bf9e60e607
Deployed to win11 + IIS + MySQL 5.6 end to end; fixed what broke.
- requirements.txt: add tzdata. Windows has no IANA tz database, so
ZoneInfo('America/New_York') (notifications recognition/recert) fails and the
plugin won't import. Also confirmed waitress (added earlier) is required.
- deploy/windows/web.config: comment out the X-Forwarded-For <rewrite> block by
default - it needs URL Rewrite, and with it active but the module absent IIS
returns HTTP 500.19. Uncomment after installing URL Rewrite.
- docs/DEPLOY-WINDOWS-IIS.md: add the required `appcmd unlock config` step for
system.webServer/handlers + httpPlatform (locked server-wide by default ->
500.19 without it) and the app-pool icacls grant.
Verified: IIS -> HttpPlatformHandler -> waitress -> app on :8090, all plugins
load, admin login works.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
73 lines
2.9 KiB
XML
73 lines
2.9 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!--
|
|
IIS site config for shopdb-flask via HttpPlatformHandler.
|
|
|
|
IIS launches waitress (a Windows-friendly WSGI server; gunicorn does NOT run
|
|
on Windows) and forwards requests to it on a private loopback port that IIS
|
|
assigns via %HTTP_PLATFORM_PORT%. One process serves both /api and the built
|
|
Vue SPA (frontend/dist), so no separate static site is needed.
|
|
|
|
Prerequisites on the box:
|
|
- HttpPlatformHandler IIS module installed
|
|
(https://www.iis.net/downloads/microsoft/httpplatformhandler)
|
|
- URL Rewrite module installed (only for the optional X-Forwarded-For rule)
|
|
- Python 3.12 + a venv at APP_ROOT\venv with requirements.txt + waitress
|
|
- Secrets live in APP_ROOT\.env (wsgi.py load_dotenv() reads it). Keep them
|
|
OUT of this file. Lock .env ACLs to the app pool identity + admins.
|
|
|
|
Replace APP_ROOT (C:\shopdb-flask below) with the real deploy path. The IIS
|
|
site's physical path MUST be APP_ROOT (where wsgi.py lives).
|
|
-->
|
|
<configuration>
|
|
<system.webServer>
|
|
|
|
<handlers>
|
|
<add name="httpplatformhandler" path="*" verb="*"
|
|
modules="httpPlatformHandler" resourceType="Unspecified" />
|
|
</handlers>
|
|
|
|
<httpPlatform
|
|
processPath="C:\shopdb-flask\venv\Scripts\waitress-serve.exe"
|
|
arguments="--port=%HTTP_PLATFORM_PORT% --host=127.0.0.1 --threads=8 wsgi:app"
|
|
stdoutLogEnabled="true"
|
|
stdoutLogFile="C:\shopdb-flask\logs\httpplatform"
|
|
startupTimeLimit="120"
|
|
startupRetryCount="3">
|
|
<environmentVariables>
|
|
<!-- FLASK_ENV MUST be production here or wsgi.py defaults to the dev
|
|
config (SQL echo, debug, wrong DB URL). Real secrets go in .env. -->
|
|
<environmentVariable name="FLASK_ENV" value="production" />
|
|
<environmentVariable name="PYTHONPATH" value="C:\shopdb-flask" />
|
|
</environmentVariables>
|
|
</httpPlatform>
|
|
|
|
<!--
|
|
OPTIONAL: forward the real client IP so audit logs and the kiosk
|
|
visitor-location feature (IP -> business unit) see the caller, not the
|
|
loopback that HttpPlatformHandler connects from.
|
|
|
|
This block is COMMENTED OUT by default because it needs the URL Rewrite
|
|
module; with it uncommented but URL Rewrite not installed, IIS returns
|
|
HTTP 500.19 ("configuration section not well-formed / cannot be read").
|
|
Install URL Rewrite (https://www.iis.net/downloads/microsoft/url-rewrite)
|
|
and then uncomment the <rewrite> block below to enable it.
|
|
|
|
<rewrite>
|
|
<allowedServerVariables>
|
|
<add name="HTTP_X_FORWARDED_FOR" />
|
|
</allowedServerVariables>
|
|
<rules>
|
|
<rule name="Set X-Forwarded-For" stopProcessing="false">
|
|
<match url=".*" />
|
|
<serverVariables>
|
|
<set name="HTTP_X_FORWARDED_FOR" value="{REMOTE_ADDR}" />
|
|
</serverVariables>
|
|
<action type="None" />
|
|
</rule>
|
|
</rules>
|
|
</rewrite>
|
|
-->
|
|
|
|
</system.webServer>
|
|
</configuration>
|