build(deploy): add cloud stack containers

tests/test_deployment_config.py

@@ -0,0 +1,54 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import yaml
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_compose_defines_database_control_plane_and_outbound_host_agent() -> None:
+    compose = yaml.safe_load((ROOT / "compose.yaml").read_text(encoding="utf-8"))
+    services = compose["services"]
+
+    assert set(services) == {"postgres", "cloud-api", "host-agent"}
+    assert services["postgres"]["image"].startswith("postgres:18")
+    assert services["cloud-api"]["depends_on"]["postgres"]["condition"] == (
+        "service_healthy"
+    )
+    assert services["host-agent"]["depends_on"]["cloud-api"]["condition"] == (
+        "service_healthy"
+    )
+    assert "ports" not in services["host-agent"]
+    assert services["host-agent"]["environment"][
+        "HOST_AGENT_CONTROL_PLANE_URL"
+    ] == "http://cloud-api:8001"
+
+
+def test_container_uses_locked_workspace_install_and_migrations() -> None:
+    dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
+    compose = yaml.safe_load((ROOT / "compose.yaml").read_text(encoding="utf-8"))
+    cloud_command = compose["services"]["cloud-api"]["command"][-1]
+
+    assert "uv sync --locked --all-packages --no-dev" in dockerfile
+    assert "alembic" in cloud_command
+    assert "upgrade head" in cloud_command
+    assert "device-cloud-api --host 0.0.0.0" in cloud_command
+
+
+def test_example_environment_contains_only_placeholder_credentials() -> None:
+    values = {}
+    for line in (ROOT / ".env.example").read_text(encoding="utf-8").splitlines():
+        if line and not line.startswith("#"):
+            name, value = line.split("=", 1)
+            values[name] = value
+
+    public_credentials = json.loads(values["CLOUD_PUBLIC_CREDENTIALS_JSON"])
+    host_credentials = json.loads(values["CLOUD_HOST_CREDENTIALS_JSON"])
+
+    assert public_credentials[0]["token"].startswith("change-me-")
+    assert host_credentials[0]["token"] == values["HOST_AGENT_TOKEN"]
+    assert host_credentials[0]["token"].startswith("change-me-")
+    assert host_credentials[0]["host_id"] == values["HOST_AGENT_HOST_ID"]