Hartmut
4a5edeef3e
CI / Unit Tests (pull_request) Successful in 5m46s
CI / Lint (pull_request) Failing after 3m49s
CI / E2E Tests (pull_request) Has been skipped
CI / Fresh-Linux Docker Deploy (pull_request) Has been skipped
CI / Assistant Split Regression (pull_request) Failing after 35s
CI / Architecture Guardrails (pull_request) Failing after 2m14s
CI / Typecheck (pull_request) Successful in 4m22s
CI / Build (pull_request) Has been skipped
CI / Release Images (pull_request) Has been skipped
- @capakraken/* → @nexus/* across 12 packages (root + 11 workspaces),
1551 import lines migrated via codemod
- User-visible brand strings renamed (emails, page titles, PWA
manifest, mobile header, MFA backup-codes header, tooltips, signin
page, invite page, weekly digest, install prompt)
- TOTP issuer "CapaKraken" → "Nexus" (existing secrets still valid;
re-enrollment relabels them in users' authenticator apps)
- Function rename: assertCapaKrakenDbTarget → assertNexusDbTarget
- LocalStorage migration shim in apps/web/src/app/layout.tsx copies
capakraken_* → nexus_* on first load (guarded by nexus_migrated_v1
sentinel; runs once per browser, then never again)
- Service-worker cache name capakraken-v2 → nexus-v2 with one-time
caches.delete('capakraken-v2') from the same shim
- Email-domain fixtures @capakraken.{dev,app} → @nexus.{dev,app} in
seed data, e2e specs, SMTP default fallback
- Dockerfile.dev / Dockerfile.prod / all .github/workflows/*.yml
pnpm --filter @capakraken/* → @nexus/*
- README, CLAUDE.md, LEARNINGS.md, all docs/*.md, .env.example,
tooling/deploy/.env.production.example brand sweep
Phase 1 deliberately leaves untouched (handled in Phase 3 cutover):
- PostgreSQL DB name "capakraken" and POSTGRES_USER "capakraken"
- Volume names capakraken_pgdata etc.
- Compose project name "capakraken" / "capakraken-prod"
- db-target-guard default expectedDatabase
- env-var CAPAKRAKEN_EXPECTED_DB_NAME
- Container DNS names in docker-compose.ci.yml
Quality gates green: pnpm typecheck (7/7), pnpm test:unit (7/7),
pnpm lint (0 errors), check:exports/imports/architecture all pass.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Deploy Tooling
This directory contains the canonical host-side tooling for the image-based staging and production path.
Files
deploy-compose.sh: validates compose input, pulls images, runs migrations, starts the app, and waits for readiness.env.production.example: example host-side runtime configurationdeploy.env.example: example short-lived deployment manifest written by GitHub Actions
Host Layout
On the target host, the deploy directory should contain:
<deploy-path>/
docker-compose.prod.yml
deploy.env
.env.production
tooling/deploy/deploy-compose.sh
deploy.env is ephemeral and written by GitHub Actions for one deployment. .env.production stays on the host and contains the long-lived runtime secrets and app configuration.
First Setup
- Copy
tooling/deploy/.env.production.exampleto the target host as.env.production. - Fill in the required secrets and URLs.
- Keep
RATE_LIMIT_BACKEND=redisso production uses the shared counter path intentionally. - Copy
tooling/deploy/deploy.env.exampleto the host only if you want to dry-run the deploy script manually. - Replace the placeholder images in
deploy.env.examplewith a realsha-<commit>tag and save it asdeploy.envfor a manual dry run. - Provision runtime AI/SMTP/anonymization secrets on the host through
.env.productionor the platform's secret facility. - Keep admin settings for status/verification only; do not use them to enter or rotate operational secrets.
- After migration, use the admin cleanup action to remove any legacy database-stored runtime secrets.
- Ensure Docker Engine and Docker Compose v2 are installed.
- Ensure the target host can pull from
ghcr.io. - A normal release no longer needs a Git checkout on the host. The host only needs the deploy bundle plus the two env files.
- Merge to
main, letrelease-image.ymlpublish the immutable images, then run the staging or production deploy workflow with the same image tag.
Manual Host Test
After the files are present on the host, the canonical flow can be tested manually:
set -a
. ./deploy.env
set +a
bash tooling/deploy/deploy-compose.sh staging