### Run automated Nix setup script Source: https://docs.ohc.network/contributing/local-development/nix Runs the automated setup script from the repo root for a first-time setup. The script checks that Nix is installed and flakes are enabled, creates the Python virtual environment, installs dependencies, starts services (PostgreSQL, Redis, MinIO), runs migrations, and optionally loads sample fixtures. ```bash ./scripts/nix-dev-setup.sh ``` -------------------------------- ### Manual quick start with nix develop Source: https://docs.ohc.network/contributing/local-development/nix Manual quick start: enters the dev shell, installs Python dependencies into a .venv, starts background services, runs migrations, and launches the unified development server (Django API plus Celery worker). On later days you usually only need nix develop, then start-services (if not already running), then rundev. ```bash nix develop setup-dev start-services rundev ``` -------------------------------- ### Install frontend dependencies with npm install Source: https://docs.ohc.network/contributing/local-development/frontend Installs the frontend dependencies from the root of the care_fe clone. This also runs the project's postinstall step, which installs platform-specific dependencies and generates HTTP headers. ```bash npm install ``` -------------------------------- ### Create virtual environment and install dependencies Source: https://docs.ohc.network/contributing/local-development/backend Creates a virtual environment, activates it, and installs dependencies using pipenv. Requires Python 3 and pipenv. ```bash python3 -m venv .venv source .venv/bin/activate pipenv sync --categories "packages dev-packages docs" ``` -------------------------------- ### Install pre-commit hooks Source: https://docs.ohc.network/contributing/local-development/backend Installs the pre-commit hooks configured in the repository so that linters and formatters run automatically before each commit. Run once after cloning the repository. ```bash pre-commit install ``` -------------------------------- ### Install Cilium CLI and Cilium CNI Source: https://docs.ohc.network/deployment/kubernetes/cluster-setup Install the Cilium CLI (architecture-aware) and then install Cilium itself, pointing it at the internal API name and the pod CIDR allocated by kubeadm. The k8sServiceHost value is a placeholder; use the actual internal API DNS name and ensure the matching /etc/hosts entry exists on every node. ```bash CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt) CLI_ARCH=amd64 if [ "$(uname -m)" = "aarch64" ]; then CLI_ARCH=arm64; fi curl -L --fail --remote-name-all https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum} sha256sum --check cilium-linux-${CLI_ARCH}.tar.gz.sha256sum sudo tar xzvfC cilium-linux-${CLI_ARCH}.tar.gz /usr/local/bin rm cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum} cilium install \ --set k8sServiceHost=kube-api.internal \ --set k8sServicePort=6443 \ --set ipam.mode=kubernetes ``` -------------------------------- ### Add Docker repository and install containerd Source: https://docs.ohc.network/deployment/kubernetes/cluster-setup Adds the Docker apt repository and installs containerd and related packages. Run on every node. ```bash # Add Docker's official GPG key sudo apt update sudo apt install ca-certificates curl sudo install -m 0755 -d /etc/apt/keyrings sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc sudo chmod a+r /etc/apt/keyrings/docker.asc # Add the repository to apt sources sudo tee /etc/apt/sources.list.d/docker.sources < -n longhorn-system \ --from-literal=AWS_ACCESS_KEY_ID=XXX \ --from-literal=AWS_SECRET_ACCESS_KEY=XXX \ --from-literal=AWS_ENDPOINTS= \ --from-literal=AWS_REGION= ``` ```bash python deployer.py apply-k8 volumes ``` -------------------------------- ### Install and hold kubelet, kubeadm, kubectl Source: https://docs.ohc.network/deployment/kubernetes/cluster-setup Updates apt, installs the Kubernetes packages, and holds them to prevent out-of-band upgrades. The cluster is pinned to the v1.34 package line. ```bash sudo apt-get update sudo apt-get install -y kubelet kubeadm kubectl sudo apt-mark hold kubelet kubeadm kubectl ``` -------------------------------- ### Install plugin in editable mode Source: https://docs.ohc.network/contributing/plugins Installs a plugin in editable mode for local development so source edits are picked up without reinstalling. ```bash pip install -e /path/to/plugin ``` -------------------------------- ### Join worker nodes with kubeadm join (example shape) Source: https://docs.ohc.network/deployment/kubernetes/cluster-setup Example shape of the kubeadm join command printed by kubeadm init. Use the exact command printed by kubeadm init, which includes the API server address, token, and CA certificate hash. ```bash # Example shape only — use the exact command printed by `kubeadm init` sudo kubeadm join :6443 --token \ --discovery-token-ca-cert-hash sha256: ``` -------------------------------- ### Set Build and Run Commands for Care Backend Source: https://docs.ohc.network/deployment/providers/digitalocean Build and run commands for the Care Backend app on DigitalOcean App Platform. The build command installs plugins, collects static files, and compiles messages; the run command starts Gunicorn with two workers on port 9000. ```bash python install_plugins.py && python manage.py collectstatic --noinput && python manage.py compilemessages ``` ```bash gunicorn config.wsgi:application --workers 2 --bind :9000 ``` -------------------------------- ### Install deployer Python dependencies Source: https://docs.ohc.network/deployment/kubernetes/requirements Installs the deployer's Python dependencies, including Typer (typer>=0.9.0), which the make targets use to wrap Tofu and kubectl runs. Use a Python virtual environment to avoid dependency collisions. ```bash pip install -r requirements.txt ``` -------------------------------- ### Install Pillow native libraries Source: https://docs.ohc.network/contributing/local-development/backend Installs native image libraries required for Pillow build on macOS. Run if pipenv sync fails while building Pillow. ```bash brew install libjpeg libtiff little-cms2 openjpeg webp freetype harfbuzz fribidi ``` -------------------------------- ### Install Care in editable mode from plugin Source: https://docs.ohc.network/contributing/plugins Installs Care itself in editable mode from inside the plugin when the plugin needs to inherit components from the core app. ```bash pip install -e /path/to/care ``` -------------------------------- ### Install direnv for automatic shell activation Source: https://docs.ohc.network/contributing/local-development/nix Installs direnv for automatic shell activation when you cd into the repo. The command varies by operating system: use Homebrew on macOS, apt on Ubuntu/Debian, and dnf on Fedora. ```bash # macOS (Homebrew) brew install direnv # Linux (varies by distribution) sudo apt install direnv # Ubuntu/Debian sudo dnf install direnv # Fedora ``` -------------------------------- ### Apply Kubernetes configurations with kubectl Source: https://docs.ohc.network/deployment/providers/gcp/gke Applies all Kubernetes YAML files in the specified order: ConfigMaps, Secrets, Deployments, Services, ClusterIssuer, Certificate, and Ingress. After ingress creation, use 'kubectl get ingress care-ingress' to get the load balancer IP. ```bash # Deploy ConfigMaps: kubectl apply -f 'configmaps/*' # Secrets: kubectl apply -f 'secrets/*' # Deployments: kubectl apply -f 'deployments/*' # Services: kubectl apply -f 'services/*' # ClusterIssuer: kubectl apply -f ClusterIssuer/cluster-issuer.yaml # Certificate: kubectl apply -f certificate/certificate.yml # Ingress: kubectl apply -f ingress/care.yaml ``` -------------------------------- ### Add Postgres.app binaries to PATH Source: https://docs.ohc.network/contributing/local-development/backend Adds PostgreSQL binaries to PATH for macOS Postgres.app. Adjust version number to match your install. ```bash export PATH=$PATH:/Applications/Postgres.app/Contents/Versions/14/bin ``` -------------------------------- ### Run the host dev server for in-tree Care App development Source: https://docs.ohc.network/contributing/plugins Run this command from the care_fe host to start the dev server. The host's localPluginDevSupport() auto-discovers every apps/*/src/manifest.tsx and wires each plugin into the Vite module graph, enabling hot reload without a separate build or REACT_ENABLED_APPS entry. ```bash npm run dev ``` -------------------------------- ### Get Current Month's Cost and View CDN Usage Source: https://docs.ohc.network/deployment/providers/gcp/gcs Commands to list billing accounts, view CDN policy for a backend bucket, and optimize storage class by rewriting objects to STANDARD. ```bash # Get current month's cost gcloud billing accounts list # View CDN usage gcloud compute backend-buckets describe [BACKEND_BUCKET_NAME] \ --format="get(cdnPolicy)" # Optimize storage class gsutil rewrite -s STANDARD gs://[BUCKET_NAME]/** ``` -------------------------------- ### Run the development server with npm run dev Source: https://docs.ohc.network/contributing/local-development/frontend Starts the Vite development server at http://localhost:4000 with hot reload. The page reloads automatically on edits and lint errors appear in the terminal. ```bash npm run dev ``` -------------------------------- ### Enable Django dotenv reading Source: https://docs.ohc.network/contributing/local-development/backend Tells Django to read the .env file. Run in the shell before starting Django commands. ```bash export DJANGO_READ_DOT_ENV_FILE=true ``` -------------------------------- ### Apply OpenSearch cluster manifest Source: https://docs.ohc.network/deployment/kubernetes/deploying-care Applies the OpenSearch cluster manifest after installing the OpenSearch controller. ```bash kubectl apply -f infra/opensearch/cluster.yaml ``` -------------------------------- ### Add Kubernetes signing key and apt source for v1.34 Source: https://docs.ohc.network/deployment/kubernetes/cluster-setup Adds the Kubernetes apt repository signing key