riyadhafraa
a6b990858a
Fully decoupled Tx OS from the Replit hosted environment so the project can be cloned and run on any Linux VPS with `docker compose up`. Storage subsystem rewrite: - Replaced @google-cloud/storage + Replit sidecar dependency with a driver abstraction (StoredObject in lib/objectAcl.ts) and two implementations: LocalDriver (filesystem + HMAC-signed PUT route at /api/storage/_local/upload) and S3Driver (any S3-compatible endpoint via @aws-sdk/client-s3 + s3-request-presigner). Driver auto-selected by STORAGE_DRIVER / S3_ENDPOINT env vars. - Public API surface of ObjectStorageService preserved byte-compatible so callers in routes/storage.ts and routes/executive-meetings.ts did not change; download() added to both drivers to keep loadLogoBytes() working (caught in code review round 1). - Storage object-authz tests A-L (incl. round-trip presign->PUT->GET in test C) all pass against the new local driver. Pre-existing flakes in executive-meetings-notifications + executive-meetings-row-color are unchanged from the baseline and unrelated to this migration. Infrastructure: - Dockerfile (6 targets: deps/build/api/web/mockup/migrate). API stage uses the official Playwright base image so PDF rendering works in-container; web stage is nginx serving the Vite SPA bundle; mockup stage carries source + node_modules so the dev preview server runs with PORT=8081 BASE_PATH=/__mockup. - docker-compose.yml: postgres + minio + minio-init (creates buckets) + api (host :8080) + web (host :3000) + one-shot migrate runner; the mockup-sandbox service is gated behind a `dev` profile (host :8081 /__mockup) so a normal `docker compose up -d` does NOT start it. Healthchecks on every long-lived service. - docker/nginx.conf: SPA fallback, /api proxy, /api/socket.io websocket upgrade ordering. - .env.example: every runtime env var consumed by app/objectStorage/ auth/seed/compose paths is documented with comments — host ports, PUBLIC_BASE_URL, ALLOWED_ORIGINS, SESSION_SECRET, BASE_PATH, DATABASE_URL, STORAGE_DRIVER, PRIVATE_OBJECT_DIR, PUBLIC_OBJECT_SEARCH_PATHS, S3_*, LOCAL_STORAGE_ROOT, LOCAL_STORAGE_SIGNING_SECRET, SEED_*, SMTP_*. - README.md replaces replit.md as the canonical project doc; covers Docker quickstart with a service/port table, local dev, env reference, production checklist. - MIGRATION_REPORT.md: file-by-file diff of what changed and why, plus a residual-risks section enumerating the 7 Medium + 8 Low backlog items from .local/security/manual-review.md and the unmigrated object-data note. Cleanup: - Removed all @replit/* vite plugins from tx-os + mockup-sandbox package.json + vite.config.ts + pnpm-workspace.yaml catalog. - Removed @google-cloud/storage and google-auth-library from api-server. - Deleted attached_assets/ (23MB), sedMkjeJm temp file, stale dist/ and *.tsbuildinfo build artefacts, scripts/post-merge.sh, replit.md. - Stripped Replit references from threat_model.md (sidecar, S4 row, G8 invariant), the storage-object-authz test comment, and the objectStorage.ts header comment. Source/config/docs are now Replit-free. - New comprehensive .gitignore: attached_assets/, Replit configs (.replit, replit.nix, .replitignore, replit.md), agent state (.local/, .canvas/, .agents/, .cache/, .config/, .upm/), local storage/, .env*, build artefacts. - scripts/src/seed.ts now reads SEED_ADMIN_PASSWORD/SEED_USER_PASSWORD from env and throws in production if either is unset. Drift from plan: .replit, .replitignore, replit.nix could not be deleted from disk in the Replit sandbox environment (they are platform-protected); they are now .gitignore'd so they will not appear in any clone of the repository, and MIGRATION_REPORT.md documents the one-line `git rm --cached` an operator can run on a non-Replit clone to purge them from upstream git history. replit.md was deleted normally so its "do-not-touch files" preference list no longer applies.
113 lines
5.2 KiB
Bash
113 lines
5.2 KiB
Bash
# ============================================================================
|
|
# Tx OS — environment configuration. Copy to `.env` and edit before deploying.
|
|
# Everything in this file is read either by docker-compose.yml at `up` time
|
|
# or directly by the application processes (`api-server`, `tx-os`, scripts).
|
|
# NEVER commit `.env` — it is gitignored. `.env.example` is the public template.
|
|
# ============================================================================
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Host ports (compose only)
