5 Commits

Author	SHA1	Message	Date
Hartmut	01f8974314	rename(phase 3): compose/DB/infra names + stray code refs capakraken → nexus ... - docker-compose.yml / .prod.yml / .ci.yml: project names, POSTGRES_DB/USER, pg_isready, DATABASE_URL, volume names (nexus_pgdata, nexus_prod_*) - .github/workflows/ci.yml: POSTGRES_PASSWORD, pg_isready, psql credentials, GRANT statements, POSTGRES_PASSWORD=nexus_dev for Docker Deploy job - scripts/db-target-guard.mjs: expectedDatabase default, NEXUS_EXPECTED_DB_NAME - scripts/prisma-with-env.mjs, e2e/test-server.mjs: env-var rename - packages/db/src/safe-destructive-env.ts + reset-dispo-import.ts: DB name set - packages/db/src/destructive-db-guard.ts: PROTECTED_DATABASE_NAMES → "nexus" - packages/db/src/destructive-db-guard.test.ts: all fixture DB names + comments - .env.example, tooling/deploy/deploy.env.example: DATABASE_URL, image refs - packages/api: Redis channel/key prefixes (rbac-invalidate, sse, ratelimit), logger service name, app-base-url log prefix - E2E: DB container names, localStorage/sessionStorage keys, email domains - scripts: architecture-guardrails filter, export/import-dev-seed defaults, harden-postgres defaults, start.sh pg_isready, worktree-hygiene fixture - tooling/migrate/rename-to-nexus.sh: new maintenance-window cutover script Only intentional capakraken survivor: anonymization.ts DEFAULT_ANONYMIZATION_SEED (functional cryptographic constant — changing it would invalidate stored aliases). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-21 16:35:39 +02:00
Hartmut	0ef9add935	ci(docker-deploy): pin DATABASE_URL to unique container name to fix split-brain ... The app container is attached to both `default` and `gitea_gitea` networks. Both have a container answering to "postgres" (ours on default, Gitea's core on gitea_gitea). Docker's embedded DNS returns IPs from all attached networks, so the app startup script's `prisma db push` and the seed script's `prisma.user.count()` cached different IPs and hit different postgres instances. The seed then saw "table public.users does not exist" even though `/api/health` reported db:ok. Override DATABASE_URL and REDIS_URL in docker-compose.ci.yml to use the unique compose container names (capakraken-postgres-1, capakraken-redis-1) so resolution is unambiguous. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-13 09:16:12 +02:00
Hartmut	b164c4ca70	ci: fix e2e hostname collision and docker-deploy admin seed ... E2E: rename service hosts postgres/redis to e2epg/e2eredis — the gitea_gitea network has multiple containers answering to 'postgres' (Gitea core + concurrent job services), causing split-brain where prisma db push and db:seed connected to different databases and audit_logs ended up missing. docker-compose.ci.yml: stop attaching postgres/redis to gitea_gitea for the docker-deploy-test job — only the app needs cross-network reachability; the compose services talk to each other on the internal default network. Docker Deploy: setup-admin.mjs imports @prisma/client and @node-rs/argon2 which only live in packages/db/node_modules. Node resolves bare specifiers from the script's directory (/app/scripts), not cwd, so pnpm --filter wrappers did not help. Set NODE_PATH to packages/db/node_modules as a fallback resolution root.	2026-04-13 00:04:32 +02:00
Hartmut	931d1f5d5f	ci: bridge docker-deploy compose to gitea_gitea; bypass turbo for e2e ... - docker-compose.ci.yml: attach app/postgres/redis to the external gitea_gitea network so the act_runner job container (which lives on gitea_gitea) can reach the compose services by name. Otherwise 'localhost:3100' from the job container resolves to the job container itself, not the compose-network app — all health checks and smoke tests were hitting nothing. - ci.yml: switch health/smoke URLs from localhost to http://app:3100 and expose PLAYWRIGHT_BASE_URL so the smoke config can override. - ci.yml: run E2E playwright directly via pnpm --filter, bypassing turbo which strict-filters PLAYWRIGHT_DATABASE_URL and friends. - playwright.ci.config.ts: honour PLAYWRIGHT_BASE_URL env override. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-12 23:22:50 +02:00
Hartmut	ec557a0b4b	ci: fix E2E db target guard and strip bind mounts in docker deploy test ... E2E was failing at `pnpm db:push` because scripts/prisma-with-env.mjs refuses to run when DATABASE_URL's database name doesn't match the expected target ("capakraken"). CI uses capakraken_test. Set CAPAKRAKEN_EXPECTED_DB_NAME=capakraken_test on the e2e job. Fresh-Linux Docker Deploy was failing because docker-compose.yml's dev bind mount `.:/app` doesn't work under docker-outside-of-docker on the Gitea act_runner — the host daemon can't see the job container's /workspace/... path, so the mount masks the image's baked-in files and the CMD fails with `cannot open ./tooling/docker/app-dev-start.sh`. Added docker-compose.ci.yml that resets `app.volumes` and layered it onto every `docker compose` invocation in the deploy job. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-12 21:41:46 +02:00