riyadhafraa
a3ebff2afa
Task #534 — backend, infra, and tooling only. UI ships in Stage 2. Backend - New system_settings table (id=1 singleton): installed flag, base_url, local_domain, local_ip, https_mode, app_version. Pushed to dev DB. - New /api/setup/status (open) and /api/setup/{validate,complete} (gated by requireSetupOpen — 409 once installed). - completeInstall is fully transactional: pg_advisory_xact_lock serializes concurrent callers, double-gates on installed flag and admin existence, then atomically creates the admin user, assigns admin role + Admins/Everyone groups, and flips system_settings to installed=true. Rolls back on any failure. - Zod validation, bcrypt hashing, in-memory rate limiter for the setup endpoints. Backward compat - scripts/src/seed.ts now branches on installed flag + admin existence + SEED_*_PASSWORD env vars. Legacy installs (admin exists, system_settings empty) get backfilled to installed=true via ON CONFLICT DO UPDATE so they are never forced through the wizard. When env passwords are unset and no admin exists, the seed prints a wizard hint instead of seeding. Infra - docker-compose.yml: replaced nginx edge with a Caddy service that mounts ./certs and ./docker/Caddyfile. The web service no longer publishes a port directly — Caddy is the only public ingress. - docker/Caddyfile: HTTPS site for LOCAL_DOMAIN/LOCAL_IP with WebSocket upgrade preserved and a plaintext :80 fallback when HTTPS_MODE=skip (dev-only). - .env.example: added LOCAL_DOMAIN, LOCAL_IP, BASE_URL, HTTP_PORT, HTTPS_PORT, HTTPS_MODE; SEED_*_PASSWORD now optional. Tooling - scripts/local-setup.sh: idempotent OS-aware bootstrap (.env upsert, mkcert hint, cert SAN check, dry-run via LOCAL_SETUP_DRY_RUN). start.sh untouched. Tests - artifacts/api-server/tests/setup-wizard.test.mjs: 7/7 pass (snapshot/restore admin role + system_settings around tests). - scripts/tests/local-setup.test.mjs: 2/2 pass (first-run bootstrap + second-run no-op idempotency with mkcert/openssl stubs). Constraints honored: no force-push, no destructive ops, start.sh preserved, scripts idempotent, volumes/DB never touched, HTTPS skip mode dev-only, wizard does not edit LOCAL_DOMAIN/LOCAL_IP. Out of scope / not addressed: pre-existing TS errors in routes/users.ts and pre-existing failure in executive-meetings-postpone-race.test.mjs.
140 lines
6.6 KiB
Bash
140 lines
6.6 KiB
Bash
# ============================================================================
|
|
# Tx OS — environment configuration. Copy to `.env` and edit before deploying.
|
|
# Everything in this file is read either by docker-compose.yml at `up` time
|
|
# or directly by the application processes (`api-server`, `tx-os`, scripts).
|
|
# NEVER commit `.env` — it is gitignored. `.env.example` is the public template.
|
|
# ============================================================================
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Host ports (compose only)
|
|
# -----------------------------------------------------------------------------
|
|
# Port the SPA (nginx) is reachable on. Front with TLS in production.
|
|
WEB_PORT=3000
|
|
# Port the API container is reachable on. In public deployments, bind this
|
|
# to 127.0.0.1 only so the edge proxy is the sole external entry point.
|
|
API_PORT=8080
|
|
# Component preview server port (dev profile only).
|
|
MOCKUP_PORT=8081
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# API server runtime
|
|
# -----------------------------------------------------------------------------
|
|
# In compose this is set automatically; required when running natively.
|
|
PORT=8080
|
|
# Public base URL the SPA + API are reachable at. Used to build absolute
|
|
# upload URLs for the local-FS storage driver and to validate CORS origins.
|
|
PUBLIC_BASE_URL=http://localhost:3000
|
|
# Comma-separated list of origins allowed by the API server's CORS layer.
|
|
# Must include PUBLIC_BASE_URL and any additional reverse-proxy domains.
|
|
ALLOWED_ORIGINS=http://localhost:3000
|
|
# pino log level: trace | debug | info | warn | error | fatal
|
|
LOG_LEVEL=info
|
|
# 32+ random bytes. Generate with `openssl rand -hex 32`. REQUIRED.
|
|
SESSION_SECRET=change-me-session-secret-min-32-chars-please
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Local hostname / TLS (used by Caddy + the Setup Wizard)
