Merge pull request 'flows' (#4) from dock into main

Reviewed-on: #4

.gitea/workflows/test.yml

@@ -11,50 +11,58 @@ on:
 jobs:
   healthcheck:
     runs-on: ubuntu-latest
-    name: Compose Templates Health Check
+    name: Code, dbt & Live App Health Check
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
 
       - name: Install System Dependencies
         run: |
-          apt-get update && apt-get install -y python3 python3-yaml git ca-certificates
+          apt-get update && apt-get install -y curl unzip git ca-certificates
 
-      - name: Validate Compose Templates & Workflows
+      - name: Install uv
         run: |
-          echo "==> Validating all docker-compose.yml files..."
+          curl -LsSf https://astral.sh/uv/install.sh | sh
-          python3 - <<'PY'
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
-          import pathlib, sys
+          echo "/root/.local/bin" >> $GITHUB_PATH
-          try:
+
-              import yaml
+      - name: Install Project Dependencies
-          except ImportError:
+        run: |
-              print("pyyaml missing"); sys.exit(1)
+          export PATH="$HOME/.local/bin:/root/.local/bin:$PATH"
-          failures = []
+          uv sync
-          files = sorted(pathlib.Path(".").glob("*/docker-compose.yml"))
+
-          assert files, "no */docker-compose.yml found"
+      - name: Python Syntax & Compilation Verification
-          for f in files:
+        run: |
-              try:
+          export PATH="$HOME/.local/bin:/root/.local/bin:$PATH"
-                  doc = yaml.safe_load(f.read_text())
+          echo "==> Validating Python scripts compilation..."
-              except Exception as e:
+          uv run python -m py_compile streamlit_app/app.py scripts/db_storage.py
-                  failures.append(f"{f}: YAML parse error: {e}")
+          echo "✓ Python scripts compiled without errors"
-                  continue
+
-              if not isinstance(doc, dict) or "services" not in doc:
+      - name: dbt Manifest & Model Validation
-                  failures.append(f"{f}: missing top-level 'services' key")
+        run: |
-                  continue
+          export PATH="$HOME/.local/bin:/root/.local/bin:$PATH"
-              for svc, cfg in doc["services"].items():
+          echo "==> Validating dbt package dependencies..."
-                  if not isinstance(cfg, dict) or "image" not in cfg:
+          uv run dbt deps --project-dir dbt_nba --profiles-dir dbt_nba
-                      failures.append(f"{f}: service '{svc}' missing 'image'")
+          echo "==> Validating dbt models, seeds, and tests compilation..."
-              print(f"OK {f} services={list(doc['services'].keys())}")
+          uv run dbt parse --project-dir dbt_nba --profiles-dir dbt_nba
-          for f in sorted(pathlib.Path(".gitea/workflows").glob("*.y*ml")):
+          echo "✓ All dbt models, seeds, and macros validated"
-              try:
+
-                  yaml.safe_load(f.read_text())
+      - name: Cloudflare R2 Storage Probe (Optional if secrets present)
-                  print(f"OK {f}")
+        env:
-              except Exception as e:
+          S3_ENDPOINT_URL: ${{ secrets.S3_ENDPOINT_URL }}
-                  failures.append(f"{f}: YAML parse error: {e}")
+          S3_BUCKET_NAME: ${{ secrets.S3_BUCKET_NAME }}
-          if failures:
+          S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
-              print("FAILURES:"); [print(" -", x) for x in failures]; sys.exit(1)
+          S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
-          print("All templates validated")
+          S3_REGION: ${{ secrets.S3_REGION || 'auto' }}
-          PY
+          S3_DB_KEY: ${{ secrets.S3_DB_KEY || 'dbt_nba.duckdb' }}
+        run: |
+          export PATH="$HOME/.local/bin:/root/.local/bin:$PATH"
+          if [ -n "${S3_ENDPOINT_URL:-}" ]; then
+            echo "==> Probing Cloudflare R2 storage status..."
+            uv run python scripts/db_storage.py status
+          else
+            echo "==> S3 secrets not configured for this step; skipping storage probe."
+          fi
 
       - name: Live Production App Health Probe
         run: |

cloudflare/.env.example

@@ -1,14 +0,0 @@
-# Copy to .env and fill in before `docker compose up -d`
-# Cloudflare API token with Zone:DNS:Edit + Zone:Zone:Read (favonia/cloudflare-ddns)
-CLOUDFLARE_API_TOKEN=
-# Comma-separated list, e.g. example.com,sub.example.com
-DOMAINS=
-PROXIED=true
-UPDATE_CRON=*/5 * * * *
-
-# cloudflared-web UI (wisdomsky/cloudflared-web)
-WEBUI_PORT=14333
-BASIC_AUTH_USER=admin
-BASIC_AUTH_PASS=change-me
-
-TZ=UTC

