wtclaude
f2e59a2426
All checks were successful
PR checks / checks (pull_request) Successful in 9m46s
PLAN.md §13 phase 12, the last one. Four decisions of record, D54–D57, taking the count to fifty-seven; recorded in §6, "How phase 12 delivered it". A two-stage Dockerfile, a pull-only docker-compose.yml carrying both bind mounts, .env.example, the workflow that publishes and deploys, CONTRIBUTING.md, the community-health files this was the only repository of the ten to lack, and DEPLOY.md. D54 — a merge deploys, amending D6. build-image.yml pushes runicgateway-site:latest and :sha-<7>, then rolls the container over on the `rgcom` runner out of /opt/runicgateway.com, and waits for the container's own healthcheck rather than for `up -d` to return. D55 — the site runs on its own host behind a generic reverse proxy, so DEPLOY.md states the four requirements rather than one worked example, and the container binds 127.0.0.1 so the safe configuration is the default. D56 — @astrojs/node derives the request protocol from req.socket.encrypted and never reads x-forwarded-proto, so behind a TLS-terminating proxy the browser sends Origin: https://… while the container computes http://… and Astro's CSRF check compares them for equality. Every beta signup, from every visitor, was answered 403. serve.mjs now normalises both forwarded headers, unconditionally — the image should deploy and work. Two assertions in test/headers.test.mjs hold both halves. D57 — DEPLOY.md rather than a README section; SECURITY.md and CODE_OF_CONDUCT.md are pointers to the org's copies rather than copies, because a copy would hard-code the contact address D13 confines to brand.json. Verified: npm run verify green (eleven checks, 36 unit tests, 7 served tests, astro check 0 errors). The image was built and run with both mounts — a mounted brand reached 51 files and all 50 search pages, /brand/* fell back per file, a proxy-shaped signup reached the store, and the export CLI wrote both Play files to the host mount. docker compose config caught a YAML trap in the healthcheck: a block sequence reads the `: ` in `r.ok ? 0 : 1` as a mapping. Co-Authored-By: Claude <noreply@anthropic.com>
43 lines
1.1 KiB
Plaintext
43 lines
1.1 KiB
Plaintext
# What must never reach the build context.
|
|
#
|
|
# Two entries here are load-bearing rather than housekeeping, and both are about
|
|
# the bind mounts (PLAN.md §6, §7).
|
|
#
|
|
# brand/ is the OPERATOR's override. If a developer's local mount were copied
|
|
# in, the image would ship somebody's test logo as if it were stock —
|
|
# and, worse, it would win over brand-default/ on every deployment that
|
|
# does not mount its own. The mount is the only way brand/ is allowed
|
|
# to exist inside a container.
|
|
#
|
|
# data/ holds beta.sqlite: real addresses, given under a consent notice that
|
|
# says where they are stored. A published image is world-readable to
|
|
# anyone who can pull it. This line is the reason that cannot happen by
|
|
# accident.
|
|
#
|
|
# brand-default/ is deliberately NOT here. It is baked in and must always be
|
|
# complete; §7's whole per-file fallback rests on it.
|
|
|
|
node_modules
|
|
dist
|
|
.astro
|
|
.output
|
|
|
|
brand
|
|
data
|
|
|
|
.git
|
|
.gitea
|
|
.gitignore
|
|
.dockerignore
|
|
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
|
|
# Authoring inputs and working notes, none of which the running site reads.
|
|
PLAN.md
|
|
*.log
|
|
npm-debug.log*
|
|
.DS_Store
|
|
Thumbs.db
|