Deploying a FastAPI app

Under Uvicorn or Gunicorn with Uvicorn workers, behind nginx or on a PaaS: nothing realtime is kept on your servers, so any worker answers any request.

Its settings

WORDPLUS_SITE, WORDPLUS_SECRET	from your app in WordPlus Cloud
WORDPLUS_LOCAL_KEY	yours: kept as long as the app

Set them in the server environment. Keep the secret and the local key out of your repository and out of every page. The key reaches pages through config_for(), which is what it is for.

Its addresses

Add every address your pages are served from to the app in WordPlus Cloud: scheme, host and port exactly (https://shop.example.com, https://www.shop.example.com). A page anywhere else is refused with wrong_origin. Up to 20 addresses an app. If your server hears webhooks, set their address there too.

Its files

realtime-worker.js, realtime-rooms.min.js, realtime-rooms-e2ee.worker.js and realtime-ui.min.js are served by your app, from its own address: a browser runs a worker only from the page origin. Copy them in your build (npx wordplus-realtime copy static/), so each release serves the ones its package came with.

Workers

The router runs the rules on a worker thread, and aemit() its request on one too, so neither holds up the event loop. Any number of Uvicorn workers answer the routes: they share nothing but your database and, for moving keys on, the generation store.

Another address

A page or app served from another address than your API, such as a single-page app on its own domain or one in Capacitor, connects with endpoint: 'https://api.example.com/api/realtime', and your server answers that address with CORS:

from fastapi.middleware.cors import CORSMiddleware

app.add_middleware(CORSMiddleware, allow_origins=["https://app.example.com"], allow_credentials=True, allow_methods=["POST"], allow_headers=["*"])

Add that address to the app in WordPlus Cloud too.

Content Security Policy

If your pages send one, let them reach the WordPlus Cloud servers (the realtime servers, which may move a connection to another of them, and the media servers for group calls) and run the workers from your own address:

connect-src 'self' https://*.wordplus.cloud wss://*.wordplus.cloud;
worker-src 'self';

Clocks

Your server signs what it sends with the time. Keep its clock synced (NTP): one more than 5 minutes off has its emits refused with stale_signature.