clusev

Commit Graph

Author	SHA1	Message	Date
boban	16655eb537	feat(deploy): install.sh + Caddy auto-TLS + prod hardening One-command, idempotent production install per docs/install-update-design.md (the "JETZT" phase). Onboarding (forced password change + 2FA) already ships via EnsureSecurityOnboarded; the in-dashboard self-updater stays deferred to v1.x. - install.sh: preflight -> idempotent secrets (set_kv never regenerates) -> derive SITE_ADDRESS/APP_URL/REVERB_* from the single APP_DOMAIN knob -> build -> up -> wait DB -> migrate + cache -> clusev:install. One-time admin password is printed only on the terminal, never stored. Bare-IP and private-IP warnings. - app/Console/Commands/Install.php: idempotent first admin (Str::password(20), must_change_password); hard no-op once a user exists (INSTALL_LOCK idiom). - docker/caddy/Caddyfile: one template, both modes; Reverb wss over /app/* and /apps/* on the same address; admin-API-free, security headers. Validated for bare-IP (:80) and domain (https) modes. - docker-compose.prod.yml: Caddy is the only host-published service (80/443 + HTTP/3); app/reverb/queue/mariadb lose host ports (internal net only); CLUSEV_IMAGE indirection (locally-built tag, GHCR digest later); Redis requires a password; caddy-data/caddy-config volumes persist ACME certs. - .env.example: APP_DOMAIN/APP_SCHEME/ACME_EMAIL/SITE_ADDRESS/CLUSEV_IMAGE/ UPDATE_HMAC_KEY documented. - README: real Clusev install/deploy guide (replaces Laravel boilerplate). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-12 15:17:32 +02:00
boban	53f7309c0b	feat: scaffold — Dockerized Laravel 13 + Livewire 3 + Tailwind 4 + Reverb Working dev stack on :80 (Freigabe step 5: app boots, page renders, Vite HMR runs): - Multi-stage Dockerfile (php8.3-fpm + nginx + supervisor + node). Dev runs php-fpm + nginx + vite in ONE app container; prod target bakes vendor + assets. - docker-compose.yml (dev, bind-mount) + docker-compose.prod.yml (GHCR image). Env-driven ports/UID (APP_PORT, VITE_PORT, REVERB_HOST_PORT, DB_PORT, HOST_UID/HOST_GID) — nothing hardcoded. MariaDB only on 127.0.0.1:3306. - Laravel 13, Livewire 3.8 (class-based, no Volt), wire-elements/modal 2, phpseclib 3, laravel/reverb 1. composer platform pinned to php 8.3. - Tailwind v4 @theme tokens ("Tactical Terminal") in app.css; Vite remote HMR (host 0.0.0.0, hmr.host 10.10.90.136). - Dashboard as a full-page Livewire route (/) in layouts/app; §5 folder skeleton. - Docs: rules.md R1-R11 (incl. R11 UUID-in-URLs) + CLAUDE.md updated for Laravel 13, clusev/ root, port 80, vite-in-app, env-driven config. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-12 00:31:50 +02:00

Author

SHA1

Message

Date

boban

16655eb537

feat(deploy): install.sh + Caddy auto-TLS + prod hardening

One-command, idempotent production install per docs/install-update-design.md
(the "JETZT" phase). Onboarding (forced password change + 2FA) already ships
via EnsureSecurityOnboarded; the in-dashboard self-updater stays deferred to v1.x.

- install.sh: preflight -> idempotent secrets (set_kv never regenerates) ->
  derive SITE_ADDRESS/APP_URL/REVERB_* from the single APP_DOMAIN knob -> build ->
  up -> wait DB -> migrate + cache -> clusev:install. One-time admin password is
  printed only on the terminal, never stored. Bare-IP and private-IP warnings.
- app/Console/Commands/Install.php: idempotent first admin (Str::password(20),
  must_change_password); hard no-op once a user exists (INSTALL_LOCK idiom).
- docker/caddy/Caddyfile: one template, both modes; Reverb wss over /app/* and
  /apps/* on the same address; admin-API-free, security headers. Validated for
  bare-IP (:80) and domain (https) modes.
- docker-compose.prod.yml: Caddy is the only host-published service (80/443 +
  HTTP/3); app/reverb/queue/mariadb lose host ports (internal net only);
  CLUSEV_IMAGE indirection (locally-built tag, GHCR digest later); Redis requires
  a password; caddy-data/caddy-config volumes persist ACME certs.
- .env.example: APP_DOMAIN/APP_SCHEME/ACME_EMAIL/SITE_ADDRESS/CLUSEV_IMAGE/
  UPDATE_HMAC_KEY documented.
- README: real Clusev install/deploy guide (replaces Laravel boilerplate).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-12 15:17:32 +02:00

boban

53f7309c0b

feat: scaffold — Dockerized Laravel 13 + Livewire 3 + Tailwind 4 + Reverb

Working dev stack on :80 (Freigabe step 5: app boots, page renders, Vite HMR runs):
- Multi-stage Dockerfile (php8.3-fpm + nginx + supervisor + node). Dev runs
  php-fpm + nginx + vite in ONE app container; prod target bakes vendor + assets.
- docker-compose.yml (dev, bind-mount) + docker-compose.prod.yml (GHCR image).
  Env-driven ports/UID (APP_PORT, VITE_PORT, REVERB_HOST_PORT, DB_PORT,
  HOST_UID/HOST_GID) — nothing hardcoded. MariaDB only on 127.0.0.1:3306.
- Laravel 13, Livewire 3.8 (class-based, no Volt), wire-elements/modal 2,
  phpseclib 3, laravel/reverb 1. composer platform pinned to php 8.3.
- Tailwind v4 @theme tokens ("Tactical Terminal") in app.css; Vite remote HMR
  (host 0.0.0.0, hmr.host 10.10.90.136).
- Dashboard as a full-page Livewire route (/) in layouts/app; §5 folder skeleton.
- Docs: rules.md R1-R11 (incl. R11 UUID-in-URLs) + CLAUDE.md updated for
  Laravel 13, clusev/ root, port 80, vite-in-app, env-driven config.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-12 00:31:50 +02:00

2 Commits (v0.2.0)