Skip to content

Deployment

How the auth server is configured and shipped.

Environment variables

Variable Required Default Purpose
MONGO_HOST yes — MongoDB host
MONGO_USER no — MongoDB username
MONGO_PASS no — MongoDB password
MONGO_PORT no 27017 MongoDB port
MONGO_DB_NAME no auth Database name
JWT_SECRET no* superstrongsecretkey Token signing secret (*set in production!)

Credentials and the token secret live in the environment / Deploy secrets — see .env.example for the shape. .env is gitignored.

Running locally

1
2
cp .env.example .env      # fill in MONGO_HOST, JWT_SECRET
uvicorn main:app --reload --port 8000

The health endpoint is available at GET /health.

Container image

The Dockerfile is a multi-stage build on python:3.13-slim:

  1. Builder installs requirements.txt from the private pip index using build args PIP_USERNAME, PIP_PASSWORD, PIP_REPO_URL.
  2. Runtime copies Python 3.13 from the builder, installs curl, exposes port 8000, and runs uvicorn main:app. A HEALTHCHECK curls /health.

CI/CD (Drone)

.drone.yml ships on git tag events (arm64):

  1. Resolve the latest tag.
  2. Skip if the image already exists.
  3. docker build with pip credentials (secrets) → aetos/auth-server:$TAG and :latest.
  4. Push to $REGISTRY_HOST/aetos/auth-server:*.
  5. Restart the running container auth-server.

The deployed container runs with --restart always, maps host 9003 → 8000, resolves private-pi to 192.168.1.111 for Mongo, and receives MONGO_* + JWT_SECRET from secrets.

Environments

Environment Base URL
Production https://auth.aetoskia.com
Internal staging http://server-pi:9002
Local development http://localhost:8000