cloudflare/docker-compose.yml

@@ -1,26 +0,0 @@
-services:
-  cloudflare-ddns:
-    image: favonia/cloudflare-ddns:latest
-    container_name: cloudflare-ddns
-    restart: unless-stopped
-    network_mode: host
-    environment:
-      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN:?set CLOUDFLARE_API_TOKEN in .env}
-      DOMAINS: ${DOMAINS:?set DOMAINS in .env}
-      PROXIED: ${PROXIED:-true}
-      UPDATE_CRON: ${UPDATE_CRON:-*/5 * * * *}
-      TZ: ${TZ:-UTC}
-
-  cloudflared-web:
-    image: wisdomsky/cloudflared-web:latest
-    container_name: cloudflared-web
-    restart: unless-stopped
-    ports:
-      - '${WEBUI_PORT:-14333}:14333'
-    environment:
-      WEBUI_PORT: ${WEBUI_PORT:-14333}
-      BASIC_AUTH_USER: ${BASIC_AUTH_USER:-admin}
-      BASIC_AUTH_PASS: ${BASIC_AUTH_PASS:-}
-      TZ: ${TZ:-UTC}
-    volumes:
-      - /data/cloudflare/files/config:/config

dozzle-dockge/docker-compose.yml

@@ -1,25 +0,0 @@
-services:
-  dozzle:
-    image: amir20/dozzle:latest
-    container_name: dozzle
-    restart: unless-stopped
-    ports:
-      - '9999:8080'
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    environment:
-      TZ: ${TZ:-UTC}
-
-  dockge:
-    image: louislam/dockge:1
-    container_name: dockge
-    restart: unless-stopped
-    ports:
-      - '5001:5001'
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - /data/dockge/files/data:/app/data
-      - /data/dockge/files/stacks:/opt/stacks
-    environment:
-      DOCKGE_STACKS_DIR: /opt/stacks
-      TZ: ${TZ:-UTC}

it-tools/docker-compose.yml

@@ -1,7 +0,0 @@
-services:
-  it-tools:
-    image: corentinth/it-tools:latest
-    container_name: it-tools
-    restart: unless-stopped
-    ports:
-      - '8080:80'

n8n/.env.example

@@ -1,12 +0,0 @@
-# Copy to .env and fill in secrets before `docker compose up -d`
-POSTGRES_USER=n8n
-POSTGRES_PASSWORD=change-me
-POSTGRES_DB=n8n
-
-# Public hostname / protocol used to access n8n (no port suffix needed when behind a reverse proxy)
-N8N_HOST=localhost
-N8N_PROTOCOL=http
-N8N_PORT=5678
-WEBHOOK_URL=http://localhost:5678/
-
-TZ=UTC

n8n/docker-compose.yml

@@ -1,41 +0,0 @@
-services:
-  postgres:
-    image: postgres:16
-    container_name: n8n-postgres
-    restart: unless-stopped
-    environment:
-      POSTGRES_USER: ${POSTGRES_USER:-n8n}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
-      POSTGRES_DB: ${POSTGRES_DB:-n8n}
-    volumes:
-      - /data/n8n/postgres:/var/lib/postgresql/data
-    healthcheck:
-      test: ['CMD-SHELL', 'pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}']
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  n8n:
-    image: n8nio/n8n:latest
-    container_name: n8n
-    restart: unless-stopped
-    ports:
-      - '${N8N_PORT:-5678}:5678'
-    environment:
-      DB_TYPE: postgresdb
-      DB_POSTGRESDB_HOST: postgres
-      DB_POSTGRESDB_PORT: '5432'
-      DB_POSTGRESDB_DATABASE: ${POSTGRES_DB:-n8n}
-      DB_POSTGRESDB_USER: ${POSTGRES_USER:-n8n}
-      DB_POSTGRESDB_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
-      N8N_HOST: ${N8N_HOST:-localhost}
-      N8N_PORT: '5678'
-      N8N_PROTOCOL: ${N8N_PROTOCOL:-http}
-      WEBHOOK_URL: ${WEBHOOK_URL:-}
-      GENERIC_TIMEZONE: ${TZ:-UTC}
-      TZ: ${TZ:-UTC}
-    volumes:
-      - /data/n8n/files:/home/node/.n8n
-    depends_on:
-      postgres:
-        condition: service_healthy

paperless-ngx/docker-compose.yml

@@ -1,39 +0,0 @@
-services:
-  broker:
-    image: docker.io/library/redis:6.0
-    restart: unless-stopped
-  webserver:
-    image: ghcr.io/paperless-ngx/paperless-ngx:latest
-    ports:
-      - '8010:8000'
-    volumes:
-      - /data/paperless-ngx/data:/usr/src/paperless/data
-      - /data/paperless-ngx/media:/usr/src/paperless/media
-      - /data/paperless-ngx/export:/usr/src/paperless/export
-      - /data/paperless-ngx/consume:/usr/src/paperless/consume
-      - /data/paperless-ngx/redis/data:/data
-    environment:
-      PAPERLESS_REDIS: redis://broker:6379
-      USERMAP_UID: ${PUID}
-      USERMAP_GID: ${PGID}
-      PAPERLESS_TIME_ZONE: ${TZ}
-      PAPERLESS_URL: ${PAPERLESSURL}
-      PAPERLESS_SECRET_KEY: ${RANDOMKEY}
-      PAPERLESS_OCR_LANGUAGE: ${LANG}
-      PAPERLESS_ADMIN_USER: ${ADMIN_USER}
-      PAPERLESS_ADMIN_PASSWORD: ${ADMIN_PASS}
-    healthcheck:
-      test:
-        - CMD
-        - curl
-        - '-fs'
-        - '-S'
-        - '--max-time'
-        - '2'
-        - http://localhost:8000
-      interval: 30s
-      timeout: 10s
-      retries: 5
-    depends_on:
-      - broker
-    restart: unless-stopped