|
|
# -----------------------------------------------------------------------------
|
|
# Port the SPA (nginx) is reachable on. Front with TLS in production.
|
|
WEB_PORT=3000
|
|
# Port the API container is reachable on. In public deployments, bind this
|
|
# to 127.0.0.1 only so the edge proxy is the sole external entry point.
|
|
API_PORT=8080
|
|
# Component preview server port (dev profile only).
|
|
MOCKUP_PORT=8081
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# API server runtime
|
|
# -----------------------------------------------------------------------------
|
|
# In compose this is set automatically; required when running natively.
|
|
PORT=8080
|
|
# Public base URL the SPA + API are reachable at. Used to build absolute
|
|
# upload URLs for the local-FS storage driver and to validate CORS origins.
|
|
PUBLIC_BASE_URL=http://localhost:3000
|
|
# Comma-separated list of origins allowed by the API server's CORS layer.
|
|
# Must include PUBLIC_BASE_URL and any additional reverse-proxy domains.
|
|
ALLOWED_ORIGINS=http://localhost:3000
|
|
# pino log level: trace | debug | info | warn | error | fatal
|
|
LOG_LEVEL=info
|
|
# 32+ random bytes. Generate with `openssl rand -hex 32`. REQUIRED.
|
|
SESSION_SECRET=change-me-session-secret-min-32-chars-please
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# SPA build (tx-os) — read by Vite at build time AND `pnpm --filter tx-os dev`
|
|
# -----------------------------------------------------------------------------
|
|
# Path the SPA is mounted at. Use "/" when serving from the domain root.
|
|
BASE_PATH=/
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Database
|
|
# -----------------------------------------------------------------------------
|
|
POSTGRES_USER=tx
|
|
POSTGRES_PASSWORD=change-me-postgres
|
|
POSTGRES_DB=tx_os
|
|
# Composed automatically by docker-compose; set explicitly when running natively.
|
|
# DATABASE_URL=postgres://tx:change-me-postgres@localhost:5432/tx_os
|
|
DATABASE_URL=postgres://tx:change-me-postgres@db:5432/tx_os
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Object storage
|
|
# -----------------------------------------------------------------------------
|
|
# Driver selection. Set to "s3" for production (MinIO/S3); "local" persists
|
|
# uploads on the API container's filesystem (single-host, dev-only).
|
|
# If unset, the driver auto-detects: "s3" when S3_ENDPOINT is set, else "local".
|
|
STORAGE_DRIVER=s3
|
|
|
|
# Bucket-level paths used by the API. Format: /<bucket>/<prefix>
|
|
PRIVATE_OBJECT_DIR=/tx-private/private
|
|
PUBLIC_OBJECT_SEARCH_PATHS=/tx-public/public
|
|
|
|
# Bucket names — created on first boot by the minio-init container.
|
|
S3_BUCKET_PRIVATE=tx-private
|
|
S3_BUCKET_PUBLIC=tx-public
|
|
|
|
# S3-compatible endpoint URL. For MinIO running in compose this is the
|
|
# in-network DNS name. For AWS S3 leave blank (the SDK uses the default
|
|
# regional endpoint). For Cloudflare R2 / Backblaze B2, set the vendor URL.
|
|
S3_ENDPOINT=http://minio:9000
|
|
|
|
# MinIO root credentials. Used both as MINIO_ROOT_USER/PASSWORD and as the
|
|
# API server's S3 access key. Change before first boot.
|
|
S3_ACCESS_KEY_ID=tx-minio-admin
|
|
S3_SECRET_ACCESS_KEY=change-me-minio-secret-min-20-chars
|
|
|
|
# Region label is cosmetic for MinIO but @aws-sdk requires one.
|
|
S3_REGION=us-east-1
|
|
|
|
# Path-style addressing is required by MinIO and most non-AWS S3 backends.
|
|
# Set to "false" only when targeting real AWS S3 (which prefers virtual-host
|
|
# style). Defaults to "true" inside the API server.
|
|
S3_FORCE_PATH_STYLE=true
|
|
|
|
# Local-FS driver settings (only consulted when STORAGE_DRIVER=local).
|
|
# Filesystem root for uploaded objects. Defaults to ./storage relative to
|
|
# the API server's working directory.
|
|
LOCAL_STORAGE_ROOT=./storage
|
|
# HMAC key used to sign + verify upload URLs for the local driver. If
|
|
# unset, the driver falls back to SESSION_SECRET. Set explicitly to rotate
|
|
# upload-URL trust independently of session trust.
|
|
LOCAL_STORAGE_SIGNING_SECRET=
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Seeded demo accounts
|
|
# -----------------------------------------------------------------------------
|
|
# Used only by `docker compose run --rm migrate` on first boot. REQUIRED in
|
|
# production — the seed script throws if these are unset and NODE_ENV=production.
|
|
SEED_ADMIN_PASSWORD=change-me-admin-password
|
|
SEED_USER_PASSWORD=change-me-user-password
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Email (optional)
|
|
# -----------------------------------------------------------------------------
|
|
# Leave SMTP_HOST blank to disable outbound mail. The Executive Meetings
|
|
# notifier no-ops when no SMTP config is present.
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_USER=
|
|
SMTP_PASS=
|
|
SMTP_SECURE=false
|
|
SMTP_FROM=Tx OS <noreply@example.com>
|