v3 effort

.dockerignore

@@ -1,11 +1,15 @@
 Dockerfile
 .dockerignore
-node_modules
 npm-debug.log
 README.md
-.next
-!.next/static
-!.next/standalone
 .git
 .sourcebot
-.env.local
+packages/web/.next
+!packages/web/.next/static
+!packages/web/.next/standalone
+**/node_modules
+**/.env.local
+**/.sentryclirc
+**/.env.sentry-build-plugin
+.yarn
+!.yarn/releases

.env.development

@@ -0,0 +1,81 @@
+
+# Prisma
+DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres"
+
+# Zoekt
+ZOEKT_WEBSERVER_URL="http://localhost:6070"
+# SHARD_MAX_MATCH_COUNT=10000
+# TOTAL_MAX_MATCH_COUNT=100000
+# The command to use for generating ctags.
+CTAGS_COMMAND=ctags
+# logging, strict
+SRC_TENANT_ENFORCEMENT_MODE=strict
+
+# Auth.JS
+# You can generate a new secret with:
+# openssl rand -base64 33
+# @see: https://authjs.dev/getting-started/deployment#auth_secret
+AUTH_SECRET="00000000000000000000000000000000000000000000"
+AUTH_URL="http://localhost:3000"
+# AUTH_CREDENTIALS_LOGIN_ENABLED=true
+# AUTH_GITHUB_CLIENT_ID=""
+# AUTH_GITHUB_CLIENT_SECRET=""
+# AUTH_GOOGLE_CLIENT_ID=""
+# AUTH_GOOGLE_CLIENT_SECRET=""
+
+# Email
+# EMAIL_FROM_ADDRESS="" # The from address for transactional emails.
+# SMTP_CONNECTION_URL="" # The SMTP connection URL for transactional emails.
+
+# PostHog
+# POSTHOG_PAPIK=""
+# NEXT_PUBLIC_POSTHOG_PAPIK=""
+
+# Sentry
+# SENTRY_BACKEND_DSN=""
+# NEXT_PUBLIC_SENTRY_WEBAPP_DSN=""
+# SENTRY_ENVIRONMENT="dev"
+# NEXT_PUBLIC_SENTRY_ENVIRONMENT="dev"
+# SENTRY_AUTH_TOKEN=
+
+# Logtail
+# LOGTAIL_TOKEN=""
+# LOGTAIL_HOST=""
+
+# Redis
+REDIS_URL="redis://localhost:6379"
+
+# Stripe
+# STRIPE_SECRET_KEY: z.string().optional(),
+# STRIPE_PRODUCT_ID: z.string().optional(),
+# STRIPE_WEBHOOK_SECRET: z.string().optional(),
+# STRIPE_ENABLE_TEST_CLOCKS=false
+
+# Misc
+
+# Generated using:
+# openssl rand -base64 24
+SOURCEBOT_ENCRYPTION_KEY="00000000000000000000000000000000"
+
+SOURCEBOT_LOG_LEVEL="debug" # valid values: info, debug, warn, error
+SOURCEBOT_TELEMETRY_DISABLED=true # Disables telemetry collection
+
+# Code-host fallback tokens
+# FALLBACK_GITHUB_CLOUD_TOKEN=""
+# FALLBACK_GITLAB_CLOUD_TOKEN=""
+# FALLBACK_GITEA_CLOUD_TOKEN=""
+
+# Controls the number of concurrent indexing jobs that can run at once
+# INDEX_CONCURRENCY_MULTIPLE=
+
+# Controls the polling interval for the web app
+# NEXT_PUBLIC_POLLING_INTERVAL_MS=
+
+# Controls the version of the web app
+# NEXT_PUBLIC_SOURCEBOT_VERSION=
+
+# CONFIG_MAX_REPOS_NO_TOKEN=
+# NODE_ENV=
+# SOURCEBOT_TENANCY_MODE=single
+
+# NEXT_PUBLIC_SOURCEBOT_CLOUD_ENVIRONMENT=

.github/workflows/_gcp-deploy.yml

@@ -0,0 +1,87 @@
+name: GCP Deploy
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        required: true
+        description: 'The environment to deploy to'
+        type: string
+
+jobs:
+  gcp-deploy:
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    env:
+      IMAGE_PATH: us-west1-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/sourcebot/sourcebot-${{ vars.NEXT_PUBLIC_SOURCEBOT_CLOUD_ENVIRONMENT }}
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@v3'
+        with:
+          submodules: "true"
+
+      # @see: https://github.com/google-github-actions/auth?tab=readme-ov-file#direct-wif
+      - name: 'Google auth'
+        id: 'auth'
+        uses: 'google-github-actions/auth@v2'
+        with:
+          project_id: '${{ secrets.GCP_PROJECT_ID }}'
+          workload_identity_provider: '${{ secrets.GCP_WIF_PROVIDER }}'
+
+      - name: 'Set up Cloud SDK'
+        uses: 'google-github-actions/setup-gcloud@v1'
+        with:
+          project_id: '${{ secrets.GCP_PROJECT_ID }}'
+
+      - name: 'Docker auth'
+        run: |-
+          gcloud auth configure-docker us-west1-docker.pkg.dev
+
+      - name: Configure SSH
+        run: |
+          mkdir -p ~/.ssh/
+          echo "${{ secrets.GCP_SSH_PRIVATE_KEY }}" > ~/.ssh/private.key
+          chmod 600 ~/.ssh/private.key
+          echo "${{ secrets.GCP_SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
+
+      - name: Build Docker image
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.IMAGE_PATH }}:${{ github.sha }}
+            ${{ env.IMAGE_PATH }}:latest
+          build-args: |
+            NEXT_PUBLIC_SOURCEBOT_VERSION=${{ github.ref_name }}
+            NEXT_PUBLIC_POSTHOG_PAPIK=${{ vars.NEXT_PUBLIC_POSTHOG_PAPIK }}
+            NEXT_PUBLIC_SOURCEBOT_CLOUD_ENVIRONMENT=${{ vars.NEXT_PUBLIC_SOURCEBOT_CLOUD_ENVIRONMENT }}
+            NEXT_PUBLIC_SENTRY_ENVIRONMENT=${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+            NEXT_PUBLIC_SENTRY_WEBAPP_DSN=${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+            NEXT_PUBLIC_SENTRY_BACKEND_DSN=${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+            SENTRY_SMUAT=${{ secrets.SENTRY_SMUAT }}
+            SENTRY_ORG=${{ vars.SENTRY_ORG }}
+            SENTRY_WEBAPP_PROJECT=${{ vars.SENTRY_WEBAPP_PROJECT }}
+            SENTRY_BACKEND_PROJECT=${{ vars.SENTRY_BACKEND_PROJECT }}
+
+
+      - name: Deploy to GCP
+        run: |
+          ssh -i ~/.ssh/private.key ${{ secrets.GCP_USERNAME }}@${{ secrets.GCP_HOST }} << 'EOF'
+            # First pull the new image
+            docker pull ${{ env.IMAGE_PATH }}:${{ github.sha }}
+
+            # Stop and remove any existing container
+            docker stop -t 60 sourcebot || true
+            docker rm sourcebot || true
+
+            # Run the new container
+            docker run -d \
+              -p 80:3000 \
+              --rm \
+              --env-file .env \
+              -v /mnt/data:/data \
+              --name sourcebot \
+              ${{ env.IMAGE_PATH }}:${{ github.sha }}
+          EOF

.github/workflows/deploy-prod.yml

@@ -0,0 +1,18 @@
+name: Deploy Prod
+
+on:
+  push:
+    tags: ["v*.*.*"]
+  workflow_dispatch:
+
+jobs:
+  deploy-prod:
+    uses: ./.github/workflows/_gcp-deploy.yml
+    secrets: inherit
+    permissions:
+      contents: 'read'
+      # Requird for OIDC auth with GCP.
+      # @see: https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings
+      id-token: 'write'
+    with:
+      environment: prod

.github/workflows/deploy-staging.yml

@@ -0,0 +1,19 @@
+name: Deploy Staging
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*.*.*"]
+  workflow_dispatch:
+
+jobs:
+  deploy-staging:
+    uses: ./.github/workflows/_gcp-deploy.yml
+    secrets: inherit
+    permissions:
+      contents: 'read'
+      # Requird for OIDC auth with GCP.
+      # @see: https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings
+      id-token: 'write'
+    with:
+      environment: staging

.github/workflows/ghcr-publish.yml

@@ -15,6 +15,7 @@ env:
 jobs:
   build:
     runs-on: ${{ matrix.runs-on}}
+    environment: oss
     permissions:
       contents: read
       packages: write
@@ -30,8 +31,6 @@ jobs:
           - platform: linux/arm64
             runs-on: ubuntu-24.04-arm
 
-
-
     steps:
       - name: Prepare
         run: |
@@ -79,8 +78,8 @@ jobs:
           platforms: ${{ matrix.platform }}
           outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true,annotation.org.opencontainers.image.description=Blazingly fast code search
           build-args: |
-            SOURCEBOT_VERSION=${{ github.ref_name }}
-            POSTHOG_PAPIK=${{ secrets.POSTHOG_PAPIK }}
+            NEXT_PUBLIC_SOURCEBOT_VERSION=${{ github.ref_name }}
+            NEXT_PUBLIC_POSTHOG_PAPIK=${{ vars.NEXT_PUBLIC_POSTHOG_PAPIK }}
 
       - name: Export digest
         run: |