pal-e-docs

Deployment — westside-streamlit

arch-deployment-westside-streamlit Doc

architecture active mermaid
Project

Deployment — westside-streamlit

Where the service runs and how it connects to the basketball database. Current state is "local only" — the diagram below shows both the current reality and the target state.

Current — local dev loop




          
  
Target — deployed via the standard platform pipeline



          
  



          
  
Gap to target



          
    
The following pieces are missing and live as tickets on board-westside-streamlit:



          
  
    
      
  • Dockerfile — multi-stage build producing a small Python 3.12 + streamlit image.
    • 
      
  • Woodpecker pipeline — .woodpecker.yaml mirroring the basketball-api pattern (test, build, push to Harbor, update pal-e-deployments overlay).
    • 
      
  • Harbor robot account — per-service credential for the Woodpecker build step.
    • 
      
  • Kustomize overlay in pal-e-deployments — Deployment + Service + SOPS-encrypted Secret for PGURL.
    • 
      
  • Tailscale funnel — new dedicated hostname (never stomp archbox per feedback_never_stomp_archbox). Proposal: westside-ops.tail5b443a.ts.net.
    • 
      
  • ArgoCD Application pointing at the new overlay.
    • 
      
  • Keycloak OIDC (optional, post-MVP) — even though the app is read-only, the data is sensitive (parent emails, phone numbers). Wrap it in Keycloak auth before exposing on a public funnel.
    • 



          
  
DB connection detail



          
    
In-cluster, the connection target is pal-e-postgres-rw.postgres.svc.cluster.local:5432 (the read-write endpoint). The database name is basketball; credentials come from a dedicated read-only role (to be created in a backlog ticket — the basketball-api role has write privileges we don't need).