finnandClaude Opus 5.5
53081dd553
Only the direct dependencies were pinned. Werkzeug, Jinja2, MarkupSafe, itsdangerous and the other transitive packages were resolved at build time, so builds of the same commit could differ, and pip did not verify the downloaded files. There was also no vulnerability scan. - requirements.in / requirements-dev.in list the direct dependencies. requirements.txt / requirements-dev.txt are lockfiles generated by pip-compile with exact versions and hashes for every package. The dev lockfile is constrained by the production one. - Makefile targets: lock-deps, update-deps, sync-deps and audit (pip-audit against requirements.txt). - The locked production versions match the previously installed ones. The first audit found no known vulnerabilities. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
47 lines
1007 B
Makefile
47 lines
1007 B
Makefile
# DEV
|
|
seed-dev: clear-dev
|
|
FLASK_APP=max.app FLASK_DEBUG=1 scripts/dev/seed-db.sh
|
|
|
|
clear-dev:
|
|
scripts/dev/clear-db.sh
|
|
|
|
run-dev:
|
|
FLASK_APP=max.app FLASK_DEBUG=1 flask run --host 0.0.0.0 --port 8757
|
|
|
|
run-dev-as-prod:
|
|
FLASK_APP=max.app MAX_ORIGIN=http://localhost:8757 gunicorn -w 1 -b 0.0.0.0:8757 max.app:app
|
|
|
|
run-cleanup:
|
|
scripts/dev/cleanup.sh
|
|
|
|
# DEPENDENCIES
|
|
PIP_COMPILE = pip-compile --quiet --generate-hashes --strip-extras --allow-unsafe
|
|
|
|
lock-deps:
|
|
$(PIP_COMPILE) requirements.in
|
|
$(PIP_COMPILE) requirements-dev.in
|
|
|
|
update-deps:
|
|
$(PIP_COMPILE) --upgrade requirements.in
|
|
$(PIP_COMPILE) --upgrade requirements-dev.in
|
|
|
|
sync-deps:
|
|
pip-sync requirements.txt requirements-dev.txt
|
|
|
|
audit:
|
|
pip-audit --strict -r requirements.txt
|
|
|
|
# PROD
|
|
build-prod:
|
|
docker build -t max:$(shell cat VERSION) .
|
|
|
|
run-prod:
|
|
docker-compose up -d
|
|
|
|
stop-prod:
|
|
docker-compose down
|
|
|
|
setup-prod-initial-login:
|
|
docker-compose exec max flask add-domain finn.st
|
|
docker-compose exec max flask reset-admin admin@finn.st admin
|