and source for the v1.34 package line. The repository path and installed version must stay on the same line across all nodes. ```bash curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.34/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.34/deb/ /' | sudo tee /etc/apt/sources.list.d/kubernetes.list ``` -------------------------------- ### Build Docker images with make build Source: https://docs.ohc.network/contributing/local-development/backend Builds the Docker images for the Care backend stack. The first build pulls base images and installs dependencies, so it can take a while depending on your machine and network speed. ```bash make build ``` -------------------------------- ### plug_config.py plugin configuration Source: https://docs.ohc.network/deployment/providers/gcp/gke Python script to configure plugins for the care backend. Includes an example HCX plugin and a PlugManager instance. ```python from plugs.manager import PlugManager from plugs.plug import Plug hcx_plugin = Plug( name="hcx", package_name="git+https://github.com/ohcnetwork/care_hcx.git", version="@main", configs={}, ) plugs = [hcx_plugin] manager = PlugManager(plugs) ``` -------------------------------- ### Enable Nix flakes in nix.conf Source: https://docs.ohc.network/contributing/local-development/nix Enables Nix flakes by adding this line to ~/.config/nix/nix.conf. Modern installers enable flakes automatically, so this is only needed if yours did not. ```ini experimental-features = nix-command flakes ``` -------------------------------- ### Install barman-cloud plugin manifest Source: https://docs.ohc.network/deployment/kubernetes/operations Applies the CloudNativePG barman-cloud plugin manifest from the official release. Required before configuring PostgreSQL backups with WAL archiving and base backups to S3-compatible storage. ```bash kubectl apply -f \ https://github.com/cloudnative-pg/plugin-barman-cloud/releases/download/v0.10.0/manifest.yaml ``` -------------------------------- ### Configure direnv to use the flake Source: https://docs.ohc.network/contributing/local-development/nix Configures direnv to use the Nix flake from the repo root. Run these commands after installing direnv to enable automatic shell activation. ```bash echo "use flake" > .envrc direnv allow ``` -------------------------------- ### Check Bucket Permissions and Test Access Source: https://docs.ohc.network/deployment/providers/gcp/gcs Commands to get bucket IAM permissions, update permissions to allow public object viewing, and test access with curl. ```bash # Check bucket permissions gsutil iam get gs://[BUCKET_NAME] # Update permissions gsutil iam ch allUsers:objectViewer gs://[BUCKET_NAME] # Test access curl -I https://[DOMAIN_NAME] ``` -------------------------------- ### react.env environment configuration Source: https://docs.ohc.network/deployment/providers/gcp/gke Environment variables for the React frontend, including API URLs, logos, and feature flags. Replace example values with production values. ```plaintext REACT_PLAUSIBLE_SERVER_URL=https://plausible.example.com REACT_HEADER_LOGO='{"light":"https://cdn.ohc.network/header_logo.png","dark":"https://cdn.ohc.network/header_logo.png"}' REACT_MAIN_LOGO='{"light":"https://cdn.ohc.network/light-logo.svg","dark":"https://cdn.ohc.network/black-logo.svg"}' REACT_GMAPS_API_KEY="examplekey" REACT_GOV_DATA_API_KEY="" REACT_RECAPTCHA_SITE_KEY="" REACT_SENTRY_DSN="" REACT_SAMPLE_FORMAT_ASSET_IMPORT="" REACT_SAMPLE_FORMAT_EXTERNAL_RESULT_IMPORT="" REACT_KASP_ENABLED="" REACT_ENABLE_HCX="" REACT_ENABLE_ABDM="" REACT_ENABLE_SCRIBE="" REACT_WARTIME_SHIFTING="" REACT_OHCN_URL="" REACT_PLAUSIBLE_SITE_DOMAIN="care.example.com" REACT_SENTRY_ENVIRONMENT="" REACT_CARE_API_URL="https://care.example.com" REACT_DASHBOARD_URL="" ``` -------------------------------- ### Add /etc/hosts entry for kube-api.internal Source: https://docs.ohc.network/deployment/kubernetes/cluster-setup Add an entry mapping the cluster's internal API DNS name to the primary node's IP in /etc/hosts on every node before installing Cilium. The API host must resolve on each node or Cilium pods will not come up. ```plaintext # /etc/hosts on every node kube-api.internal ``` -------------------------------- ### GET {resource}/favorite_lists/ Source: https://docs.ohc.network/references/platform/favorites Returns the list of favorite list names for the user and resource. The facility is resolved from the facility_external_id kwarg or the facility query parameter. The response is cache-first, falling back to the database. ```APIDOC ## GET {resource}/favorite_lists/ ### Description Returns the list of favorite list names for the user and resource. The facility is resolved from the facility_external_id kwarg or the facility query parameter. The response is cache-first, falling back to the database. ### Method GET ### Endpoint {resource}/favorite_lists/ ### Parameters #### Path Parameters - **resource** (string) - Required - The owning resource name (e.g., questionnaire). #### Query Parameters - **facility** (string) - Optional - The facility external