feat: implement automated Ansible deployment workflows and secure Anthropic API key management via reverse proxy injection

.github/workflows/deploy-dev.yml

@@ -27,4 +27,5 @@ jobs:
           ansible-playbook \
             -i infra/development/hosts.ini \
             -e "ansible_ssh_private_key_file=~/.ssh/deploy_key" \
+            -e "anthropic_api_key=${{ secrets.ANTHROPIC_API_KEY }}" \
             infra/development/site/deploy-playbook.yml

.github/workflows/deploy-prod.yml

@@ -29,4 +29,5 @@ jobs:
           ansible-playbook \
             -i infra/production/hosts.ini \
             -e "ansible_ssh_private_key_file=~/.ssh/deploy_key" \
+            -e "anthropic_api_key=${{ secrets.ANTHROPIC_API_KEY }}" \
             infra/production/site/deploy-playbook.yml

Caddyfile

@@ -14,6 +14,7 @@
         uri strip_prefix /api/anthropic
         reverse_proxy https://api.anthropic.com {
             header_up Host api.anthropic.com
+            header_up x-api-key "{$ANTHROPIC_API_KEY}"
         }
     }
 

docker-compose.yml

@@ -2,7 +2,7 @@ services:
   frontend:
     build: .
     restart: unless-stopped
-    ports:
+    environment:\n      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}\n    ports:
       - "8080:80"
 
   pocketbase-learning:

infra/development/site/compose.yml

@@ -9,6 +9,8 @@ services:
     image: git.labs.respellion.tech/respellion/learning-platform/learning-platform:latest
     container_name: learning-platform
     restart: unless-stopped
+    environment:
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
     networks:
       - learning-platform
 

infra/development/site/deploy-playbook.yml

@@ -36,6 +36,13 @@
         src: compose.yml
         dest: "{{ dest_dir }}/compose.yml"
 
+    - name: Create .env file for secrets
+      ansible.builtin.copy:
+        dest: "{{ dest_dir }}/.env"
+        content: |
+          ANTHROPIC_API_KEY={{ anthropic_api_key | default('') }}
+        mode: '0600'
+
     - name: Pull latest image
       community.docker.docker_compose_v2:
         project_src: "{{ dest_dir }}"

infra/production/site/compose.yml

@@ -12,6 +12,8 @@ services:
     image: git.labs.respellion.tech/respellion/learning-platform/learning-platform:latest
     container_name: learning-platform
     restart: unless-stopped
+    environment:
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
     networks:
       - learning-platform
 

infra/production/site/deploy-playbook.yml

@@ -36,6 +36,13 @@
         src: compose.yml
         dest: "{{ dest_dir }}/compose.yml"
 
+    - name: Create .env file for secrets
+      ansible.builtin.copy:
+        dest: "{{ dest_dir }}/.env"
+        content: |
+          ANTHROPIC_API_KEY={{ anthropic_api_key | default('') }}
+        mode: '0600'
+
     - name: Pull latest image
       community.docker.docker_compose_v2:
         project_src: "{{ dest_dir }}"

src/lib/api.js

@@ -16,10 +16,7 @@ export const anthropicApi = {
       return await simulateResponse();
     }
 
-    const apiKey = storage.get('admin:anthropic_key') || import.meta.env.VITE_ANTHROPIC_API_KEY;
-    if (!apiKey) {
-      throw new Error('No Anthropic API key found. Please configure it in Admin -> Settings.');
-    }
+    // The API key is now securely injected by the Caddy reverse proxy via environment variables.
 
     // Model is configurable from Admin > Settings, defaults to the original spec model
     const model = storage.get('admin:model') || DEFAULT_MODEL;
@@ -32,7 +29,6 @@ export const anthropicApi = {
           method: 'POST',
           headers: {
             'Content-Type': 'application/json',
-            'x-api-key': apiKey,
             'anthropic-version': '2023-06-01',
             'anthropic-dangerous-direct-browser-access': 'true'
           },