lisilou-portfolio/docs/BACKLOG-2026-07-16.md

Backlog from overnight session — 2026-07-16

Written to the repo because the available Gitea credential (write:repository only) cannot create issues. Transfer these to Gitea once a token with read:issue + write:issue scope exists.

Blockers needing Jerod's input

B1. Gitea API token for agent workflows

The stored git credential can push code but not read/create issues (required=[read:issue], token scope=write:repository). Create a token at git.jerodrigged.com/user/settings/applications with read:user, write:issue, write:repository and set it as GITEA_TOKEN (user env var) on this machine.

B2. Production (CT111) api/.env is a blank template

The GitHub deploy now auto-creates api/.env from .env.example, which is why the new stack runs — but every secret is empty. Until real values are set on CT111 at /opt/lisilou-portfolio/api/.env:

• admin dashboard login is disabled (no ADMIN_SECRET)
• new bookings send no n8n notification — real clients could book silently
• calendar availability shows all dates free (no Google creds)
• SSO/client portal sign-in is inactive (no OIDC_* / SESSION_SECRET) Copy working values from CT114:/opt/…/api/.env (adjust SITE_URL / CORS_ORIGIN to https://lisilou.jerodrigged.com), then docker compose restart api.

B3. Authentik provider + groups (issues #10/#12)

Code for OIDC login and the client portal is deployed and tested, but Authentik needs one-time admin setup (see header comment in api/auth.js):

1. OAuth2/OpenID provider (confidential; redirect URIs for both dev and prod /api/auth/callback), application "LisiLou Portfolio"
2. lisilou-admin group with Elysse (grants dashboard access)
3. Enrollment flow for client self-registration (#12) — Authentik-side config only
4. Fill OIDC_* + SESSION_SECRET in both instances' api/.env

B4. Decide the deploy topology (dev vs prod)

Discovered overnight: lisilou.jerodrigged.com → NPM (CT102) → CT111, deployed by GitHub Actions from github.com/jhodgkin/lisilou-portfolio; the Gitea repo deploys to CT114 (dev). The public site was 20 commits stale because pushes stopped reaching GitHub. I've synced GitHub main and both pipelines are green, but:

• keeping two remotes in sync manually will drift again (mirror Gitea→GitHub, or point NPM at CT114, or move prod deploy to Gitea Actions)
• CT111 and CT114 have separate SQLite DBs — real bookings live on CT111 only
• homelab/docs/infrastructure.md is stale (lists CT114 as Keycloak; CT111 notes don't mention the GitHub runner deploy chain)

B5. dev-lisilou.jerodrigged.com has no NPM proxy host

The Cloudflare tunnel delivers the hostname to NPM (CT102), but NPM has no proxy host for it, so it falls through to the "Jerod Rigged" default landing page. Verified: curl -H "Host: dev-lisilou.jerodrigged.com" http://192.168.1.185/ → landing page, while the same probe with Host: lisilou.jerodrigged.com → healthy. I could not fix this without the NPM admin login (192.168.1.185:81 — presumably in Vaultwarden; factory default is disabled, and neither SSH nor the ansible key works from this machine).

Fix (2 min in NPM UI): Hosts → Proxy Hosts → Add:

• Domain: dev-lisilou.jerodrigged.com
• Scheme http, Forward Host 192.168.1.192, Port 8080
• Websockets ON, Block Common Exploits ON; SSL tab: same as the lisilou.jerodrigged.com host Also confirm the hostname exists as a public hostname/CNAME in the CF tunnel config (it already resolves and reaches NPM, so likely fine).

So the agent can do this next time: put the NPM admin credential in a place Claude can reach (e.g. NPM_ADMIN_IDENTITY/NPM_ADMIN_SECRET env vars, or an API-only NPM user), or install/authorize the ~/.ssh/ansible_ed25519 key on this machine.

Security

S1. Signed-contract download is unauthenticated and enumerable

GET /api/bookings/:id/contract serves any signed contract by numeric id (kept because n8n email links use it). Replace with HMAC-signed URLs (?token=…, using SESSION_SECRET) and update the n8n workflow template.

S2. Dev ADMIN_SECRET committed in playwright.config.js

9yPu… is in git history and matches the dev instance. Rotate the dev secret and inject via env/Gitea secret instead of a hardcoded default.

Content (needed to look professional — code is ready, assets are missing)

C1. Real photography on the prod volume

• /images/hero.jpg — new: homepage hero photo (soft scrim applied automatically)
• portfolio category covers (/images/portfolio/*-cover.jpg) or working Immich album links — cards currently show the styled placeholder
• location photos (/images/locations/<id>/hero.jpg, 1.jpg, 2.jpg)
• /images/logo.png, /images/favicon.ico, profile photo Verify the Immich share albums referenced in site.json resolve on prod.

C2. Contract template PDF

api/contracts/model-release.pdf is absent on both instances — the e-sign step falls back and no PDF gets stamped. Drop the real contract on the volumes.

C3. Confirm public contact details

site.json has hello@lisilou.com and an empty phone; Venmo username LisiLouPhoto — confirm all are real before promoting the site.

Nice-to-haves spotted during the walkthrough

• Portfolio lightbox: verify Immich proxy flow end-to-end on prod (couldn't test without albums)
• /dashboard and /my-bookings aren't linked from anywhere for the photographer; consider a footer link or bookmark
• Add robots.txt + real meta description / OpenGraph tags for sharing
• The "designer plugin" requested for the design review doesn't exist in this Claude Code environment — the pass was done manually (screenshots + fixes); if there's a specific plugin to install, add it to .claude/settings.json