sensors is separate API with td

server/run-prod.sh

@@ -1,35 +1,68 @@
 #!/usr/bin/env bash
-# Production startup (gunicorn) with a stable SECRET_KEY.
+# Production startup (gunicorn). Pick the service and port:
 #
-# Key resolution order:
+#   ./run-prod.sh               # main app on 8000
+#   ./run-prod.sh main 8000     # main app on 8000
+#   ./run-prod.sh sensors 8001  # sensors app on 8001 (localhost only)
+#
+# SECRET_KEY resolution (main app sessions):
 #   1. SECRET_KEY environment variable (takes precedence),
 #   2. .secret_key file next to this script (created once on first start),
 #   3. otherwise a random key is generated and saved to .secret_key.
 #
-# A stable key matters: it signs the session cookies, so changing it
-# on every restart would log out all users.
+# The sensors API is open to every user on the local machine. To expose it
+# on the network explicitly set HOST=0.0.0.0 (or BIND).
 set -euo pipefail
 cd "$(dirname "$0")"
 
-SECRET_FILE=".secret_key"
+APP="${1:-${APP:-main}}"
+PORT="${2:-${PORT:-}}"
 
-if [ -z "${SECRET_KEY:-}" ]; then
-    if [ -f "$SECRET_FILE" ]; then
-        SECRET_KEY="$(cat "$SECRET_FILE")"
-    else
-        SECRET_KEY="$(python3 -c 'import secrets; print(secrets.token_hex(32))')"
-        printf '%s' "$SECRET_KEY" > "$SECRET_FILE"
-        chmod 600 "$SECRET_FILE"
-        echo "Generated a new SECRET_KEY, saved to $SECRET_FILE" >&2
+case "$APP" in
+    main)
+        MODULE="app:create_app"
+        DEFAULT_PORT=8000
+        DEFAULT_HOST="0.0.0.0"
+        ;;
+    sensors)
+        MODULE="sensors_app:create_app"
+        DEFAULT_PORT=8001
+        DEFAULT_HOST="127.0.0.1"
+        ;;
+    *)
+        echo "Usage: $0 [main|sensors] [port]" >&2
+        exit 2
+        ;;
+esac
+
+PORT="${PORT:-$DEFAULT_PORT}"
+HOST="${HOST:-$DEFAULT_HOST}"
+
+if [ "$APP" = "main" ]; then
+    SECRET_FILE=".secret_key"
+    if [ -z "${SECRET_KEY:-}" ]; then
+        if [ -f "$SECRET_FILE" ]; then
+            SECRET_KEY="$(cat "$SECRET_FILE")"
+        else
+            SECRET_KEY="$(python3 -c 'import secrets; print(secrets.token_hex(32))')"
+            printf '%s' "$SECRET_KEY" > "$SECRET_FILE"
+            chmod 600 "$SECRET_FILE"
+            echo "Generated a new SECRET_KEY, saved to $SECRET_FILE" >&2
+        fi
+        export SECRET_KEY
     fi
-    export SECRET_KEY
 fi
 
-# Migrate before starting, so the schema matches the code.
+# Each service runs migrations for its own database.
 if [ -x ".venv/bin/alembic" ]; then
-    .venv/bin/alembic upgrade head
-elif command -v alembic >/dev/null 2>&1; then
-    alembic upgrade head
+    ALEMBIC=".venv/bin/alembic"
+else
+    ALEMBIC="alembic"
+fi
+if [ "$APP" = "main" ]; then
+    "$ALEMBIC" -c alembic_users.ini upgrade head
+else
+    "$ALEMBIC" -c alembic.ini upgrade head
 fi
 
 if [ -x ".venv/bin/gunicorn" ]; then
@@ -38,4 +71,8 @@ else
     GUNICORN="gunicorn"
 fi
 
-exec "$GUNICORN" -c gunicorn.conf.py "app:create_app()"
+export BIND="${BIND:-$HOST:$PORT}"
+echo "Starting $APP app on http://$BIND" >&2
+# Gunicorn needs the factory call syntax ("module:create_app()"), otherwise it
+# treats create_app itself as the WSGI callable.
+exec "$GUNICORN" -c gunicorn.conf.py "$MODULE()"