clusev

Commit Graph

Author	SHA1	Message	Date
boban	e6f6e7f8a4	fix(dev): read VITE_HMR_HOST from the .env FILE (loadEnv), restoring dev HMR assets Regression from the leak-scrub: vite.config read $process.env.VITE_HMR_HOST, but the dev container bind-mounts .env without exporting it into the process environment — so it was ALWAYS empty and the hmr host fell back to 'localhost'. On a remote dev box the browser then loaded the Vite client + app.css + app.js from localhost:5173 (ERR_CONNECTION_REFUSED) → the whole panel rendered unstyled. Switch to Vite's loadEnv (reads the .env file, same source the other VITE_* vars use) and fall back to undefined (Vite infers the host from the request) instead of a hard 'localhost'. The real address stays in the untracked dev .env (documented in .env.example, no IP committed). Verified: dev assets load 200 + the login renders styled, and `npm run build` (prod) still succeeds.	2026-07-05 11:06:53 +02:00
boban	a6176341e2	fix(security): keep internal IPs out of shipped code and docs/ out of the public image Audit leak-hygiene findings: - The operator's real internal dev-VM/WireGuard IPs (10.10.90.136/.162/.165) were shipped in vite.config.js (hmr.host), lang hint/placeholder strings, a code comment and the CHANGELOG. vite HMR host is now env-driven (VITE_HMR_HOST, dev .env only); all other occurrences are replaced with RFC5737 documentation addresses (203.0.113.x). Tests updated in lockstep. - docs/ is export-ignored from the git tree and named in promote.sh's refuse-to-publish list, but was never .dockerignore'd, so `COPY . .` baked the private docs (with private host/URL refs) into the public image, which the git-tree leak-guard never inspects. Added docs/ (and art/) to .dockerignore. - /update.log (new repo-root update transcript) gitignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-04 10:25:10 +02:00
boban	53f7309c0b	feat: scaffold — Dockerized Laravel 13 + Livewire 3 + Tailwind 4 + Reverb Working dev stack on :80 (Freigabe step 5: app boots, page renders, Vite HMR runs): - Multi-stage Dockerfile (php8.3-fpm + nginx + supervisor + node). Dev runs php-fpm + nginx + vite in ONE app container; prod target bakes vendor + assets. - docker-compose.yml (dev, bind-mount) + docker-compose.prod.yml (GHCR image). Env-driven ports/UID (APP_PORT, VITE_PORT, REVERB_HOST_PORT, DB_PORT, HOST_UID/HOST_GID) — nothing hardcoded. MariaDB only on 127.0.0.1:3306. - Laravel 13, Livewire 3.8 (class-based, no Volt), wire-elements/modal 2, phpseclib 3, laravel/reverb 1. composer platform pinned to php 8.3. - Tailwind v4 @theme tokens ("Tactical Terminal") in app.css; Vite remote HMR (host 0.0.0.0, hmr.host 10.10.90.136). - Dashboard as a full-page Livewire route (/) in layouts/app; §5 folder skeleton. - Docs: rules.md R1-R11 (incl. R11 UUID-in-URLs) + CLAUDE.md updated for Laravel 13, clusev/ root, port 80, vite-in-app, env-driven config. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-12 00:31:50 +02:00

Author

SHA1

Message

Date

boban

e6f6e7f8a4

fix(dev): read VITE_HMR_HOST from the .env FILE (loadEnv), restoring dev HMR assets

Regression from the leak-scrub: vite.config read $process.env.VITE_HMR_HOST, but the dev container
bind-mounts .env without exporting it into the process environment — so it was ALWAYS empty and the
hmr host fell back to 'localhost'. On a remote dev box the browser then loaded the Vite client + app.css
+ app.js from localhost:5173 (ERR_CONNECTION_REFUSED) → the whole panel rendered unstyled. Switch to
Vite's loadEnv (reads the .env file, same source the other VITE_* vars use) and fall back to undefined
(Vite infers the host from the request) instead of a hard 'localhost'. The real address stays in the
untracked dev .env (documented in .env.example, no IP committed). Verified: dev assets load 200 + the
login renders styled, and `npm run build` (prod) still succeeds.

2026-07-05 11:06:53 +02:00

boban

a6176341e2

fix(security): keep internal IPs out of shipped code and docs/ out of the public image

Audit leak-hygiene findings:
- The operator's real internal dev-VM/WireGuard IPs (10.10.90.136/.162/.165) were shipped in
  vite.config.js (hmr.host), lang hint/placeholder strings, a code comment and the CHANGELOG.
  vite HMR host is now env-driven (VITE_HMR_HOST, dev .env only); all other occurrences are replaced
  with RFC5737 documentation addresses (203.0.113.x). Tests updated in lockstep.
- docs/ is export-ignored from the git tree and named in promote.sh's refuse-to-publish list, but was
  never .dockerignore'd, so `COPY . .` baked the private docs (with private host/URL refs) into the
  public image, which the git-tree leak-guard never inspects. Added docs/ (and art/) to .dockerignore.
- /update.log (new repo-root update transcript) gitignored.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-04 10:25:10 +02:00

boban

53f7309c0b

feat: scaffold — Dockerized Laravel 13 + Livewire 3 + Tailwind 4 + Reverb

Working dev stack on :80 (Freigabe step 5: app boots, page renders, Vite HMR runs):
- Multi-stage Dockerfile (php8.3-fpm + nginx + supervisor + node). Dev runs
  php-fpm + nginx + vite in ONE app container; prod target bakes vendor + assets.
- docker-compose.yml (dev, bind-mount) + docker-compose.prod.yml (GHCR image).
  Env-driven ports/UID (APP_PORT, VITE_PORT, REVERB_HOST_PORT, DB_PORT,
  HOST_UID/HOST_GID) — nothing hardcoded. MariaDB only on 127.0.0.1:3306.
- Laravel 13, Livewire 3.8 (class-based, no Volt), wire-elements/modal 2,
  phpseclib 3, laravel/reverb 1. composer platform pinned to php 8.3.
- Tailwind v4 @theme tokens ("Tactical Terminal") in app.css; Vite remote HMR
  (host 0.0.0.0, hmr.host 10.10.90.136).
- Dashboard as a full-page Livewire route (/) in layouts/app; §5 folder skeleton.
- Docs: rules.md R1-R11 (incl. R11 UUID-in-URLs) + CLAUDE.md updated for
  Laravel 13, clusev/ root, port 80, vite-in-app, env-driven config.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-12 00:31:50 +02:00

3 Commits (e6f6e7f8a46a0f9bdf2d2cfbbd616ab540878eaf)