Foss4geu helmchart

.github/workflows/ci.yml

@@ -17,3 +17,20 @@ jobs:
         run: uv run ruff check
       - name: Format
         run: uv run ruff format --check
+
+  helm:
+    name: Helm chart
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: azure/setup-helm@v4
+      - name: Register dependency repos
+        run: |
+          helm repo add eoapi https://developmentseed.org/eoapi-k8s/
+          helm repo add stac-manager https://stac-manager.ds.io/
+      - name: Build chart dependencies
+        run: helm dependency build infrastructure/charts/eoapi-workshop
+      - name: Lint
+        run: helm lint infrastructure/charts/eoapi-workshop
+      - name: Render checks
+        run: ./infrastructure/charts/eoapi-workshop/tests/render-checks.sh

.github/workflows/publish-workshop-image.yml

@@ -0,0 +1,53 @@
+name: Publish workshop image
+
+# Builds the JupyterLab workshop image (Dockerfile.local + environment.yml) and
+# pushes it to GHCR. Consumed by the Helm chart's per-participant Labs
+# (infrastructure/charts/eoapi-workshop, values key `jupyter.image`).
+on:
+  push:
+    branches:
+      - main
+      - foss4geu-helmchart        # workshop branch — image is built from here for now
+    paths:
+      - Dockerfile.local
+      - environment.yml
+      - docs/**
+      - .github/workflows/publish-workshop-image.yml
+  workflow_dispatch: {}          # manual run (once this workflow is on the default branch)
+
+jobs:
+  publish:
+    name: Build and push
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Image metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          # Portable: resolves to ghcr.io/developmentseed/eoapi-workshop in this repo.
+          images: ghcr.io/${{ github.repository_owner }}/eoapi-workshop
+          tags: |
+            type=raw,value=latest
+            type=sha,format=long
+            type=ref,event=branch
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile.local
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -178,3 +178,8 @@ cdk.context.json
 node_modules/
 
 config.yaml
+
+# Helm: pulled chart dependencies (rebuilt with `helm dependency update`).
+# Chart.lock IS tracked for reproducible builds.
+charts/*/charts/
+charts/**/*.tgz

docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   database:
-    image: ghcr.io/stac-utils/pgstac:v0.9.8
+    image: ghcr.io/stac-utils/pgstac:v0.9.10
     environment:
       - POSTGRES_USER=username
       - POSTGRES_PASSWORD=password
@@ -59,8 +59,34 @@ services:
       start_period: 120s
 
 
+  # Load a public STAC collection from the MAAP STAC into pgstac so notebook 04
+  # §4.5 has data — mirrors the 2i2c deploy step and the Helm chart's
+  # features-loader Job (stac-loader container). Idempotent: skips if present.
+  stac-loader:
+    image: python:3.12-slim
+    depends_on:
+      database:
+        condition: service_started
+    environment:
+      - PGHOST=database
+      - PGUSER=username
+      - PGPASSWORD=password
+      - PGDATABASE=postgis
+      - PGPORT=5432
+    restart: "no"
+    command: >
+      bash -c '
+        set -euo pipefail &&
+        pip install -q "pypgstac[psycopg]==0.9.10" &&
+        sleep 5 &&
+        python3 /opt/load_stac.py
+      '
+    configs:
+      - source: load_stac
+        target: /opt/load_stac.py
+
   stac-fastapi:
-    image: ghcr.io/stac-utils/stac-fastapi-pgstac:6.0.2
+    image: ghcr.io/stac-utils/stac-fastapi-pgstac:6.2.2
     ports:
       - 8081:8081
     environment:
@@ -107,16 +133,16 @@ services:
 
   titiler-pgstac:
     platform: linux/amd64
-    image: ghcr.io/stac-utils/titiler-pgstac:1.9.0
+    image: ghcr.io/stac-utils/titiler-pgstac:3.0.0
     ports:
       - 8082:8082
     environment:
-      # Postgres connection
-      - POSTGRES_USER=username
-      - POSTGRES_PASS=password
-      - POSTGRES_DBNAME=postgis
-      - POSTGRES_HOST=database
-      - POSTGRES_PORT=5432
+      # Postgres connection — titiler-pgstac 3.x reads PG* (POSTGRES_* was dropped)
+      - PGUSER=username
+      - PGPASSWORD=password
+      - PGDATABASE=postgis
+      - PGHOST=database
+      - PGPORT=5432
       - DB_MIN_CONN_SIZE=1
       - DB_MAX_CONN_SIZE=10
       # - DB_MAX_QUERIES=10
@@ -134,9 +160,11 @@ services:
       # TiTiler Config
       - MOSAIC_CONCURRENCY=1
       - TITILER_PGSTAC_API_ENABLE_EXTERNAL_DATASET_ENDPOINTS=True
-      # AWS S3 endpoint config
+      # AWS S3 endpoint config — the workshop's s3:// assets (glad collection)
+      # are in public buckets; read unsigned unless real credentials are provided
       - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
       - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
+      - AWS_NO_SIGN_REQUEST=${AWS_NO_SIGN_REQUEST:-YES}
     depends_on:
       database:
         condition: service_started
@@ -146,7 +174,7 @@ services:
       bash -c "uvicorn titiler.pgstac.main:app  --host 0.0.0.0 --port 8082"
 
   tipg:
-    image: ghcr.io/developmentseed/tipg:1.1.2
+    image: ghcr.io/developmentseed/tipg:1.4.0
     ports:
       - 8083:8083
     environment:
@@ -178,6 +206,8 @@ services:
       - database
 
   stac-manager:
+    # no arm64 manifest published — run the amd64 image under emulation
+    platform: linux/amd64
     image: ghcr.io/developmentseed/stac-manager:1.0.3
     ports:
       - 8086:8080
@@ -215,6 +245,38 @@ services:
       - STAC_BROWSER_ENDPOINT=http://localhost:8080
       - STAC_MANAGER_ENDPOINT=http://localhost:8086
 
+configs:
+  # same loader as the Helm chart's stac-loader container — keep in sync
+  load_stac:
+    content: |
+      import json
+      import sys
+      import urllib.request
+
+      from pypgstac.db import PgstacDB
+      from pypgstac.load import Loader, Methods
+
+      SRC = "https://stac.maap-project.org"
+      COLLECTION = "glad-global-forest-change-1.11"
+      LIMIT = 100
+
+      db = PgstacDB()
+      if db.query_one("select 1 from pgstac.collections where id=%s", [COLLECTION]):
+          print(f"{COLLECTION} already present -- skipping load.")
+          sys.exit(0)
+
+      urllib.request.urlretrieve(f"{SRC}/collections/{COLLECTION}", "/tmp/collection.json")
+      with urllib.request.urlopen(f"{SRC}/search?collections={COLLECTION}&limit={LIMIT}") as r:
+          features = json.load(r)["features"]
+      with open("/tmp/items.ndjson", "w") as f:
+          for feat in features:
+              f.write(json.dumps(feat) + "\n")
+
+      loader = Loader(db=db)
+      loader.load_collections("/tmp/collection.json", Methods.upsert)
+      loader.load_items("/tmp/items.ndjson", Methods.upsert)
+      print(f"{COLLECTION}: collection + {len(features)} items loaded.")
+
 volumes:
   pgdata:
   feature-loader-state: