Initial commit: YouTube Studio Flow (backend, frontend, infrastructure, docs)

2026-08-11 12:27:44 +02:00
commit d5af006443
304 changed files with 74604 additions and 0 deletions
@@ -0,0 +1,36 @@
+# ─── Domain ───────────────────────────────────────────────────────────────────
+# The public domain Traefik routes to this app (no https://, no trailing slash).
+DOMAIN=yourdomain.com
+
+# ─── Postgres ─────────────────────────────────────────────────────────────────
+POSTGRES_USER=studioflow
+POSTGRES_PASSWORD=change_me_strong_password
+POSTGRES_DB=studioflow
+
+# ─── Redis ────────────────────────────────────────────────────────────────────
+REDIS_PASSWORD=change_me_strong_password
+
+# ─── JWT secrets (generate with: openssl rand -base64 48) ─────────────────────
+JWT_SECRET=change_me_min_32_chars_xxxxxxxxxxxxxxxxxx
+JWT_REFRESH_SECRET=change_me_min_32_chars_refresh_xxxxxxxx
+
+# ─── YouTube token encryption — MUST be exactly 32 characters ─────────────────
+# Generate with: openssl rand -hex 16
+TOKEN_ENCRYPTION_KEY=change_me_exactly_32chars_key_xxxx
+
+# ─── Google OAuth / YouTube API ───────────────────────────────────────────────
+# Create OAuth 2.0 credentials at https://console.cloud.google.com/
+# Authorised redirect URI must match GOOGLE_CALLBACK_URL exactly.
+GOOGLE_CLIENT_ID=your_client_id.apps.googleusercontent.com
+GOOGLE_CLIENT_SECRET=your_client_secret
+GOOGLE_CALLBACK_URL=https://yourdomain.com/api/v1/auth/google/callback
+
+# ─── App URLs ─────────────────────────────────────────────────────────────────
+# Public URL of the frontend — used by the API for CORS.
+FRONTEND_URL=https://yourdomain.com
+
+# ─── Conflict detection (worker) ──────────────────────────────────────────────
+# Global kill switch for the scheduled remote-conflict sweep.
+# Per-team opt-in and batch limits are configured in Team settings.
+CONFLICT_DETECTION_ENABLED=false
+CONFLICT_DETECTION_CRON=0 3 * * *
@@ -0,0 +1,21 @@
+# StudioFlow — Infrastruktur
+
+## Übersicht
+Dieses Verzeichnis enthält die Konfiguration für die lokale Entwicklung und das Deployment mittels Docker Compose.
+
+## Dienste
+- **frontend:** Next.js UI (Port 3000)
+- **api:** NestJS REST API (Port 3001)
+- **worker:** NestJS BullMQ Consumer
+- **postgres:** PostgreSQL 16 (Port 5432)
+- **redis:** Redis 7 für Caching und Queues (Port 6379)
+
+## Schnellstart
+1. `.env.example` kopieren: `cp .env.example .env`
+2. Werte in `.env` anpassen (besonders Google API Keys).
+3. Container starten: `docker compose up -d`
+4. Datenbank migrieren: `docker compose run --rm migrate`
+
+## Daten-Persistenz
+- PostgreSQL-Daten liegen im Volume `postgres_data`.
+- Redis-Daten liegen im Volume `redis_data`.
@@ -0,0 +1,153 @@
+services:
+
+  # Runs database migrations once before the API and worker start.
+  migrate:
+    build:
+      context: ../backend
+      dockerfile: Dockerfile
+    command: npx prisma migrate deploy
+    restart: "no"
+    environment:
+      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+    depends_on:
+      postgres:
+        condition: service_healthy
+    networks:
+      - app-network
+
+  api:
+    build:
+      context: ../backend
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    environment:
+      NODE_ENV: production
+      PORT: 3001
+      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
+      JWT_SECRET: ${JWT_SECRET}
+      JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET}
+      TOKEN_ENCRYPTION_KEY: ${TOKEN_ENCRYPTION_KEY}
+      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
+      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET}
+      GOOGLE_CALLBACK_URL: ${GOOGLE_CALLBACK_URL}
+      FRONTEND_URL: ${FRONTEND_URL}
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.studioflow-api.rule=Host(`${DOMAIN}`) && PathPrefix(`/api`)"
+      - "traefik.http.routers.studioflow-api.entrypoints=websecure"
+      - "traefik.http.routers.studioflow-api.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.studioflow-api.priority=10"
+      - "traefik.http.services.studioflow-api.loadbalancer.server.port=3001"
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      migrate:
+        condition: service_completed_successfully
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:3001/api/v1/health || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+    networks:
+      - app-network
+      - traefik-network
+
+  worker:
+    build:
+      context: ../backend
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    command: node dist/worker.js
+    environment:
+      NODE_ENV: production
+      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
+      JWT_SECRET: ${JWT_SECRET}
+      JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET}
+      TOKEN_ENCRYPTION_KEY: ${TOKEN_ENCRYPTION_KEY}
+      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
+      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET}
+      CONFLICT_DETECTION_ENABLED: ${CONFLICT_DETECTION_ENABLED:-false}
+      CONFLICT_DETECTION_CRON: ${CONFLICT_DETECTION_CRON:-0 3 * * *}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      migrate:
+        condition: service_completed_successfully
+    networks:
+      - app-network
+
+  frontend:
+    build:
+      context: ../frontend
+      dockerfile: Dockerfile
+      # NEXT_PUBLIC_API_URL defaults to /api/v1 in the Dockerfile — no override needed.
+      # The relative path works because Traefik serves both frontend and API on the same domain.
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.studioflow-frontend.rule=Host(`${DOMAIN}`)"
+      - "traefik.http.routers.studioflow-frontend.entrypoints=websecure"
+      - "traefik.http.routers.studioflow-frontend.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.studioflow-frontend.priority=1"
+      - "traefik.http.services.studioflow-frontend.loadbalancer.server.port=3000"
+    depends_on:
+      api:
+        condition: service_healthy
+    networks:
+      - app-network
+      - traefik-network
+
+  postgres:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    # Bound to localhost only — not exposed to the public internet.
+    ports:
+      - "127.0.0.1:5432:5432"
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    networks:
+      - app-network
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    command: >
+      redis-server
+      --requirepass ${REDIS_PASSWORD}
+      --appendonly yes
+      --maxmemory-policy noeviction
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    networks:
+      - app-network
+
+volumes:
+  postgres_data:
+  redis_data:
+
+networks:
+  app-network:
+    driver: bridge
+  traefik-network:
+    external: true