rename(phase 3): compose/DB/infra + stray code refs capakraken → nexus #62

Merged

Hartmut merged 4 commits from rename/nexus-infra into main 2026-05-21 20:07:19 +02:00

Conversation 0 Commits 4 Files Changed 44

+406 -187

Hartmut commented 2026-05-21 16:36:50 +02:00

Owner

Copy Link

Copy Source

Summary

• docker-compose.yml / .prod.yml / .ci.yml: project names, POSTGRES_DB/POSTGRES_USER, pg_isready health-checks, DATABASE_URL, volume names (nexus_pgdata, nexus_prod_pgdata, nexus_prod_redis)
• .github/workflows/ci.yml: POSTGRES_PASSWORD, psql credentials, GRANT statements, POSTGRES_PASSWORD=nexus_dev for Docker Deploy
• db-guard + env-var: scripts/db-target-guard.mjs, prisma-with-env.mjs, e2e/test-server.mjs → NEXUS_EXPECTED_DB_NAME; safe-destructive-env.ts, reset-dispo-import.ts, destructive-db-guard.ts/.test.ts
• API Redis channels/keys: nexus:rbac-invalidate, nexus:sse, nexus:ratelimit, logger service name
• E2E: DB container names (nexus-postgres-1), localStorage/sessionStorage keys, email domain fixtures
• Scripts: check-architecture-guardrails, export/import-dev-seed, harden-postgres, start.sh, worktree-hygiene.test
• New: tooling/migrate/rename-to-nexus.sh — idempotent maintenance-window cutover script (pg_dump → restore → volume copy → bring up under new project name)

Intentional survivor

packages/api/src/lib/anonymization.ts DEFAULT_ANONYMIZATION_SEED is a functional cryptographic constant — changing it would invalidate all stored anonymization aliases.

After merge

Run tooling/migrate/rename-to-nexus.sh dev in a brief maintenance window to migrate the running Docker stack (DB dump/restore, volume copy, compose project rename). Old capakraken DB + role are retained for rollback.

Test plan

• CI green on this PR
• pnpm test:unit — all passing locally ✓
• pnpm lint — no errors ✓
• pnpm --filter @nexus/web exec tsc --noEmit — clean ✓
• After merge: run ./tooling/migrate/rename-to-nexus.sh dev, verify row counts match, app boots under nexus compose project

🤖 Generated with Claude Code

## Summary - **docker-compose.yml / .prod.yml / .ci.yml**: project names, `POSTGRES_DB`/`POSTGRES_USER`, `pg_isready` health-checks, `DATABASE_URL`, volume names (`nexus_pgdata`, `nexus_prod_pgdata`, `nexus_prod_redis`) - **`.github/workflows/ci.yml`**: `POSTGRES_PASSWORD`, psql credentials, `GRANT` statements, `POSTGRES_PASSWORD=nexus_dev` for Docker Deploy - **db-guard + env-var**: `scripts/db-target-guard.mjs`, `prisma-with-env.mjs`, `e2e/test-server.mjs` → `NEXUS_EXPECTED_DB_NAME`; `safe-destructive-env.ts`, `reset-dispo-import.ts`, `destructive-db-guard.ts/.test.ts` - **API Redis channels/keys**: `nexus:rbac-invalidate`, `nexus:sse`, `nexus:ratelimit`, logger service name - **E2E**: DB container names (`nexus-postgres-1`), localStorage/sessionStorage keys, email domain fixtures - **Scripts**: `check-architecture-guardrails`, `export/import-dev-seed`, `harden-postgres`, `start.sh`, `worktree-hygiene.test` - **New**: `tooling/migrate/rename-to-nexus.sh` — idempotent maintenance-window cutover script (pg_dump → restore → volume copy → bring up under new project name) ## Intentional survivor `packages/api/src/lib/anonymization.ts` `DEFAULT_ANONYMIZATION_SEED` is a functional cryptographic constant — changing it would invalidate all stored anonymization aliases. ## After merge Run `tooling/migrate/rename-to-nexus.sh dev` in a brief maintenance window to migrate the running Docker stack (DB dump/restore, volume copy, compose project rename). Old `capakraken` DB + role are retained for rollback. ## Test plan - [ ] CI green on this PR - [ ] `pnpm test:unit` — all passing locally ✓ - [ ] `pnpm lint` — no errors ✓ - [ ] `pnpm --filter @nexus/web exec tsc --noEmit` — clean ✓ - [ ] After merge: run `./tooling/migrate/rename-to-nexus.sh dev`, verify row counts match, app boots under `nexus` compose project 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Hartmut added 1 commit 2026-05-21 16:36:51 +02:00

