e1ec082e50
Task #534 — backend, infra, tooling. UI ships in Stage 2 (#535). Backend - New system_settings table (id=1 singleton): installed flag, base_url, local_domain, local_ip, https_mode, app_version. Pushed to dev DB. - New /api/setup/status (open) and /api/setup/{validate,complete} (gated by requireSetupOpen — 409 once installed). - completeInstall is fully transactional: pg_advisory_xact_lock serializes concurrent callers, double-gates on installed flag and admin existence, then atomically creates the admin user, assigns admin role + Admins/Everyone groups, and flips system_settings to installed=true. Rolls back on any failure. - Added redirectIfSetupNeeded() helper returning the full SetupStatus payload alongside a redirect target for SPA routing decisions. - Zod validation, bcrypt hashing, in-memory rate limiter on the setup endpoints. Backward compat - scripts/src/seed.ts now branches on installed flag + admin existence + SEED_*_PASSWORD env vars. Legacy installs (admin exists, system_settings empty) get backfilled to installed=true via ON CONFLICT DO UPDATE so they are never forced through the wizard. When env passwords are unset and no admin exists, the seed prints a wizard hint instead of seeding. Infra - docker-compose.yml: replaced nginx edge with a Caddy service that mounts ./certs and ./docker/Caddyfile{,.skip}. The web service no longer publishes a port directly — Caddy is the only public ingress. - Caddy entrypoint picks Caddyfile.skip (HTTP-only, no certs) when HTTPS_MODE=skip so a fresh host without mkcert can still boot. - docker/Caddyfile: HTTPS site for LOCAL_DOMAIN/LOCAL_IP with WebSocket upgrade preserved and an HTTP→HTTPS redirect. - start.sh: preserved. Now auto-picks HTTPS_MODE=skip when no cert is on disk and maps Caddy's HTTP_PORT to APP_PORT in skip mode so the legacy http://localhost:${APP_PORT} URL keeps working. In local/byo mode it prints the https://${LOCAL_DOMAIN} URL. - .env.example: added LOCAL_DOMAIN, LOCAL_IP, BASE_URL, HTTP_PORT, HTTPS_PORT, HTTPS_MODE; SEED_*_PASSWORD now optional. Tooling - scripts/local-setup.sh: idempotent OS-aware bootstrap (.env upsert, mkcert hint, cert SAN check, dry-run via LOCAL_SETUP_DRY_RUN). Tests - artifacts/api-server/tests/setup-wizard.test.mjs: 7/7 pass. - scripts/tests/local-setup.test.mjs: 2/2 pass. Constraints honored: no force-push, no destructive ops, start.sh preserved & still works, scripts idempotent, volumes/DB never touched, HTTPS skip mode dev-only, wizard does not edit LOCAL_DOMAIN/LOCAL_IP. Out of scope / not addressed: pre-existing TS errors in routes/users.ts and pre-existing failure in executive-meetings-postpone-race.test.mjs.
102 lines
3.5 KiB
Bash
Executable File
102 lines
3.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# -----------------------------------------------------------------------------
|
|
# Tx OS — one-shot launcher for Docker on macOS / Linux.
|
|
# Usage:
|
|
# ./start.sh # build (if needed) and start in the background
|
|
# ./start.sh logs # tail container logs
|
|
# ./start.sh stop # stop containers (data is preserved)
|
|
# ./start.sh down # stop AND remove containers (data still preserved)
|
|
# ./start.sh reset # DANGEROUS: also wipe database + uploaded files
|
|
# ./start.sh rebuild # force rebuild images then start
|
|
# -----------------------------------------------------------------------------
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")"
|
|
|
|
if ! command -v docker >/dev/null 2>&1; then
|
|
echo "Docker not found. Install Docker Desktop from https://www.docker.com/products/docker-desktop/"
|
|
exit 1
|
|
fi
|
|
|
|
if ! docker compose version >/dev/null 2>&1; then
|
|
echo "Docker Compose v2 not found. Update Docker Desktop."
|
|
exit 1
|
|
fi
|
|
|
|
if [ ! -f .env ]; then
|
|
echo "No .env file found. Creating one from .env.docker.example ..."
|
|
cp .env.docker.example .env
|
|
if command -v openssl >/dev/null 2>&1; then
|
|
SECRET="$(openssl rand -hex 32)"
|
|
PG_PW="$(openssl rand -hex 16)"
|
|
ADMIN_PW="$(openssl rand -base64 18 | tr -d '/+=' | cut -c1-20)"
|
|
USER_PW="$(openssl rand -base64 18 | tr -d '/+=' | cut -c1-20)"
|
|
if [[ "$OSTYPE" == "darwin"* ]]; then
|
|
SED_I=(sed -i '')
|
|
else
|
|
SED_I=(sed -i)
|
|
fi
|
|
"${SED_I[@]}" "s|^SESSION_SECRET=.*|SESSION_SECRET=${SECRET}|" .env
|
|
"${SED_I[@]}" "s|^POSTGRES_PASSWORD=.*|POSTGRES_PASSWORD=${PG_PW}|" .env
|
|
"${SED_I[@]}" "s|^SEED_ADMIN_PASSWORD=.*|SEED_ADMIN_PASSWORD=${ADMIN_PW}|" .env
|
|
"${SED_I[@]}" "s|^SEED_USER_PASSWORD=.*|SEED_USER_PASSWORD=${USER_PW}|" .env
|
|
echo
|
|
echo "================================================================"
|
|
echo " Generated initial credentials (also saved in .env)"
|
|
echo "----------------------------------------------------------------"
|
|
echo " Admin login: admin / ${ADMIN_PW}"
|
|
echo " User login: ahmed / ${USER_PW}"
|
|
echo "================================================================"
|
|
echo " IMPORTANT: write these down NOW — you can change them later"
|
|
echo " from the admin panel, but recovery from a lost admin password"
|
|
echo " requires direct database access."
|
|
echo "================================================================"
|
|
echo
|
|
else
|
|
echo "openssl not available — please open .env and set SESSION_SECRET, POSTGRES_PASSWORD, SEED_ADMIN_PASSWORD and SEED_USER_PASSWORD before running again."
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
action="${1:-up}"
|
|
|
|
case "$action" in
|
|
up)
|
|
echo "==> Building images (first time can take 5-10 minutes) ..."
|
|
docker compose build
|
|
echo "==> Starting containers ..."
|
|
docker compose up -d
|
|
APP_PORT="$(grep -E '^APP_PORT=' .env | cut -d= -f2 | tr -d '\r' || echo 3000)"
|
|
echo
|
|
echo "Tx OS is starting. Open http://localhost:${APP_PORT:-3000}"
|
|
echo "Tail logs with: ./start.sh logs"
|
|
;;
|
|
rebuild)
|
|
docker compose build --no-cache
|
|
docker compose up -d
|
|
;;
|
|
logs)
|
|
docker compose logs -f --tail=200
|
|
;;
|
|
stop)
|
|
docker compose stop
|
|
;;
|
|
down)
|
|
docker compose down
|
|
;;
|
|
reset)
|
|
read -r -p "This will DELETE the database and uploaded files. Type 'yes' to confirm: " ans
|
|
if [ "$ans" = "yes" ]; then
|
|
docker compose down -v
|
|
echo "All data wiped."
|
|
else
|
|
echo "Aborted."
|
|
fi
|
|
;;
|
|
*)
|
|
echo "Unknown action: $action"
|
|
echo "Usage: ./start.sh [up|rebuild|logs|stop|down|reset]"
|
|
exit 1
|
|
;;
|
|
esac
|