Riyadh
d1d4f6baaa
Task #534 — backend, infra, tooling. UI ships in Stage 2 (#535). Backend - New system_settings table (id=1 singleton): installed flag, base_url, local_domain, local_ip, https_mode, app_version. Pushed to dev DB. - New /api/setup/status (open) and /api/setup/{validate,complete} (gated by requireSetupOpen — 409 once installed). - completeInstall is fully transactional: pg_advisory_xact_lock serializes concurrent callers, double-gates on installed flag and admin existence, then atomically creates the admin user, assigns admin role + Admins/Everyone groups, and flips system_settings to installed=true. Rolls back on any failure. - Added redirectIfSetupNeeded() helper returning the full SetupStatus payload alongside a redirect target for SPA routing decisions. - Zod validation, bcrypt hashing, in-memory rate limiter on the setup endpoints. Backward compat - scripts/src/seed.ts now branches on installed flag + admin existence + SEED_*_PASSWORD env vars. Legacy installs (admin exists, system_settings empty) get backfilled to installed=true via ON CONFLICT DO UPDATE so they are never forced through the wizard. When env passwords are unset and no admin exists, the seed prints a wizard hint instead of seeding. Infra - docker-compose.yml: replaced nginx edge with a Caddy service that mounts ./certs and ./docker/Caddyfile{,.skip}. The web service no longer publishes a port directly — Caddy is the only public ingress. - Caddy entrypoint picks Caddyfile.skip (HTTP-only, no certs) when HTTPS_MODE=skip so a fresh host without mkcert can still boot. - docker/Caddyfile: HTTPS site for LOCAL_DOMAIN/LOCAL_IP with WebSocket upgrade preserved and an HTTP→HTTPS redirect. - start.sh: preserved. Now auto-picks HTTPS_MODE=skip when no cert is on disk and maps Caddy's HTTP_PORT to APP_PORT in skip mode so the legacy http://localhost:${APP_PORT} URL keeps working. In local/byo mode it prints the https://${LOCAL_DOMAIN} URL. - .env.example: added LOCAL_DOMAIN, LOCAL_IP, BASE_URL, HTTP_PORT, HTTPS_PORT, HTTPS_MODE; SEED_*_PASSWORD now optional. Tooling - scripts/local-setup.sh: idempotent OS-aware bootstrap (.env upsert, mkcert hint, cert SAN check, dry-run via LOCAL_SETUP_DRY_RUN). Tests - artifacts/api-server/tests/setup-wizard.test.mjs: 7/7 pass. - scripts/tests/local-setup.test.mjs: 2/2 pass. Constraints honored: no force-push, no destructive ops, start.sh preserved & still works, scripts idempotent, volumes/DB never touched, HTTPS skip mode dev-only, wizard does not edit LOCAL_DOMAIN/LOCAL_IP. Out of scope / not addressed: pre-existing TS errors in routes/users.ts and pre-existing failure in executive-meetings-postpone-race.test.mjs.
56 lines
1.5 KiB
Caddyfile
56 lines
1.5 KiB
Caddyfile
# Tx OS — Caddy reverse proxy + TLS termination (HTTPS_MODE=local|byo).
|
|
#
|
|
# This Caddyfile is the default. The compose `caddy` service entrypoint
|
|
# loads docker/Caddyfile.skip instead when HTTPS_MODE=skip, so this file
|
|
# can assume TLS certificates exist in /certs.
|
|
#
|
|
# The site MUST stay single-origin so the API session cookie
|
|
# (sameSite=lax) keeps working across SPA + /api requests.
|
|
{
|
|
# Disable Caddy's automatic Let's Encrypt issuance — we always
|
|
# bring our own cert (mkcert locally, real cert in BYO mode).
|
|
auto_https disable_certs
|
|
admin off
|
|
}
|
|
|
|
(api_proxy) {
|
|
# WebSocket / Socket.IO upgrade for /api/socket.io
|
|
@websocket {
|
|
header Connection *Upgrade*
|
|
header Upgrade websocket
|
|
}
|
|
reverse_proxy /api/socket.io/* api:8080
|
|
reverse_proxy /api/* api:8080
|
|
}
|
|
|
|
(spa_proxy) {
|
|
# Static SPA bundle is served by the `web` container (nginx-alpine)
|
|
# on port 80 inside the docker network. Caddy is the public edge.
|
|
reverse_proxy web:80
|
|
}
|
|
|
|
# ---------- HTTPS site (default) ----------
|
|
{$LOCAL_DOMAIN:tx.local}, {$LOCAL_IP:127.0.0.1} {
|
|
tls /certs/local-cert.pem /certs/local-key.pem
|
|
encode zstd gzip
|
|
import api_proxy
|
|
import spa_proxy
|
|
}
|
|
|
|
# Catch-all HTTPS host (covers raw IP / Tailscale name without
|
|
# touching the named site).
|
|
:443 {
|
|
tls /certs/local-cert.pem /certs/local-key.pem
|
|
encode zstd gzip
|
|
import api_proxy
|
|
import spa_proxy
|
|
}
|
|
|
|
# Plain HTTP → permanent redirect to HTTPS. Skip-mode (no certs) is
|
|
# handled exclusively by docker/Caddyfile.skip, picked by the compose
|
|
# entrypoint when HTTPS_MODE=skip.
|
|
:80 {
|
|
redir https://{host}{uri} permanent
|
|
}
|