rename(phase 3): compose/DB/infra names + stray code refs capakraken → nexus ... 01f8974314

- docker-compose.yml / .prod.yml / .ci.yml: project names, POSTGRES_DB/USER,
  pg_isready, DATABASE_URL, volume names (nexus_pgdata, nexus_prod_*)
- .github/workflows/ci.yml: POSTGRES_PASSWORD, pg_isready, psql credentials,
  GRANT statements, POSTGRES_PASSWORD=nexus_dev for Docker Deploy job
- scripts/db-target-guard.mjs: expectedDatabase default, NEXUS_EXPECTED_DB_NAME
- scripts/prisma-with-env.mjs, e2e/test-server.mjs: env-var rename
- packages/db/src/safe-destructive-env.ts + reset-dispo-import.ts: DB name set
- packages/db/src/destructive-db-guard.ts: PROTECTED_DATABASE_NAMES → "nexus"
- packages/db/src/destructive-db-guard.test.ts: all fixture DB names + comments
- .env.example, tooling/deploy/deploy.env.example: DATABASE_URL, image refs
- packages/api: Redis channel/key prefixes (rbac-invalidate, sse, ratelimit),
  logger service name, app-base-url log prefix
- E2E: DB container names, localStorage/sessionStorage keys, email domains
- scripts: architecture-guardrails filter, export/import-dev-seed defaults,
  harden-postgres defaults, start.sh pg_isready, worktree-hygiene fixture
- tooling/migrate/rename-to-nexus.sh: new maintenance-window cutover script

Only intentional capakraken survivor: anonymization.ts DEFAULT_ANONYMIZATION_SEED
(functional cryptographic constant — changing it would invalidate stored aliases).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Hartmut added 1 commit 2026-05-21 17:23:39 +02:00

fix(ci): tear down legacy capakraken compose project before Docker Deploy ... 7cee3b3a97

After the Phase 3 rename the project name flipped from 'capakraken' to 'nexus'.
The QNAP runner may still have capakraken-redis-1 running (holding port 6380).
The down step only cleaned up the 'nexus' project, leaving the old container
alive and causing "Bind for 0.0.0.0:6380 failed: port is already allocated".

Add an explicit `docker compose -p capakraken ... down` before the normal
cleanup so stale pre-rename containers are always removed first.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Hartmut added 1 commit 2026-05-21 19:38:03 +02:00

fix(ci): add --profile full to teardown so app container on port 3100 is stopped ... db7948d279

The app service is declared under the 'full' profile. Without --profile full,
docker compose down skips it — leaving nexus-app-1 (or capakraken-app-1)
running and holding port 3100, which causes the next run to fail with
"Bind for 0.0.0.0:3100 failed: port is already allocated".

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Hartmut added 1 commit 2026-05-21 19:51:46 +02:00

ci: retrigger — unit-tests flake on run 159 (setup-node .gitignore issue) 5d6ca3d8cc

Hartmut merged commit 19aeb2ba04 into main 2026-05-21 20:07:19 +02:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

cdp

CDP (Client Data Protection) compliance

epic

Parent/umbrella ticket

not-applicable

Control does not apply to CapaKraken scope

security

Security / compliance work

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

Hartmut

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Hartmut/Nexus#62