|
|
# -----------------------------------------------------------------------------
|
|
# Hostname operators reach the system at on the LAN. The Caddy edge
|
|
# binds this name and serves the mkcert-issued certificate.
|
|
LOCAL_DOMAIN=tx.local
|
|
# Auto-detected by scripts/local-setup.sh — the host's LAN IP. Used as
|
|
# an additional SAN on the local certificate so phones / tablets that
|
|
# can't resolve mDNS can still reach the system at https://<ip>/.
|
|
LOCAL_IP=127.0.0.1
|
|
# Canonical public URL the SPA + API are reachable at. Setup Wizard
|
|
# stores this in system_settings.base_url at install time.
|
|
BASE_URL=https://tx.local
|
|
# Edge ports (Caddy). Set HTTP_PORT=8080 / HTTPS_PORT=8443 if you
|
|
# can't bind privileged ports.
|
|
HTTP_PORT=80
|
|
HTTPS_PORT=443
|
|
# TLS strategy:
|
|
# local — local-setup.sh provisions ./certs/local-{cert,key}.pem via mkcert
|
|
# byo — operator drops their own cert/key into ./certs/ with the same names
|
|
# skip — DEVELOPER ONLY: serve plaintext on :80, no HTTPS. Never use
|
|
# outside trusted local development networks.
|
|
HTTPS_MODE=local
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# SPA build (tx-os) — read by Vite at build time AND `pnpm --filter tx-os dev`
|
|
# -----------------------------------------------------------------------------
|
|
# Path the SPA is mounted at. Use "/" when serving from the domain root.
|
|
BASE_PATH=/
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Database
|
|
# -----------------------------------------------------------------------------
|
|
POSTGRES_USER=tx
|
|
POSTGRES_PASSWORD=change-me-postgres
|
|
POSTGRES_DB=tx_os
|
|
# Composed automatically by docker-compose; set explicitly when running natively.
|
|
# DATABASE_URL=postgres://tx:change-me-postgres@localhost:5432/tx_os
|
|
DATABASE_URL=postgres://tx:change-me-postgres@db:5432/tx_os
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Object storage
|
|
# -----------------------------------------------------------------------------
|
|
# Driver selection. Set to "s3" for production (MinIO/S3); "local" persists
|
|
# uploads on the API container's filesystem (single-host, dev-only).
|
|
# If unset, the driver auto-detects: "s3" when S3_ENDPOINT is set, else "local".
|
|
STORAGE_DRIVER=s3
|
|
|
|
# Bucket-level paths used by the API. Format: /<bucket>/<prefix>
|
|
PRIVATE_OBJECT_DIR=/tx-private/private
|
|
PUBLIC_OBJECT_SEARCH_PATHS=/tx-public/public
|
|
|
|
# Bucket names — created on first boot by the minio-init container.
|
|
S3_BUCKET_PRIVATE=tx-private
|
|
S3_BUCKET_PUBLIC=tx-public
|
|
|
|
# S3-compatible endpoint URL. For MinIO running in compose this is the
|
|
# in-network DNS name. For AWS S3 leave blank (the SDK uses the default
|
|
# regional endpoint). For Cloudflare R2 / Backblaze B2, set the vendor URL.
|
|
S3_ENDPOINT=http://minio:9000
|
|
|
|
# MinIO root credentials. Used both as MINIO_ROOT_USER/PASSWORD and as the
|
|
# API server's S3 access key. Change before first boot.
|
|
S3_ACCESS_KEY_ID=tx-minio-admin
|
|
S3_SECRET_ACCESS_KEY=change-me-minio-secret-min-20-chars
|
|
|
|
# Region label is cosmetic for MinIO but @aws-sdk requires one.
|
|
S3_REGION=us-east-1
|
|
|
|
# Path-style addressing is required by MinIO and most non-AWS S3 backends.
|
|
# Set to "false" only when targeting real AWS S3 (which prefers virtual-host
|
|
# style). Defaults to "true" inside the API server.
|
|
S3_FORCE_PATH_STYLE=true
|
|
|
|
# Local-FS driver settings (only consulted when STORAGE_DRIVER=local).
|
|
# Filesystem root for uploaded objects. Defaults to ./storage relative to
|
|
# the API server's working directory.
|
|
LOCAL_STORAGE_ROOT=./storage
|
|
# HMAC key used to sign + verify upload URLs for the local driver. If
|
|
# unset, the driver falls back to SESSION_SECRET. Set explicitly to rotate
|
|
# upload-URL trust independently of session trust.
|
|
LOCAL_STORAGE_SIGNING_SECRET=
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Seeded demo accounts (OPTIONAL since the Setup Wizard exists)
|
|
# -----------------------------------------------------------------------------
|
|
# When BOTH variables are set, the migrate container creates an `admin`
|
|
# and `ahmed` user with these passwords on first boot and immediately
|
|
# marks the install complete (skipping the wizard). When EITHER is unset,
|
|
# the seed creates only roles/permissions and leaves admin creation to
|
|
# the first-run wizard at /setup.
|
|
SEED_ADMIN_PASSWORD=
|
|
SEED_USER_PASSWORD=
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Email (optional)
|
|
# -----------------------------------------------------------------------------
|
|
# Leave SMTP_HOST blank to disable outbound mail. The Executive Meetings
|
|
# notifier no-ops when no SMTP config is present.
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_USER=
|
|
SMTP_PASS=
|
|
SMTP_SECURE=false
|
|
SMTP_FROM=Tx OS <noreply@example.com>
|