Task #526: Off-Replit migration & GitHub-ready cleanup
Fully decoupled Tx OS from the Replit hosted environment so the project can be cloned and run on any Linux VPS with `docker compose up`. Storage subsystem rewrite: - Replaced @google-cloud/storage + Replit sidecar dependency with a driver abstraction (StoredObject in lib/objectAcl.ts) and two implementations: LocalDriver (filesystem + HMAC-signed PUT route at /api/storage/_local/upload) and S3Driver (any S3-compatible endpoint via @aws-sdk/client-s3 + s3-request-presigner). Driver auto-selected by STORAGE_DRIVER / S3_ENDPOINT env vars. - Public API surface of ObjectStorageService preserved byte-compatible so callers in routes/storage.ts and routes/executive-meetings.ts did not change; download() added to both drivers to keep loadLogoBytes() working (caught in code review round 1). - Storage object-authz tests A-L (incl. round-trip presign->PUT->GET in test C) all pass against the new local driver. Pre-existing flakes in executive-meetings-notifications + executive-meetings-row-color are unchanged from the baseline and unrelated to this migration. Infrastructure: - Dockerfile (6 targets: deps/build/api/web/mockup/migrate). API stage uses the official Playwright base image so PDF rendering works in-container; web stage is nginx serving the Vite SPA bundle; mockup stage carries source + node_modules so the dev preview server runs with PORT=8081 BASE_PATH=/__mockup. - docker-compose.yml: postgres + minio + minio-init (creates buckets) + api (host :8080) + web (host :3000) + one-shot migrate runner; the mockup-sandbox service is gated behind a `dev` profile (host :8081 /__mockup) so a normal `docker compose up -d` does NOT start it. Healthchecks on every long-lived service. - docker/nginx.conf: SPA fallback, /api proxy, /api/socket.io websocket upgrade ordering. - .env.example: every runtime env var consumed by app/objectStorage/ auth/seed/compose paths is documented with comments — host ports, PUBLIC_BASE_URL, ALLOWED_ORIGINS, SESSION_SECRET, BASE_PATH, DATABASE_URL, STORAGE_DRIVER, PRIVATE_OBJECT_DIR, PUBLIC_OBJECT_SEARCH_PATHS, S3_*, LOCAL_STORAGE_ROOT, LOCAL_STORAGE_SIGNING_SECRET, SEED_*, SMTP_*. - README.md replaces replit.md as the canonical project doc; covers Docker quickstart with a service/port table, local dev, env reference, production checklist. - MIGRATION_REPORT.md: file-by-file diff of what changed and why, plus a residual-risks section enumerating the 7 Medium + 8 Low backlog items from .local/security/manual-review.md and the unmigrated object-data note. Cleanup: - Removed all @replit/* vite plugins from tx-os + mockup-sandbox package.json + vite.config.ts + pnpm-workspace.yaml catalog. - Removed @google-cloud/storage and google-auth-library from api-server. - Deleted attached_assets/ (23MB), sedMkjeJm temp file, stale dist/ and *.tsbuildinfo build artefacts, scripts/post-merge.sh, replit.md. - Stripped Replit references from threat_model.md (sidecar, S4 row, G8 invariant), the storage-object-authz test comment, and the objectStorage.ts header comment. Source/config/docs are now Replit-free. - New comprehensive .gitignore: attached_assets/, Replit configs (.replit, replit.nix, .replitignore, replit.md), agent state (.local/, .canvas/, .agents/, .cache/, .config/, .upm/), local storage/, .env*, build artefacts. - scripts/src/seed.ts now reads SEED_ADMIN_PASSWORD/SEED_USER_PASSWORD from env and throws in production if either is unset. Drift from plan: .replit, .replitignore, replit.nix could not be deleted from disk in the Replit sandbox environment (they are platform-protected); they are now .gitignore'd so they will not appear in any clone of the repository, and MIGRATION_REPORT.md documents the one-line `git rm --cached` an operator can run on a non-Replit clone to purge them from upstream git history. replit.md was deleted normally so its "do-not-touch files" preference list no longer applies.
