit the Vite container, which returns the SPA HTML/404 for those paths instead of the backend. Either (a) add a Traefik router on FRONTEND_HOSTwith aPathPrefix(`/api`)(and/wsif used) rule pointing ataria-backend, or (b) wire the frontend to actually use an absolute base URL pointing at BACKEND_HOST. The VITE_API_URL/VITE_API_BASE_URLenvironment variables added here are never read infrontend/src(noimport.meta.env.VITE_API_*` usage), so they have no effect today. As-is, the deployed app will not be able to talk to the backend.
  docker-compose.yml:175
• The frontend service is being deployed as a Vite dev server (frontend/Dockerfile ends with CMD ["npm", "run", "dev"] and Traefik routes port 5173). This compose file is labelled "Production compose (Dokploy + Traefik + Let's Encrypt)", but the dev server is not intended for production use: it is unoptimized (no minification, no code splitting tuned for prod, large bundles), has no HMR security model for public exposure, depends on Vite's CORS/host-check behaviour (the public host must be in server.allowedHosts/server.host config, otherwise Vite refuses requests), and serves source maps and source files. The Dockerfile should be switched to a multi-stage build that runs npm run build and serves the static dist/ via nginx or vite preview, or the deployment should otherwise not rely on npm run dev for production traffic.
  docker-compose.yml:165
• VITE_API_BASE_URL and VITE_API_URL are set under environment:, but no code in frontend/src references import.meta.env.VITE_API_BASE_URL or VITE_API_URL (the API client hard-codes the relative PREFIX = "/api/v1"). Additionally, Vite only inlines VITE_* variables at build time — for a production build they would need to be passed as build args, not runtime environment. Either drop these variables (they are dead) or actually consume them in the frontend code and propagate them through the Docker build.

This issue also appears on line 164 of the same file.
docker-compose.yml:143

• ARIA_MCP_PATH_SECRET is interpolated into a Traefik-exposed URL stored in ARIA_MCP_PUBLIC_URL. The whole point of the path secret (see backend/agents/investigator/managed/bootstrap.py) is that "the URL itself IS the secret". Make sure the deployment is aware that this URL will end up in process listings, container introspection (docker inspect), Dokploy UI, and any logs that echo it. If a deployment ever logs the request URL (Traefik access logs, FastAPI access logs), the secret leaks. Consider documenting this trade-off in .env.example next to ARIA_MCP_PATH_SECRET, and confirm access logging is configured to redact /mcp/<secret>/ paths.
  docker-compose.yml:144
• CORS_ORIGINS is set to ["https://${FRONTEND_HOST}"], which is correct for browser→backend XHR. However, because frontend and backend are now on different subdomains, the backend auth cookies (access_token, refresh_token) must be issued with SameSite=None; Secure and credentialed CORS must be enabled (Access-Control-Allow-Credentials: true) for them to be sent from the frontend origin. Please verify core/security/cookies.py cookie attributes and the FastAPI CORS middleware allow_credentials=True configuration are compatible with this cross-site setup; otherwise login will silently fail in production even though the same code works in dev (where both run on localhost).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[zestones]

Salut Adam,

J'ai dû revert ta PR #140 (DeployementDemo) sur main — commit de revert : 15fe3c0.

Le souci c'est que la PR a été mergée telle quelle alors qu'elle casse complètement le workflow dev local et plusieurs choses référencées partout dans le repo. En l'état, plus personne ne peut faire tourner Aria en local.

Ce qui est cassé :

1. docker compose up plante immédiatement : le réseau dokploy-network est déclaré external: true → introuvable hors de ton serveur Dokploy.
2. Hot reload mort sur backend et frontend : tu as supprimé les bind mounts ./backend:/app:ro et ./frontend:/app, ainsi que --reload sur uvicorn et npm run dev sur le frontend. Chaque modif de code → rebuild d'image.
3. Plus aucun port hôte exposé (5432, 8000, 5173) → impossible d'ouvrir localhost:5173, localhost:8000/docs ni de se connecter à la DB en local. Le make up du Makefile annonce pourtant explicitement ces URLs dans son output.
4. Service tunnel (cloudflared) supprimé sans remplacement → casse make up.tunnel, make deploy, et tout le workflow hosted-MCP documenté dans 05-workorder-qa.md, 07-managed-agents.md et DEMO.md.
5. Tous les container_name supprimés → casse make doctor.backend, make doctor.frontend (qui font docker ps | grep aria-backend) + plusieurs docker exec aria-* documentés dans les audits M5.5.
6. CORS hardcodé sur https://${FRONTEND_HOST} → tout test depuis localhost est bloqué CORS, même si on rétablit les ports.
7. Renommage docker-compose.yaml → .yml → casse les liens Markdown dans 01-data-layer.md, 07-managed-agents.md, 08-simulators.md, README.md, etc. (qui pointent toujours vers .yaml).
8. .env.example cassé : SIMULATOR_SCENARIO retiré mais toujours utilisé par main.py, VITE_API_BASE_URL retiré, CF_TUNNEL_TOKEN retiré, INVESTIGATOR_USE_MANAGED=true et ARIA_DEMO_ENABLED=true par défaut (avant false, mode safe).
9. Message de commit trompeur : 932a6e0 "Dockerfile production demo website" ne touche aucun Dockerfile, il crée un docker-compose.override.yaml.

Ce qu'il faut faire à la place (si tu retravailles la PR) :

• Garder docker-compose.yaml orienté dev (ports, bind mounts, --reload, profile tunnel, container_names) — c'est ce que documentent le Makefile, le README et toute la doc architecture/.
• Créer un docker-compose.prod.yaml séparé (ou un override gitignored) avec uniquement les surcharges Dokploy : labels Traefik, dokploy-network, !reset [] sur les ports, CORS prod.
• Sur Dokploy : docker compose -f docker-compose.yaml -f docker-compose.prod.yaml up.
• Garder les defaults safe dans .env.example (INVESTIGATOR_USE_MANAGED=false, ARIA_DEMO_ENABLED=false).
• Mettre à jour la doc et le Makefile dans la même PR si tu renommes des fichiers ou supprimes des services.

[vgtray]

Hello,

T'as raison my bad ! La PR aurait dû rester sur ma deuxième branche deploy je pensais qu'on pouvais merge tranquille mais non (vgtray/Aria) — j'avais en tête le deploy Dokploy perso, mais c'était à séparer quand même finalement.

Je vais réécrire ça autrement sur la deuxième branche de déploy

• docker-compose.yaml reste dev-friendly (ports hôte, bind mounts, --reload, container_names, profile cloudflared optionnel) — le contrat dev de la team
• docker-compose.prod.yaml séparé avec les overrides Dokploy uniquement (labels Traefik, dokploy-network external, !reset [] sur ports, CORS prod, defaults INVESTIGATOR_USE_MANAGED/ARIA_DEMO_ENABLED safe)
• Sur Dokploy : docker compose -f docker-compose.yaml -f docker-compose.prod.yaml up
• .env.example garde les defaults safe (INVESTIGATOR_USE_MANAGED=false, ARIA_DEMO_ENABLED=false), je rajoute juste les vars Dokploy nouvelles bien commentées
• Update doc (01-data-layer, 07-managed-agents, 08-simulators, README, DEMO) + Makefile dans la même PR
• Renommage docker-compose.yaml → .yml retiré (ou alors avec MAJ de toutes les refs en même temps, mais autant garder .yaml)