ID used to resolve the facility scope. ### Response #### Success Response (200) Returns an object with a lists array containing favorite list names. #### Response Example { "lists": ["my-list", "other-list"] } ``` -------------------------------- ### Set up backend bucket, URL map, HTTP proxy, and global IP Source: https://docs.ohc.network/deployment/providers/gcp/gcs Creates a backend bucket with CDN enabled, a URL map pointing to it, an HTTP proxy, and reserves a global IP address. Replace bracketed placeholders with actual resource names. ```bash # Create backend bucket with CDN gcloud compute backend-buckets create [BACKEND_BUCKET_NAME] \ --gcs-bucket-name=[BUCKET_NAME] \ --enable-cdn # Configure URL map gcloud compute url-maps create [URL_MAP_NAME] \ --default-backend-bucket=[BACKEND_BUCKET_NAME] # Create HTTP proxy gcloud compute target-http-proxies create [HTTP_PROXY_NAME] \ --url-map=[URL_MAP_NAME] # Reserve global IP gcloud compute addresses create [IP_ADDRESS_NAME] --global ``` -------------------------------- ### GitHub Actions workflow for ECS deployment Source: https://docs.ohc.network/deployment/providers/aws/ecs GitHub Actions workflow that builds and pushes a Docker image to GHCR and Docker Hub, then deploys to ECS. Triggered manually, on pushes to develop, or on tags starting with v. Uses secrets for AWS credentials and Docker Hub authentication. ```yaml name: Deploy Care on: workflow_dispatch: push: tags: - 'v*' branches: - develop paths-ignore: - "docs/**" concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true env: IMAGE_NAME: care AWS_DEFAULT_REGION: ap-south-1 AWS_DEFAULT_OUTPUT: json AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} # AWS Access Key ID for authentication AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} # AWS Secret Access Key for authentication ECS_SERVICE_BACKEND: "care-backend" # ECS service name for the backend ECS_SERVICE_CELERY: "care-celery" # ECS service name for Celery ECS_CLUSTER: "example_cluster" # Name of the ECS cluster ECS_TASK_DEFINITION_BACKEND: "./aws/backend.json" # Path to the backend task definition ECS_TASK_DEFINITION_CELERY: "./aws/celery.json" # Path to the Celery task definition CONTAINER_NAME_BACKEND: "care-backend" # Container name for the backend CONTAINER_NAME_WORKER: "care-celery-worker" # Container name for the Celery worker CONTAINER_NAME_CRON: "care-celery-beat" # Container name for the Celery beat jobs: build: name: Build & Push to container registries runs-on: ubuntu-latest steps: - name: Checkout repository uses: actions/checkout@v4 - name: Generate docker tags id: meta uses: docker/metadata-action@v5 with: images: | ghcr.io/${{ github.repository }} ${{ secrets.DOCKER_HUB_USERNAME }}/${{ github.event.repository.name }} tags: | type=raw,value=production-latest,enable=${{ startsWith(github.event.ref, 'refs/tags/v') }} type=raw,value=production-latest-${{ github.run_number }}-{{date 'YYYYMMDD'}}-{{sha}},enable=${{ startsWith(github.event.ref, 'refs/tags/v') }} type=raw,value=latest,enable=${{ github.ref == 'refs/heads/develop' }} type=raw,value=latest-${{ github.run_number }},enable=${{ github.ref == 'refs/heads/develop' }} type=semver,pattern={{version}} flavor: latest=false - name: Setup QEMU uses: docker/setup-qemu-action@v3 - name: Setup Docker Buildx uses: docker/setup-buildx-action@v3 - name: Login to DockerHub uses: docker/login-action@v3 with: username: ${{ secrets.DOCKER_HUB_USERNAME }} # DockerHub username password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }} # DockerHub access token - name: Login to GitHub Container Registry uses: docker/login-action@v3 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} # GitHub token for authentication - name: Cache Docker layers uses: actions/cache@v4 with: path: /tmp/.buildx-cache key: ${{ runner.os }}-buildx-build-${{ hashFiles('Pipfile.lock', 'docker/prod.Dockerfile') }} restore-keys: | ${{ runner.os }}-buildx-build- - name: Build and push image uses: docker/build-push-action@v6 with: context: . file: docker/prod.Dockerfile push: true provenance: false platforms: linux/amd64,linux/arm64 tags: ${{ steps.meta.outputs.tags }} build-args: | APP_VERSION=${{ github.sha }} ADDITIONAL_PLUGS=${{ secrets.ADDITIONAL_PLUGS }} # Additional plugins cache-from: type=local,src=/tmp/.buildx-cache cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max - name: Move cache run: | rm -rf /tmp/.buildx-cache mv /tmp/.buildx-cache-new /tmp/.buildx-cache deploy: name: Deploy to ECS runs-on: ubuntu-latest environment: name: Deployment-ecs url: https://careapi.example.com steps: - name: Checkout repository uses: actions/checkout@v4 - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@v4 ``` -------------------------------- ### Create application namespaces Source: https://docs.ohc.network/deployment/kubernetes/cluster-setup Creates the namespaces the deployer expects to exist before applying resources: care-be, care-fe, odoo, metabase, and rustfs. ```bash kubectl create namespace care-be kubectl create namespace care-fe kubectl create namespace odoo kubectl create namespace