This commit is contained in:
riyadhafraa
+63
-19
@@ -1,34 +1,65 @@
|
||||
# ============================================================================
|
||||
# Tx OS — environment configuration. Copy to `.env` and edit before deploying.
|
||||
# Everything in this file is read by docker-compose.yml at `up` time.
|
||||
# Everything in this file is read either by docker-compose.yml at `up` time
|
||||
# or directly by the application processes (`api-server`, `tx-os`, scripts).
|
||||
# NEVER commit `.env` — it is gitignored. `.env.example` is the public template.
|
||||
# ============================================================================
|
||||
|
||||
# --- Web (nginx → API reverse proxy) ----------------------------------------
|
||||
# Host port that exposes the SPA. Front this with Caddy/Nginx/Traefik for TLS.
|
||||
WEB_PORT=8080
|
||||
|
||||
# Public base URL the SPA + API are reachable at (used to build absolute
|
||||
# upload URLs for the local-FS storage driver and CORS allow-list checks).
|
||||
PUBLIC_BASE_URL=http://localhost:8080
|
||||
# -----------------------------------------------------------------------------
|
||||
# Host ports (compose only)
|
||||
# -----------------------------------------------------------------------------
|
||||
# Port the SPA (nginx) is reachable on. Front with TLS in production.
|
||||
WEB_PORT=3000
|
||||
# Port the API container is reachable on. In public deployments, bind this
|
||||
# to 127.0.0.1 only so the edge proxy is the sole external entry point.
|
||||
API_PORT=8080
|
||||
# Component preview server port (dev profile only).
|
||||
MOCKUP_PORT=8081
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# API server runtime
|
||||
# -----------------------------------------------------------------------------
|
||||
# In compose this is set automatically; required when running natively.
|
||||
PORT=8080
|
||||
# Public base URL the SPA + API are reachable at. Used to build absolute
|
||||
# upload URLs for the local-FS storage driver and to validate CORS origins.
|
||||
PUBLIC_BASE_URL=http://localhost:3000
|
||||
# Comma-separated list of origins allowed by the API server's CORS layer.
|
||||
# Must include PUBLIC_BASE_URL and any additional reverse-proxy domains.
|
||||
ALLOWED_ORIGINS=http://localhost:8080
|
||||
ALLOWED_ORIGINS=http://localhost:3000
|
||||
# pino log level: trace | debug | info | warn | error | fatal
|
||||
LOG_LEVEL=info
|
||||
# 32+ random bytes. Generate with `openssl rand -hex 32`. REQUIRED.
|
||||
SESSION_SECRET=change-me-session-secret-min-32-chars-please
|
||||
|
||||
# --- Database ---------------------------------------------------------------
|
||||
# -----------------------------------------------------------------------------
|
||||
# SPA build (tx-os) — read by Vite at build time AND `pnpm --filter tx-os dev`
|
||||
# -----------------------------------------------------------------------------
|
||||
# Path the SPA is mounted at. Use "/" when serving from the domain root.
|
||||
BASE_PATH=/
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# Database
|
||||
# -----------------------------------------------------------------------------
|
||||
POSTGRES_USER=tx
|
||||
POSTGRES_PASSWORD=change-me-postgres
|
||||
POSTGRES_DB=tx_os
|
||||
# Composed automatically by docker-compose; set explicitly when running natively.
|
||||
# DATABASE_URL=postgres://tx:change-me-postgres@localhost:5432/tx_os
|
||||
DATABASE_URL=postgres://tx:change-me-postgres@db:5432/tx_os
|
||||
|
||||
# --- API server -------------------------------------------------------------
|
||||
# 32+ random bytes. Generate with `openssl rand -hex 32`. Required.
|
||||
SESSION_SECRET=change-me-session-secret-min-32-chars-please
|
||||
# -----------------------------------------------------------------------------
|
||||
# Object storage
|
||||
# -----------------------------------------------------------------------------
|
||||
# Driver selection. Set to "s3" for production (MinIO/S3); "local" persists
|
