jhodgkin
952303d05c
Deploy to Dev / Deploy & Smoke Test (push) Successful in 20s
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
84 lines
4.5 KiB
Markdown
84 lines
4.5 KiB
Markdown
# Backlog from overnight session — 2026-07-16
|
|
|
|
Written to the repo because the available Gitea credential (`write:repository` only)
|
|
cannot create issues. **Transfer these to Gitea once a token with
|
|
`read:issue` + `write:issue` scope exists.**
|
|
|
|
## Blockers needing Jerod's input
|
|
|
|
### B1. Gitea API token for agent workflows
|
|
The stored git credential can push code but not read/create issues
|
|
(`required=[read:issue], token scope=write:repository`). Create a token at
|
|
git.jerodrigged.com/user/settings/applications with `read:user`, `write:issue`,
|
|
`write:repository` and set it as `GITEA_TOKEN` (user env var) on this machine.
|
|
|
|
### B2. Production (CT111) api/.env is a blank template
|
|
The GitHub deploy now auto-creates `api/.env` from `.env.example`, which is why the
|
|
new stack runs — but every secret is empty. Until real values are set on CT111 at
|
|
`/opt/lisilou-portfolio/api/.env`:
|
|
- admin dashboard login is disabled (no `ADMIN_SECRET`)
|
|
- **new bookings send no n8n notification — real clients could book silently**
|
|
- calendar availability shows all dates free (no Google creds)
|
|
- SSO/client portal sign-in is inactive (no `OIDC_*` / `SESSION_SECRET`)
|
|
Copy working values from CT114:`/opt/…/api/.env` (adjust `SITE_URL` / `CORS_ORIGIN`
|
|
to https://lisilou.jerodrigged.com), then `docker compose restart api`.
|
|
|
|
### B3. Authentik provider + groups (issues #10/#12)
|
|
Code for OIDC login and the client portal is deployed and tested, but Authentik
|
|
needs one-time admin setup (see header comment in `api/auth.js`):
|
|
1. OAuth2/OpenID provider (confidential; redirect URIs for both dev and prod
|
|
`/api/auth/callback`), application "LisiLou Portfolio"
|
|
2. `lisilou-admin` group with Elysse (grants dashboard access)
|
|
3. Enrollment flow for client self-registration (#12) — Authentik-side config only
|
|
4. Fill `OIDC_*` + `SESSION_SECRET` in both instances' `api/.env`
|
|
|
|
### B4. Decide the deploy topology (dev vs prod)
|
|
Discovered overnight: `lisilou.jerodrigged.com` → NPM (CT102) → **CT111**, deployed
|
|
by **GitHub** Actions from github.com/jhodgkin/lisilou-portfolio; the Gitea repo
|
|
deploys to **CT114** (dev). The public site was 20 commits stale because pushes
|
|
stopped reaching GitHub. I've synced GitHub main and both pipelines are green, but:
|
|
- keeping two remotes in sync manually will drift again (mirror Gitea→GitHub, or
|
|
point NPM at CT114, or move prod deploy to Gitea Actions)
|
|
- CT111 and CT114 have separate SQLite DBs — real bookings live on CT111 only
|
|
- `homelab/docs/infrastructure.md` is stale (lists CT114 as Keycloak; CT111 notes
|
|
don't mention the GitHub runner deploy chain)
|
|
|
|
## Security
|
|
|
|
### S1. Signed-contract download is unauthenticated and enumerable
|
|
`GET /api/bookings/:id/contract` serves any signed contract by numeric id (kept
|
|
because n8n email links use it). Replace with HMAC-signed URLs
|
|
(`?token=…`, using SESSION_SECRET) and update the n8n workflow template.
|
|
|
|
### S2. Dev ADMIN_SECRET committed in playwright.config.js
|
|
`9yPu…` is in git history and matches the dev instance. Rotate the dev secret and
|
|
inject via env/Gitea secret instead of a hardcoded default.
|
|
|
|
## Content (needed to look professional — code is ready, assets are missing)
|
|
|
|
### C1. Real photography on the prod volume
|
|
- `/images/hero.jpg` — new: homepage hero photo (soft scrim applied automatically)
|
|
- portfolio category covers (`/images/portfolio/*-cover.jpg`) or working Immich
|
|
album links — cards currently show the styled placeholder
|
|
- location photos (`/images/locations/<id>/hero.jpg`, `1.jpg`, `2.jpg`)
|
|
- `/images/logo.png`, `/images/favicon.ico`, profile photo
|
|
Verify the Immich share albums referenced in `site.json` resolve on prod.
|
|
|
|
### C2. Contract template PDF
|
|
`api/contracts/model-release.pdf` is absent on both instances — the e-sign step
|
|
falls back and no PDF gets stamped. Drop the real contract on the volumes.
|
|
|
|
### C3. Confirm public contact details
|
|
`site.json` has `hello@lisilou.com` and an empty phone; Venmo username
|
|
`LisiLouPhoto` — confirm all are real before promoting the site.
|
|
|
|
## Nice-to-haves spotted during the walkthrough
|
|
- Portfolio lightbox: verify Immich proxy flow end-to-end on prod (couldn't test
|
|
without albums)
|
|
- `/dashboard` and `/my-bookings` aren't linked from anywhere for the photographer;
|
|
consider a footer link or bookmark
|
|
- Add `robots.txt` + real meta description / OpenGraph tags for sharing
|
|
- The "designer plugin" requested for the design review doesn't exist in this
|
|
Claude Code environment — the pass was done manually (screenshots + fixes);
|
|
if there's a specific plugin to install, add it to `.claude/settings.json`
|