clusev

Commit Graph

Author	SHA1	Message	Date
boban	0b2dffe0de	fix+feat(release/security): apt timeout, real version/release model, domain in DB not .env, R15 - fix(hardening): fail2ban/unattended apt installs failed because the 12s SSH timeout aborted the package download. runPrivileged/runPlain take a $timeout; apt actions use 600s. Live-verified: fail2ban installs + is active/enabled on 10.10.90.162. - feat(release): cut the foundation as the first real semantic release v0.1.0 (no more -dev). CHANGELOG is Keep-a-Changelog BY VERSION; the Versions page parses it by version, reads the newest git TAG as "latest release", and honestly compares installed vs latest in the channel. Channels reduced to stable\|beta (no user-facing dev); System clamps a legacy value back to stable. Tagged v0.1.0. - fix(domain/.env): the panel domain lives in the DATABASE (Settings); the app never rewrites .env. AppServiceProvider overrides config('app.url') at runtime from the Setting (guarded against a missing table); /system states this explicitly. Caddy config is a standalone generated file; a Caddy reload is the only infra step. - docs(arch): Caddy is the prod-only TLS reverse proxy IN FRONT of the app container's nginx (Internet -> Caddy:443 -> nginx:80 -> php-fpm); no Caddy in dev. - R15 (rules.md + CLAUDE.md): Codex must review every change for errors + security before "done". The Codex CLI is not installed in this runtime (needs `sudo npm i -g @openai/codex` + `/codex:setup`); an independent adversarial security review of this diff returned CLEAN (no vulnerabilities, no bugs) as the interim gate. Verified (R12): /system + /versions 200 / 0 console errors; channels stable\|beta only, DB-not-.env callout; versions by-version with v0.1.0; app.url override resolves from the Setting; fail2ban live install ok. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-13 03:06:35 +02:00
boban	53f7309c0b	feat: scaffold — Dockerized Laravel 13 + Livewire 3 + Tailwind 4 + Reverb Working dev stack on :80 (Freigabe step 5: app boots, page renders, Vite HMR runs): - Multi-stage Dockerfile (php8.3-fpm + nginx + supervisor + node). Dev runs php-fpm + nginx + vite in ONE app container; prod target bakes vendor + assets. - docker-compose.yml (dev, bind-mount) + docker-compose.prod.yml (GHCR image). Env-driven ports/UID (APP_PORT, VITE_PORT, REVERB_HOST_PORT, DB_PORT, HOST_UID/HOST_GID) — nothing hardcoded. MariaDB only on 127.0.0.1:3306. - Laravel 13, Livewire 3.8 (class-based, no Volt), wire-elements/modal 2, phpseclib 3, laravel/reverb 1. composer platform pinned to php 8.3. - Tailwind v4 @theme tokens ("Tactical Terminal") in app.css; Vite remote HMR (host 0.0.0.0, hmr.host 10.10.90.136). - Dashboard as a full-page Livewire route (/) in layouts/app; §5 folder skeleton. - Docs: rules.md R1-R11 (incl. R11 UUID-in-URLs) + CLAUDE.md updated for Laravel 13, clusev/ root, port 80, vite-in-app, env-driven config. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-12 00:31:50 +02:00

Author

SHA1

Message

Date

boban

0b2dffe0de

fix+feat(release/security): apt timeout, real version/release model, domain in DB not .env, R15

- fix(hardening): fail2ban/unattended apt installs failed because the 12s SSH timeout
  aborted the package download. runPrivileged/runPlain take a $timeout; apt actions use
  600s. Live-verified: fail2ban installs + is active/enabled on 10.10.90.162.
- feat(release): cut the foundation as the first real semantic release v0.1.0 (no more
  -dev). CHANGELOG is Keep-a-Changelog BY VERSION; the Versions page parses it by version,
  reads the newest git TAG as "latest release", and honestly compares installed vs latest
  in the channel. Channels reduced to stable|beta (no user-facing dev); System clamps a
  legacy value back to stable. Tagged v0.1.0.
- fix(domain/.env): the panel domain lives in the DATABASE (Settings); the app never
  rewrites .env. AppServiceProvider overrides config('app.url') at runtime from the Setting
  (guarded against a missing table); /system states this explicitly. Caddy config is a
  standalone generated file; a Caddy reload is the only infra step.
- docs(arch): Caddy is the prod-only TLS reverse proxy IN FRONT of the app container's
  nginx (Internet -> Caddy:443 -> nginx:80 -> php-fpm); no Caddy in dev.
- R15 (rules.md + CLAUDE.md): Codex must review every change for errors + security before
  "done". The Codex CLI is not installed in this runtime (needs `sudo npm i -g @openai/codex`
  + `/codex:setup`); an independent adversarial security review of this diff returned CLEAN
  (no vulnerabilities, no bugs) as the interim gate.

Verified (R12): /system + /versions 200 / 0 console errors; channels stable|beta only,
DB-not-.env callout; versions by-version with v0.1.0; app.url override resolves from the
Setting; fail2ban live install ok.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-13 03:06:35 +02:00

boban

53f7309c0b

feat: scaffold — Dockerized Laravel 13 + Livewire 3 + Tailwind 4 + Reverb

Working dev stack on :80 (Freigabe step 5: app boots, page renders, Vite HMR runs):
- Multi-stage Dockerfile (php8.3-fpm + nginx + supervisor + node). Dev runs
  php-fpm + nginx + vite in ONE app container; prod target bakes vendor + assets.
- docker-compose.yml (dev, bind-mount) + docker-compose.prod.yml (GHCR image).
  Env-driven ports/UID (APP_PORT, VITE_PORT, REVERB_HOST_PORT, DB_PORT,
  HOST_UID/HOST_GID) — nothing hardcoded. MariaDB only on 127.0.0.1:3306.
- Laravel 13, Livewire 3.8 (class-based, no Volt), wire-elements/modal 2,
  phpseclib 3, laravel/reverb 1. composer platform pinned to php 8.3.
- Tailwind v4 @theme tokens ("Tactical Terminal") in app.css; Vite remote HMR
  (host 0.0.0.0, hmr.host 10.10.90.136).
- Dashboard as a full-page Livewire route (/) in layouts/app; §5 folder skeleton.
- Docs: rules.md R1-R11 (incl. R11 UUID-in-URLs) + CLAUDE.md updated for
  Laravel 13, clusev/ root, port 80, vite-in-app, env-driven config.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-12 00:31:50 +02:00

2 Commits (4bfa367ccfb67e841f7b9c2a53200db3e99e16fa)