Feature/actionable insights

.env

@@ -31,12 +31,21 @@ SMTP_TLS=True
 SMTP_SSL=False
 SMTP_PORT=587
 
-# Postgres
-POSTGRES_SERVER=localhost
-POSTGRES_PORT=5432
-POSTGRES_DB=app
-POSTGRES_USER=postgres
-POSTGRES_PASSWORD=changethis
+# Database Configuration
+MYSQL_HOST=localhost
+MYSQL_PORT=3306
+MYSQL_USER=root
+MYSQL_PASSWORD=your_mysql_password
+MYSQL_DATABASE=ai_prompts
+
+# AI Model Configuration
+ANTHROPIC_API_KEY=your_anthropic_api_key_here
+AI_MODEL=claude-sonnet-4-5-20250929
+MAX_TOKENS=1024
+
+# Application Configuration
+ENVIRONMENT=development
+LOG_LEVEL=info
 
 SENTRY_DSN=
 

.github/workflows/deploy.yml

@@ -0,0 +1,113 @@
+name: Deploy to Production
+
+on:
+  push:
+    branches: [main, master]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Deploy frontend and backend to production
+        uses: appleboy/ssh-action@v1.2.0
+        env:
+          GH_PAT: ${{ secrets.GH_PAT }}
+          PG_PASSWORD: ${{ secrets.PG_PASSWORD }}
+          BACKEND_SECRET_KEY: ${{ secrets.BACKEND_SECRET_KEY }}
+          CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }}
+          CLERK_PUBLISHABLE_KEY: ${{ secrets.CLERK_PUBLISHABLE_KEY }}
+          CLERK_JWKS_URL: ${{ secrets.CLERK_JWKS_URL }}
+          STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}
+          STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_WEBHOOK_SECRET }}
+          STRIPE_PRO_PRICE_ID: ${{ secrets.STRIPE_PRO_PRICE_ID }}
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
+          PIPELINE_ALERT_EMAIL: ${{ secrets.PIPELINE_ALERT_EMAIL }}
+          HEALTHCHECKS_PING_URL: ${{ secrets.HEALTHCHECKS_PING_URL }}
+          VITE_CLERK_PUBLISHABLE_KEY: ${{ vars.VITE_CLERK_PUBLISHABLE_KEY }}
+          VITE_STRIPE_PRO_PRICE_ID: ${{ vars.VITE_STRIPE_PRO_PRICE_ID }}
+          VITE_STRIPE_PUBLISHABLE_KEY: ${{ vars.VITE_STRIPE_PUBLISHABLE_KEY }}
+        with:
+          host: 89.167.87.10
+          username: deployer
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
+          envs: GH_PAT,PG_PASSWORD,BACKEND_SECRET_KEY,CLERK_SECRET_KEY,CLERK_PUBLISHABLE_KEY,CLERK_JWKS_URL,STRIPE_SECRET_KEY,STRIPE_WEBHOOK_SECRET,STRIPE_PRO_PRICE_ID,GEMINI_API_KEY,RESEND_API_KEY,PIPELINE_ALERT_EMAIL,HEALTHCHECKS_PING_URL,VITE_CLERK_PUBLISHABLE_KEY,VITE_STRIPE_PRO_PRICE_ID,VITE_STRIPE_PUBLISHABLE_KEY
+          script: |
+            set -e
+
+            # Pull latest code
+            cd /opt/geo/kila
+            BRANCH=$(git rev-parse --abbrev-ref HEAD)
+            git remote set-url origin https://x-access-token:${GH_PAT}@github.com/brucezy/kila.git
+            git pull origin $BRANCH
+
+            if [ -d /opt/geo/kila-models ]; then
+              cd /opt/geo/kila-models
+              git remote set-url origin https://x-access-token:${GH_PAT}@github.com/brucezy/kila-models.git
+              git pull origin main
+            else
+              cd /opt/geo
+              git clone https://x-access-token:${GH_PAT}@github.com/brucezy/kila-models.git kila-models
+            fi
+
+            # Write backend .env.prod from GitHub Secrets
+            cat > /opt/geo/kila/backend/.env.prod << EOF
+            ENVIRONMENT=production
+            PG_HOST=172.17.0.1
+            PG_PORT=5432
+            PG_USER=yongzhang
+            PG_PASSWORD=${PG_PASSWORD}
+            PG_DATABASE=kila_intelligence
+            SECRET_KEY=${BACKEND_SECRET_KEY}
+            CLERK_SECRET_KEY=${CLERK_SECRET_KEY}
+            CLERK_PUBLISHABLE_KEY=${CLERK_PUBLISHABLE_KEY}
+            CLERK_JWKS_URL=${CLERK_JWKS_URL}
+            STRIPE_SECRET_KEY=${STRIPE_SECRET_KEY}
+            STRIPE_WEBHOOK_SECRET=${STRIPE_WEBHOOK_SECRET}
+            STRIPE_PRO_PRICE_ID=${STRIPE_PRO_PRICE_ID}
+            STRIPE_FRONTEND_URL=https://www.spekila.com
+            ALLOWED_ORIGINS=["http://www.spekila.com","https://www.spekila.com"]
+            LOG_LEVEL=WARNING
+            RATE_LIMIT_ENABLED=true
+            RATE_LIMIT_REQUESTS=200
+            RATE_LIMIT_PERIOD=60
+            EOF
+
+            # Write scraper .env.prod from GitHub Secrets
+            cat > /opt/geo/kila-scraper/.env.prod << EOF
+            ENVIRONMENT=production
+            DEBUG=False
+            ENABLE_DOCS=False
+            HOST=0.0.0.0
+            PORT=8001
+            PG_HOST=172.17.0.1
+            PG_PORT=5432
+            PG_USER=yongzhang
+            PG_PASSWORD=${PG_PASSWORD}
+            PG_DATABASE=kila_intelligence
+            SECRET_KEY=${BACKEND_SECRET_KEY}
+            GEMINI_API_KEY=${GEMINI_API_KEY}
+            GEMINI_DEFAULT_MODEL=gemini-2.5-flash
+            BACKEND_CORS_ORIGINS=["http://www.spekila.com","https://www.spekila.com"]
+            LOG_LEVEL=WARNING
+            RESEND_API_KEY=${RESEND_API_KEY}
+            PIPELINE_ALERT_EMAIL=${PIPELINE_ALERT_EMAIL}
+            HEALTHCHECKS_PING_URL=${HEALTHCHECKS_PING_URL}
+            EOF
+
+            # Export frontend build-time vars for docker-compose
+            export VITE_CLERK_PUBLISHABLE_KEY=${VITE_CLERK_PUBLISHABLE_KEY}
+            export VITE_STRIPE_PRO_PRICE_ID=${VITE_STRIPE_PRO_PRICE_ID}
+            export VITE_STRIPE_PUBLISHABLE_KEY=${VITE_STRIPE_PUBLISHABLE_KEY}
+
+            cd /opt/geo
+            docker compose -f kila/docker-compose.prod.yml up --build -d
+            # Run migrations explicitly so schema is always in sync before the scraper
+            # can run jobs. The backend prestart also does this, but running it here
+            # guarantees it completes before ofelia fires — even if a kila-models change
+            # was deployed without a backend restart.
+            docker compose -f kila/docker-compose.prod.yml exec -T backend alembic upgrade head
+            # Restart ofelia so it re-reads the scraper's labels after any container rebuild.
+            # Without this, a full rebuild replaces the scraper container and ofelia silently
+            # stops firing the daily pipeline.
+            docker compose -f kila/docker-compose.prod.yml restart ofelia