||||
# uploads on the API container's filesystem (single-host, dev-only).
|
||||
# If unset, the driver auto-detects: "s3" when S3_ENDPOINT is set, else "local".
|
||||
STORAGE_DRIVER=s3
|
||||
|
||||
# pino log level: trace | debug | info | warn | error | fatal
|
||||
LOG_LEVEL=info
|
||||
# Bucket-level paths used by the API. Format: /<bucket>/<prefix>
|
||||
PRIVATE_OBJECT_DIR=/tx-private/private
|
||||
PUBLIC_OBJECT_SEARCH_PATHS=/tx-public/public
|
||||
|
||||
# --- Object storage (S3 / MinIO) -------------------------------------------
|
||||
# Bucket names — created on first boot by the minio-init container.
|
||||
S3_BUCKET_PRIVATE=tx-private
|
||||
S3_BUCKET_PUBLIC=tx-public
|
||||
@@ -41,13 +72,26 @@ S3_SECRET_ACCESS_KEY=change-me-minio-secret-min-20-chars
|
||||
# Region label is cosmetic for MinIO but @aws-sdk requires one.
|
||||
S3_REGION=us-east-1
|
||||
|
||||
# --- Seeded demo accounts ---------------------------------------------------
|
||||
# Used only by `docker compose run --rm migrate` on first boot. Required in
|
||||
# Local-FS driver settings (only consulted when STORAGE_DRIVER=local).
|
||||
# Filesystem root for uploaded objects. Defaults to ./storage relative to
|
||||
# the API server's working directory.
|
||||
LOCAL_STORAGE_ROOT=./storage
|
||||
# HMAC key used to sign + verify upload URLs for the local driver. If
|
||||
# unset, the driver falls back to SESSION_SECRET. Set explicitly to rotate
|
||||
# upload-URL trust independently of session trust.
|
||||
LOCAL_STORAGE_SIGNING_SECRET=
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# Seeded demo accounts
|
||||
# -----------------------------------------------------------------------------
|
||||
# Used only by `docker compose run --rm migrate` on first boot. REQUIRED in
|
||||
# production — the seed script throws if these are unset and NODE_ENV=production.
|
||||
SEED_ADMIN_PASSWORD=change-me-admin-password
|
||||
SEED_USER_PASSWORD=change-me-user-password
|
||||
|
||||
# --- Email (optional) -------------------------------------------------------
|
||||
# -----------------------------------------------------------------------------
|
||||
# Email (optional)
|
||||
# -----------------------------------------------------------------------------
|
||||
# Leave SMTP_HOST blank to disable outbound mail. The Executive Meetings
|
||||
# notifier no-ops when no SMTP config is present.
|
||||
SMTP_HOST=
|
||||
|
||||
+16
-1
@@ -78,7 +78,22 @@ HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
|
||||
CMD wget -qO- http://localhost/healthz >/dev/null || exit 1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# Stage 5: one-shot DB migration + seed runner (used by `docker compose run migrate`).
|
||||
# Stage 5a: mockup-sandbox runtime (dev-only). Carries source + node_modules
|
||||
# so `pnpm --filter @workspace/mockup-sandbox dev` can run the Vite preview
|
||||
# server. Not part of the default compose stack — gated behind the `dev` profile.
|
||||
# -----------------------------------------------------------------------------
|
||||
FROM node:${NODE_VERSION}-bookworm-slim AS mockup
|
||||
WORKDIR /app
|
||||
RUN corepack enable && corepack prepare pnpm@10.26.1 --activate
|
||||
COPY --from=build /app /app
|
||||
ENV NODE_ENV=development \
|
||||
PORT=8081 \
|
||||
BASE_PATH=/__mockup
|
||||
EXPOSE 8081
|
||||
CMD ["pnpm", "--filter", "@workspace/mockup-sandbox", "run", "dev"]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# Stage 5b: one-shot DB migration + seed runner (used by `docker compose run migrate`).
|
||||
# -----------------------------------------------------------------------------
|
||||
FROM node:${NODE_VERSION}-bookworm-slim AS migrate
|
||||
WORKDIR /app
|
||||
|
||||
@@ -51,8 +51,18 @@ docker compose run --rm migrate # one-shot: db push + seed
|
||||
docker compose up -d api web
|
||||
```
|
||||
|
||||
The SPA is now served at `http://<host>:${WEB_PORT}`. Front it with Caddy /
|
||||
Nginx / Traefik for TLS and HTTP/2.