metabase kubectl create namespace rustfs ``` -------------------------------- ### Seed data with make load-fixtures Source: https://docs.ohc.network/contributing/local-development/backend Loads the fixtures (base roles, permissions, and reference data) so the app is usable. ```bash make load-fixtures ``` -------------------------------- ### Module operations: apply-tofu and apply-k8 Source: https://docs.ohc.network/deployment/kubernetes/deploying-care Shows the two operations per module: apply-tofu for OpenTofu provisioning and apply-k8 for Kubernetes manifests, each with a make proxy. ```bash python deployer.py apply-tofu make apply-tofu- python deployer.py apply-k8 make apply-k8- ``` -------------------------------- ### Configure DATABASE_URL in .env Source: https://docs.ohc.network/contributing/local-development/backend Sets the database connection string in a .env file at the repository root. Replace my_username and my_password with your credentials. ```bash DATABASE_URL=postgres://my_username:my_password@localhost:5432/care ``` -------------------------------- ### Configure REACT_CARE_API_URL in .env.local Source: https://docs.ohc.network/contributing/local-development/frontend Create a .env.local file in the project root and set the API URL to your local backend. The backend listens on port 9000, so the URL expects that. Ensure the backend is running and has dummy data loaded before signing in. ```bash # Point the frontend to your local backend REACT_CARE_API_URL=http://127.0.0.1:9000 ``` -------------------------------- ### Create GCS bucket and set permissions with gsutil Source: https://docs.ohc.network/deployment/providers/gcp/gcs Creates a bucket in asia-south1, grants public objectViewer access, and enables versioning. Replace [BUCKET_NAME] with your bucket name. ```bash # Create bucket in specified region gsutil mb -l asia-south1 gs://[BUCKET_NAME] # Set public access permissions gsutil iam ch allUsers:objectViewer gs://[BUCKET_NAME] # Enable bucket versioning gsutil versioning set on gs://[BUCKET_NAME] ``` -------------------------------- ### Enable Monitoring Service and Create Workspace Source: https://docs.ohc.network/deployment/providers/gcp/gcs Commands to enable the Cloud Monitoring API and create a monitoring workspace for the GCS website. ```bash # Enable monitoring service gcloud services enable monitoring.googleapis.com # Create monitoring workspace gcloud monitoring workspaces create [WORKSPACE_NAME] \ --display-name="GCS Website Monitoring" ``` -------------------------------- ### Run full test suite with make test Source: https://docs.ohc.network/contributing/local-development/backend Runs the full test suite for the Care backend. ```bash make test ``` -------------------------------- ### GET /file-uploads/ Source: https://docs.ohc.network/references/platform/file-upload Lists file uploads for a given associating resource and file type. Only returns rows where `upload_completed` is true. ```APIDOC ## GET /file-uploads/ ### Description Lists file uploads for a given associating resource and file type. Only returns rows where `upload_completed` is true. ### Method GET ### Endpoint /file-uploads/ ### Parameters #### Query Parameters - **associating_id** (string) - Required - The identifier of the owning resource. - **file_type** (string) - Required - The type of the file. ### Response #### Success Response (200) - **FileUploadListSpec[]** (array) - List of file upload records. #### Response Example ```json [ { "external_id": "abc-123", "original_name": "example.pdf", "upload_completed": true } ] ``` ``` -------------------------------- ### Create Backup Script and Configure Retention Policy Source: https://docs.ohc.network/deployment/providers/gcp/gcs Creates a backup script that copies the bucket to a backup bucket and sets a lifecycle policy, then creates a lifecycle.json file with a 30-day deletion rule. ```bash # Create backup script cat > backup.sh < lifecycle.json </ from there. ```bash # Select the active environment python deployer.py set-current-env # or make set-current-env # Inspect the current selection and its resolved config python deployer.py show-current-env python deployer.py show-defaults ``` -------------------------------- ### Get load balancer IP address with gcloud Source: https://docs.ohc.network/deployment/providers/gcp/gcs Retrieves the global IP address of the specified address name, useful for creating DNS records. ```bash gcloud compute addresses describe [IP_ADDRESS_NAME] --global --format="get(address)" ``` -------------------------------- ### Verify bucket, SSL certificate, and load balancer Source: https://docs.ohc.network/deployment/providers/gcp/gcs Checks the bucket configuration with gsutil ls -L, describes the SSL certificate, and tests the load balancer with curl -I against the domain. ```bash # Verify bucket setup gsutil ls -L gs://[BUCKET_NAME] # Check SSL certificate gcloud compute ssl-certificates describe [SSL_CERT_NAME] # Test load balancer curl -I https://[DOMAIN_NAME] ``` -------------------------------- ### Post-deployment verification commands