7 Commits

Include renames

Author	SHA1	Message	Date
Hartmut	b41c1d2501	rename(phase 1): CapaKraken → Nexus across code, UI, docs, CI (#61) ... rename(phase 1): CapaKraken → Nexus across code, UI, docs, CI (#61) Co-authored-by: Hartmut Nörenberg <hn@hartmut-noerenberg.com> Co-committed-by: Hartmut Nörenberg <hn@hartmut-noerenberg.com>	2026-05-21 16:28:40 +02:00
HartmutandClaude Opus 4.7	805bb0464f	security(docker): remove hardcoded dev password, stop placeholder secrets leaking into migrator image (#50) ... - docker-compose.yml: require ${POSTGRES_PASSWORD} for the postgres service and the app container's DATABASE_URL. No default — compose refuses to start without it, mirroring the existing PGADMIN_PASSWORD pattern. - Dockerfile.prod: move auth/db ENV assignments from persistent ENV lines into an inline env prefix on the `pnpm build` RUN step. Placeholders are still available to `next build` but no longer persist in the builder layer or in the published migrator image (which is FROM builder). - Dockerfile.dev: add HEALTHCHECK against /api/health and install curl for it. - .dockerignore: cover nested **/.env*, **/*.pem, **/*.key, **/secrets/**. - runtime-env.ts: add the CI build placeholder strings to the disallowed-secret set so a misconfigured prod deploy using the baked-in ARG defaults fails startup instead of silently running with a known-bad secret. - .env.example: document the new POSTGRES_PASSWORD requirement. - CI: write POSTGRES_PASSWORD into the Fresh-Linux Docker Deploy job's .env (must match docker-compose.ci.yml's hardcoded DATABASE_URL), and provide a dummy value in the E2E job where compose validates all services' interp. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-17 14:50:05 +02:00
HartmutandClaude Sonnet 4.6	c784b4b378	fix(infra): wait for postgres readiness before running migrations on container start ... Installs postgresql-client in the dev image so pg_isready is available. The startup script now polls until postgres accepts connections, preventing the P1001 "can't reach database" crash when the app container starts before postgres is fully ready. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-09 21:14:31 +02:00
Hartmut	4eac7b1888	fix(infra): apply missing migrations, fix Dockerfile.dev ui package reference	2026-04-09 20:29:21 +02:00
Hartmutandclaude-flow	0e119cfe73	security: close audit findings #19–#23 and harden Docker setup (#24) ... #19 MFA QR code: render locally via qrcode package, remove external qrserver.com request #20 Webhook SSRF: add ssrf-guard.ts with DNS-verified IP blocklist; enforce on create/update/test/dispatch #21 /api/perf: fail-closed when CRON_SECRET missing; remove query-string token auth #22 CSP: remove unsafe-eval and unsafe-inline from script-src in production builds #23 Active session registry: forward jti into session object; validate against ActiveSession on every tRPC request #24 Docker: add missing packages/application to Dockerfile.dev; fix pnpm-lock.yaml glob; run db:migrate:deploy on container start so a fresh checkout boots without manual steps Also: fix pre-existing TS error in e2e/allocations.spec.ts (args.length literal type overlap) Co-Authored-By: claude-flow <ruv@ruv.net>	2026-04-01 18:19:21 +02:00
Hartmut	4f48afe7b4	feat(planning): ship holiday-aware planning and assistant upgrades	2026-03-28 22:49:28 +01:00
Hartmut	dd55d0e78b	chore(repo): initialize planarchy workspace	2026-03-14 14:31:09 +01:00