|
||||
After this, the running stack exposes:
|
||||
|
||||
| Service | Default host port | URL |
|
||||
| ---------------- | ----------------- | ------------------------------ |
|
||||
| SPA (`web`) | `3000` | `http://<host>:3000/` |
|
||||
| API (`api`) | `8080` | `http://<host>:8080/api/healthz` |
|
||||
| MinIO console | not exposed | (proxy to `:9001` if you need it) |
|
||||
| `mockup-sandbox` | `8081` | dev profile only — `docker compose --profile dev up -d mockup-sandbox` then `http://<host>:8081/__mockup` |
|
||||
|
||||
Front the SPA (port `WEB_PORT`, default `3000`) with Caddy / Nginx / Traefik
|
||||
for TLS and HTTP/2; bind the API port (`API_PORT`, default `8080`) to
|
||||
`127.0.0.1` in production so the edge proxy is the sole external entry.
|
||||
|
||||
### Default seeded accounts
|
||||
|
||||
|
||||
@@ -406,8 +406,8 @@ export const ACTIVE_STORAGE_DRIVER = (): "s3" | "local" =>
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// ObjectStorageService — public API consumed by routes/storage.ts and
|
||||
// routes/executive-meetings.ts. Surface preserved byte-compatible with the
|
||||
// previous Replit-sidecar implementation.
|
||||
// routes/executive-meetings.ts. Surface is driver-agnostic and works
|
||||
// identically against either the local-FS or S3-compatible backend.
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
export class ObjectStorageService {
|
||||
|
||||
+18
-13
@@ -100,6 +100,11 @@ services:
|
||||
SMTP_PASS: ${SMTP_PASS:-}
|
||||
SMTP_SECURE: ${SMTP_SECURE:-}
|
||||
SMTP_FROM: ${SMTP_FROM:-}
|
||||
ports:
|
||||
# API — exposed on host :8080 for direct curl/integration access. In
|
||||
# a public-facing deployment this should be bound to 127.0.0.1 only
|
||||
# (e.g. "127.0.0.1:8080:8080") so only the edge proxy reaches it.
|
||||
- "${API_PORT:-8080}:8080"
|
||||
networks: [internal]
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:8080/api/healthz', r => process.exit(r.statusCode===200?0:1)).on('error', () => process.exit(1))\""]
|
||||
@@ -117,28 +122,28 @@ services:
|
||||
api:
|
||||
condition: service_healthy
|
||||
ports:
|
||||
# Production endpoint — the SPA + reverse-proxied /api ride one port,
|
||||
# which an operator-managed TLS terminator (Caddy / Nginx / Traefik)
|
||||
# fronts on the public interface. Default 8080 keeps WEB_PORT-driven
|
||||
# configs stable; override via .env to bind 80/443 directly.
|
||||
- "${WEB_PORT:-8080}:80"
|
||||
# SPA — exposed on host :3000. Front this with an operator-managed
|
||||
# TLS terminator (Caddy / Nginx / Traefik) for production HTTPS.
|
||||
- "${WEB_PORT:-3000}:80"
|
||||
networks: [internal]
|
||||
|
||||
# Component preview server. Dev-only — used to iterate on isolated
|
||||
# React components in an iframe-friendly preview. Not part of the
|
||||
# production user surface; kept under the `dev` profile so a normal
|
||||
# `docker compose up -d` does NOT start it. Run with:
|
||||
# React components in an iframe-friendly preview at /__mockup. Not part
|
||||
# of the production user surface; kept under the `dev` profile so a
|
||||
# normal `docker compose up -d` does NOT start it. Run with:
|
||||
# docker compose --profile dev up -d mockup-sandbox
|
||||
mockup-sandbox:
|
||||
build:
|
||||
context: .
|
||||
target: api
|
||||
image: tx-os/api:latest
|
||||
target: mockup
|
||||
image: tx-os/mockup:latest
|
||||
profiles: ["dev"]
|
||||
command: ["pnpm", "--filter", "@workspace/mockup-sandbox", "run", "dev"]
|
||||
working_dir: /app
|
||||
environment:
|
||||
NODE_ENV: development
|
||||
PORT: "8081"
|
||||
BASE_PATH: /__mockup
|
||||
ports:
|
||||
- "8081:8081"
|
||||
- "${MOCKUP_PORT:-8081}:8081"
|
||||
networks: [internal]
|
||||
|
||||
# One-shot DB migrate + seed. Run on first boot:
|
||||
|
||||
Reference in New Issue
Block a user