Source: https://docs.ohc.network/deployment/providers/gcp/gcs Verifies the deployment by checking website accessibility with curl, inspecting cache headers on index.html and a static JS file, and describing the backend bucket to check CDN status. Replace [DOMAIN_NAME] and [BACKEND_BUCKET_NAME] with your values. ```bash # Check website accessibility curl -I https://[DOMAIN_NAME] # Verify cache headers curl -I https://[DOMAIN_NAME]/index.html curl -I https://[DOMAIN_NAME]/static/js/main.js # Check CDN status gcloud compute backend-buckets describe [BACKEND_BUCKET_NAME] ``` -------------------------------- ### Deploy monitoring stack with deployer.py apply-tofu monitoring Source: https://docs.ohc.network/deployment/kubernetes/operations Runs the monitoring module deployment via the deployer script. Use after Care is running on the cluster. The stack includes Prometheus, Grafana, Loki, and Alloy. ```bash python deployer.py apply-tofu monitoring ``` -------------------------------- ### GET {resource}/?favorite_list= Source: https://docs.ohc.network/references/platform/favorites Filters the resource list to only include favorites from the specified list. The list is ordered by favorite position. An empty or unknown list returns an empty queryset. ```APIDOC ## GET {resource}/?favorite_list= ### Description Filters the resource list to only include favorites from the specified list. The list is ordered by favorite position. An empty or unknown list returns an empty queryset. ### Method GET ### Endpoint {resource}/ ### Parameters #### Path Parameters - **resource** (string) - Required - The owning resource name (e.g., questionnaire). #### Query Parameters - **favorite_list** (string) - Required - The name of the favorite list to filter by. ### Response #### Success Response (200) Returns a list of resource objects that are in the favorite list, ordered by favorite position. #### Response Example [ { "id": 1, "name": "Example" } ] ``` -------------------------------- ### Create SSL certificate, HTTPS proxy, and forwarding rules Source: https://docs.ohc.network/deployment/providers/gcp/gcs Creates a managed SSL certificate for your domain, an HTTPS proxy using it, and both HTTP (port 80) and HTTPS (port 443) forwarding rules. Requires [SSL_CERT_NAME], [DOMAIN_NAME], and other placeholders. ```bash # Create SSL certificate gcloud compute ssl-certificates create [SSL_CERT_NAME] \ --domains=[DOMAIN_NAME] # Create HTTPS proxy gcloud compute target-https-proxies create [HTTPS_PROXY_NAME] \ --url-map=[URL_MAP_NAME] \ --ssl-certificates=[SSL_CERT_NAME] # Create forwarding rules gcloud compute forwarding-rules create [HTTP_FORWARDING_RULE] \ --load-balancing-scheme=EXTERNAL \ --global \ --address=[IP_ADDRESS_NAME] \ --target-http-proxy=[HTTP_PROXY_NAME] \ --ports=80 gcloud compute forwarding-rules create [HTTPS_FORWARDING_RULE] \ --load-balancing-scheme=EXTERNAL \ --global \ --address=[IP_ADDRESS_NAME] \ --target-https-proxy=[HTTPS_PROXY_NAME] \ --ports=443 ``` -------------------------------- ### Create VPC and subnet with gcloud Source: https://docs.ohc.network/deployment/providers/gcp/gke Command-line equivalent for creating the care-vpc network and cluster-snet subnet. Uses $PROJECT variable and sets MTU, routing mode, and private Google access. ```bash gcloud compute networks create care-vpc --project=$PROJECT --subnet-mode=custom --mtu=1460 --bgp-routing-mode=regional gcloud compute networks subnets create cluster-snet --project=$PROJECT --range=10.0.0.0/16 --stack-type=IPV4_ONLY --network=care-vpc --region=asia-south1 --enable-private-ip-google-access ``` -------------------------------- ### Create PostgreSQL role and database Source: https://docs.ohc.network/contributing/local-development/backend Creates a PostgreSQL role and database for the project. Run in psql. Replace my_username and my_password with your own credentials. ```sql CREATE ROLE my_username LOGIN PASSWORD 'my_password'; CREATE DATABASE care WITH OWNER = my_username; ``` -------------------------------- ### Run Celery Worker Command Source: https://docs.ohc.network/deployment/providers/digitalocean Run command for the Celery worker component. Starts a Celery worker with a maximum of 2 tasks per child, concurrency of 2, debug logging, and stdout logfile. ```bash celery --app=config.celery_app worker --max-tasks-per-child=2 --concurrency=2 --loglevel=DEBUG --logfile stdout ``` -------------------------------- ### Declare a permission with Permission dataclass Source: https://docs.ohc.network/references/access-governance/permission Declares a single permission as a member of a permissions enum. The member name becomes the slug; the value is a Permission dataclass with name, description, context, and default roles. This example is from care/security/permissions/patient.py. ```python can_create_patient = Permission( "Can Create Patient", "", PermissionContext.PATIENT, [STAFF_ROLE, DOCTOR_ROLE, NURSE_ROLE, ADMINISTRATOR, ADMIN_ROLE, FACILITY_ADMIN_ROLE], ) ``` -------------------------------- ### Check SSL Certificate Status and Update Source: https://docs.ohc.network/deployment/providers/gcp/gcs Commands to describe SSL certificates, verify domain mapping via target HTTPS proxies, and create a new certificate for a domain. ```bash # Check certificate status gcloud compute ssl-certificates describe [SSL_CERT_NAME] # Verify domain mapping gcloud compute target-https-proxies describe [HTTPS_PROXY_NAME] # Update certificate gcloud compute ssl-certificates create [SSL_CERT_NAME]-new \ --domains=[DOMAIN_NAME] ``` -------------------------------- ### Set CORS policy on GCS bucket with gsutil Source: https://docs.ohc.network/deployment/providers/gcp/gcs Applies a CORS configuration allowing specified origins and methods (GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH) with a 3600‑second max age. Replace [DOMAIN_NAME] and [BUCKET_NAME]. ```bash gsutil cors set '[ { "origin": ["https://[DOMAIN_NAME]"], "method": ["GET", "HEAD", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"], "responseHeader": ["Content-Type", "Access-Control-Allow-Origin", "Access-Control-Allow-Methods", "Access-Control-Allow-Headers"], "maxAgeSeconds": 3600 } ]' gs://[BUCKET_NAME] ``` -------------------------------- ### Run single test with make test path Source: https://docs.ohc.network/contributing/local-development/backend Runs a single test file, class, or method by passing a dotted path to the make test command. ```bash make test path= ``` -------------------------------- ### Seed data and create admin user Source: https://docs.ohc.network/contributing/local-development/backend Seeds data and creates an admin user. Run directly in the virtual environment. ```bash python manage.py load_fixtures python manage.py createsuperuser ``` -------------------------------- ### Create admin user with createsuperuser Source: https://docs.ohc.network/contributing/local-development/backend Creates an admin user by following the prompts to set username, email, and password. You can then sign in to the API and, with the frontend running, the web app. ```bash docker compose exec backend python manage.py createsuperuser ``` -------------------------------- ### Cloud Build configuration for deploy-care Source: https://docs.ohc.network/deployment/providers/gcp/gke Inline Cloud Build YAML that clones the infra repo, downloads the care backend, and copies build files. Uses substitution variables like $_BE_TAG and $_INFRA_REPO. ```yaml steps: - name: ubuntu args: - '-c' - | echo "be $_BE_TAG" \ && echo "fe $_FE_TAG" \ && echo "metabase $_METABASE_TAG" entrypoint: bash - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk:slim' args: - '-c' - | gcloud source repos clone $_INFRA_REPO infra cd infra git config user.name "CloudBuild" git config user.email example@cloudbuild.gserviceaccount.com dir: /workspace id: clone-infra entrypoint: bash - name: gcr.io/cloud-builders/gsutil args: - '-c' - | if [[ -n "$_BE_TAG" ]]; then curl -L https://github.com/ohcnetwork/care/archive/$_BE_TAG.zip -o care.zip unzip care.zip mv care-$_BE_TAG care else echo "Skipping..." fi dir: /workspace id: download-care entrypoint: bash - name: ubuntu args: - '-c' - | if [[ -n "$_BE_TAG" ]]; then cp -r /workspace/infra/build/. /workspace/care else echo "Skipping..." fi id: copy-build-files entrypoint: bash - name: gcr.io/cloud-builders/docker args: - '-c' - | if [[ -n "$_BE_TAG" ]]; then ``` -------------------------------- ### Check Kubernetes cluster connectivity with deployer.py Source: https://docs.ohc.network/deployment/kubernetes/deploying-care Sanity-check connectivity to the selected cluster. Run this after selecting the environment to verify the kubeconfig path is valid. ```bash python deployer.py check-k8-cluster ``` -------------------------------- ### Enable uniform bucket-level access and encryption Source: https://docs.ohc.network/deployment/providers/gcp/gcs Turns on uniform bucket-level access and enables bucket encryption for the specified bucket. Use [BUCKET_NAME] placeholder. ```bash # Set uniform bucket-level access gsutil bucketiam set bucketpolicyonly:on gs://[BUCKET_NAME] # Configure bucket encryption gsutil bucketencryption set on gs://[BUCKET_NAME] ``` -------------------------------- ### Stop and reset with make down and make teardown Source: https://docs.ohc.network/contributing/local-development/backend Stops and removes containers. `make down` keeps data volumes, while `make teardown` also removes volumes, wiping the database. ```bash # Stop and remove containers, keeping your data volumes make down # Stop and remove containers AND their volumes (wipes the database) make teardown ``` -------------------------------- ### Enable systemd cgroup driver in containerd Source: https://docs.ohc.network/deployment/kubernetes/cluster-setup Enables the systemd cgroup driver in containerd to match the kubelet's cgroup management. Restarts containerd after the change. ```bash containerd config default > config.toml sudo mv config.toml /etc/containerd/config.toml sudo sed -i "s/SystemdCgroup = false/SystemdCgroup = true/g" /etc/containerd/config.toml sudo systemctl restart containerd ``` -------------------------------- ### Enable favorites on a viewset with EMRFavoritesMixin Source: https://docs.ohc.network/references/platform/favorites Opts a viewset into favorites by mixing in EMRFavoritesMixin, adding FavoritesFilter to filter_backends, and setting FAVORITE_RESOURCE to the questionnaire resource value. The client never supplies resource_type; it is fixed by this attribute. ```python class QuestionnaireViewSet(EMRModelViewSet, EMRFavoritesMixin): filter_backends = [filters.DjangoFilterBackend, FavoritesFilter] FAVORITE_RESOURCE = FavoriteResourceChoices.questionnaire.value ``` -------------------------------- ### Declare a backend plugin with Plug and PlugManager Source: https://docs.ohc.network/contributing/plugins Declares a backend plugin in plug_config.py using the Plug and PlugManager classes. Each Plug specifies a package_name (here a Git source), a version, and a configs dictionary passed to the plugin. The PlugManager automatically mounts the plugin's URLs under /api//. ```python from plugs.manager import PlugManager from plugs.plug import Plug my_plugin = Plug( name="my_plugin", package_name="git+https://github.com/octo/my_plugin.git", version="@v1.0.0", configs={ "SERVICE_API_KEY": "my_api_key", "SERVICE_SECRET_KEY": "my_secret_key", "VALUE_1_MAX": 10, }, ) plugs = [my_plugin] manager = PlugManager(plugs) ``` -------------------------------- ### Set CORS with gsutil Source: https://docs.ohc.network/deployment/providers/gcp/gke Command-line equivalent for applying the CORS configuration to both storage buckets. ```bash gsutil cors set cors.json gs://-care-facility gsutil cors set cors.json gs://-care-patient-data ``` -------------------------------- ### Upload build files to GCS bucket Source: https://docs.ohc.network/deployment/providers/gcp/gcs Uploads all build files from the local dist/ directory to the specified GCS bucket using gsutil with parallel multi-threading (-m). Replace [BUCKET_NAME] with your actual bucket name. ```bash # Upload all build files gsutil -m cp -r dist/* gs://[BUCKET_NAME]/ ``` -------------------------------- ### Request and data flow diagram Source: https://docs.ohc.network/deployment/kubernetes/architecture ASCII diagram showing the high-level request and data flow from clients through ingress controllers (public and private nginx) to the Care frontend and backend, then to the datastores: PostgreSQL (CNPG), Valkey/Redis, OpenSearch, and RustFS. Supporting services like Odoo, Metabase, and the monitoring stack sit alongside this path. ```text Clients (browsers, integrations) | v +-------------------------------------------------+ | Ingress controllers (nginx + WAF / OWASP CRS) | | TLS termination (Let's Encrypt wildcard) | | public-nginx | private-nginx | +-------------------------------------------------+ | | v v +----------------+ +------------------+ | Care FE | | Care BE | | (nginx) | ---> | web + celery | +----------------+ | + beat | +------------------+ | +----------------+----------------+----------------+ v v v v +-------------+ +-------------+ +-------------+ +-------------+ | PostgreSQL | | Valkey/ | | OpenSearch | | RustFS | | (CNPG) | | Redis | | (search) | | (S3 object | | care DB | | cache/broker| | | | storage) | +-------------+ +-------------+ +-------------+ +-------------+ ``` -------------------------------- ### Initialize control plane with kubeadm init Source: https://docs.ohc.network/deployment/kubernetes/cluster-setup Initializes the Kubernetes control plane on the primary node using the checked-in kubeadm.yaml. The configuration defines the control-plane endpoint, API server SANs, version, and pod/service subnets. ```bash sudo kubeadm init --config kubeadm.yaml ``` -------------------------------- ### Storage model inheritance chain Source: https://docs.ohc.network/references/foundation/base-model Shows the inheritance chain of the storage-layer abstract models. All are abstract=True and none owns a database table. ```text models.Model └─ BaseModel (care/utils/models/base.py) ├─ BaseFlag (care/utils/models/base.py) └─ EMRBaseModel (care/emr/models/base.py) └─ SlugBaseModel ``` -------------------------------- ### Run Helm script Source: https://docs.ohc.network/deployment/providers/gcp/gke Executes the Helm deployment script located at helm/scripts.sh. This is part of the initial deployment process. ```bash bash helm/scripts.sh ``` -------------------------------- ### Reserve static IP address with gcloud Source: https://docs.ohc.network/deployment/providers/gcp/gke Command-line equivalent for reserving the pip-care regional static IP address in asia-south1. ```bash gcloud compute addresses create pip-care --project=$PROJECT --region=asia-south1 ``` -------------------------------- ### Run Celery Beat Command Source: https://docs.ohc.network/deployment/providers/digitalocean Run command for the Celery Beat component. Runs Django migrations. ```bash python manage.py migrate ``` -------------------------------- ### Run Django tests Source: https://docs.ohc.network/contributing/local-development/backend Runs the test suite. ```bash python manage.py test ```