Deployment

corral deploy docker
corral deploy fly
corral deploy railway
corral deploy render

# ============================================================
# Corral Auth + Your Backend — Single Container
# Auth server on :3456 (internal). Backend on :8000 (exposed).
# ============================================================

FROM node:22-slim AS base

RUN apt-get update && apt-get install -y --no-install-recommends \
    supervisor curl tini \
    && rm -rf /var/lib/apt/lists/*

# ── Stage 2: Corral auth server (Node) ──────────────────────
COPY server/package*.json server/
RUN cd server && npm ci --omit=dev
COPY server/ server/

# ── Stage 3: Your backend ───────────────────────────────────
# Python example — replace with Go/Rust/Ruby as needed
COPY requirements.txt .
RUN python3 -m venv /app/venv \
    && /app/venv/bin/pip install --no-cache-dir -r requirements.txt
COPY app/ app/

# ── Stage 4: Runtime config ─────────────────────────────────
RUN mkdir -p /app/data
COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf

# Non-root user
RUN groupadd -r corral && useradd -r -g corral -d /app corral \
    && chown -R corral:corral /app
USER corral

ENV AUTH_PORT=3456 \
    AUTH_URL=http://localhost:3456 \
    PORT=8000 \
    CORRAL_DB_PATH=/app/data/corral.db \
    NODE_ENV=production

# Only expose the backend — auth stays internal
EXPOSE 8000

ENTRYPOINT ["tini", "--"]
CMD ["supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD curl -f http://localhost:8000/health || exit 1

; Two processes, one container. Auth on :3456 (internal), backend on :8000.

[supervisord]
nodaemon=true
user=corral
logfile=/dev/null
logfile_maxbytes=0
pidfile=/tmp/supervisord.pid

; ── Corral Auth Server (Node.js) ─────────────────────────────
[program:auth]
command=node /app/server/auth.js
directory=/app/server
environment=PORT="3456",AUTH_PORT="3456",CORRAL_DB_PATH="/app/data/corral.db"
autorestart=true
startretries=5
startsecs=3
stdout_logfile=/dev/fd/1
stdout_logfile_maxbytes=0
stderr_logfile=/dev/fd/2
stderr_logfile_maxbytes=0
priority=10

; ── Backend (Python example) ─────────────────────────────────
[program:backend]
command=/app/venv/bin/uvicorn app.main:app --host 0.0.0.0 --port 8000
directory=/app
environment=PORT="8000",AUTH_URL="http://localhost:3456",CORRAL_DB_PATH="/app/data/corral.db"
autorestart=true
startretries=5
startsecs=3
stdout_logfile=/dev/fd/1
stdout_logfile_maxbytes=0
stderr_logfile=/dev/fd/2
stderr_logfile_maxbytes=0
priority=20

# Required
BETTER_AUTH_SECRET=your-32-char-random-string-here
DATABASE_URL=postgresql://user:pass@host:5432/db

# Stripe (required for billing)
STRIPE_SECRET_KEY=sk_live_...
STRIPE_PUBLISHABLE_KEY=pk_live_...
STRIPE_WEBHOOK_SECRET=whsec_...

# Social auth (optional)
GOOGLE_CLIENT_ID=...
GOOGLE_CLIENT_SECRET=...
GITHUB_CLIENT_ID=...
GITHUB_CLIENT_SECRET=...

# Internal (set automatically by Dockerfile defaults)
AUTH_PORT=3456
AUTH_URL=http://localhost:3456
PORT=8000
CORRAL_DB_PATH=/app/data/corral.db

{
  "$schema": "https://railway.app/railway.schema.json",
  "build": {
    "builder": "DOCKERFILE",
    "dockerfilePath": "Dockerfile"
  },
  "deploy": {
    "startCommand": "supervisord -c /etc/supervisor/conf.d/supervisord.conf",
    "healthcheckPath": "/health",
    "healthcheckTimeout": 5,
    "restartPolicyType": "ON_FAILURE",
    "restartPolicyMaxRetries": 3
  },
  "environments": {
    "production": {
      "variables": {
        "AUTH_PORT": "3456",
        "AUTH_URL": "http://localhost:3456",
        "CORRAL_DB_PATH": "/app/data/corral.db"
      }
    }
  }
}

# Fly.io config — single container, auth on :3456 (internal)
app = "your-app-name"
primary_region = "iad"

[build]
  dockerfile = "Dockerfile"

[env]
  AUTH_PORT = "3456"
  AUTH_URL = "http://localhost:3456"
  PORT = "8000"
  CORRAL_DB_PATH = "/app/data/corral.db"

[http_service]
  internal_port = 8000
  force_https = true
  auto_stop_machines = true
  auto_start_machines = true
  min_machines_running = 0

  [http_service.concurrency]
    type = "connections"
    hard_limit = 250
    soft_limit = 200

[[http_service.checks]]
  grace_period = "10s"
  interval = "30s"
  method = "GET"
  path = "/health"
  timeout = "5s"

# Persistent volume for SQLite
[mounts]
  source = "corral_data"
  destination = "/app/data"

database:
  adapter: turso
  url: env:TURSO_DATABASE_URL
  auth_token: env:TURSO_AUTH_TOKEN

# Local dev with hot reload. Auth on :3456 (internal), backend on :8000.
services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "${PORT:-8000}:8000"
    env_file:
      - .env
    environment:
      - AUTH_PORT=3456
      - AUTH_URL=http://localhost:3456
      - PORT=8000
      - CORRAL_DB_PATH=/app/data/corral.db
    volumes:
      # Hot-reload: mount source code
      - ./server:/app/server
      - ./app:/app/app
      # Persistent SQLite data
      - corral_data:/app/data
      # Avoid overwriting node_modules
      - /app/server/node_modules
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

volumes:
  corral_data:

[program:auth]
command=node /app/server/auth.js
environment=PORT="3456",CORRAL_DB_PATH="/app/data/corral.db"
autorestart=true
priority=10

[program:backend]
command=/app/venv/bin/uvicorn app.main:app --host 0.0.0.0 --port 8000
environment=PORT="8000",AUTH_URL="http://localhost:3456"
autorestart=true
priority=20

import os, httpx
from fastapi import HTTPException, Cookie

AUTH_URL = os.getenv("AUTH_URL", "http://localhost:3456")

async def get_session(session_token: str = Cookie(None)):
    if not session_token:
        raise HTTPException(status_code=401)
    async with httpx.AsyncClient() as client:
        r = await client.get(
            f"{AUTH_URL}/api/auth/validate",
            headers={"Cookie": f"session={session_token}"}
        )
    if r.status_code != 200:
        raise HTTPException(status_code=401)
    return r.json()  # { user, plan, features }

package auth

import (
    "encoding/json"
    "fmt"
    "net/http"
    "os"
)

var AuthURL = os.Getenv("AUTH_URL") // http://localhost:3456

type Session struct {
    User     map[string]interface{}
    Plan     string
    Features []string
}

func ValidateSession(cookie string) (*Session, error) {
    req, _ := http.NewRequest("GET",
        fmt.Sprintf("%s/api/auth/validate", AuthURL), nil)
    req.Header.Set("Cookie", "session="+cookie)

    resp, err := http.DefaultClient.Do(req)
    if err != nil || resp.StatusCode != http.StatusOK {
        return nil, fmt.Errorf("unauthorized")
    }
    var session Session
    json.NewDecoder(resp.Body).Decode(&session)
    return &session, nil
}