ginnoir
6a1ec8bb7b
Replaces the 8-line placeholder with a complete README covering all four modules, platform capabilities, quick start, dev setup, configuration reference, and deployment links. Badges use dynamic shields.io URLs so version/CI status update automatically on each release. Wires README review into the release pipeline via a release-it before:git:release hook and a new item in the pre-deploy checklist.
41 lines
1.9 KiB
Markdown
41 lines
1.9 KiB
Markdown
# 09 — Pre-deploy checklist (recurring)
|
|
|
|
Run this before every production deploy (first deploy and each tagged release). Dev-login is intentionally retained behind a double gate; this checklist is what keeps that gate honest.
|
|
|
|
## README
|
|
|
|
- [ ] `README.md` reflects the current module list and any env vars added since the last release.
|
|
|
|
## Env hygiene
|
|
|
|
- [ ] Server `.env` (next to `deploy/compose.yaml`) does **not** set:
|
|
- `ENABLE_DEV_LOGIN`
|
|
- `DEV_LOGIN_EMAIL`, `DEV_LOGIN_NAME`, `DEV_HOUSEHOLD_NAME`
|
|
- [ ] Server `.env` sets real values for:
|
|
- `NEXT_PUBLIC_APP_URL` (https)
|
|
- `AUTH_SECRET` (`openssl rand -base64 32`)
|
|
- `AUTH_OIDC_ISSUER`, `AUTH_OIDC_CLIENT_ID`, `AUTH_OIDC_CLIENT_SECRET`
|
|
- `VAPID_PUBLIC_KEY`, `VAPID_PRIVATE_KEY`, `VAPID_SUBJECT`
|
|
- `FAMAPP_DB_*`, `AUTHENTIK_DB_*`, `AUTHENTIK_SECRET_KEY`
|
|
- [ ] `FAMAPP_IMAGE` pins a specific version tag (`ghcr.io/ginnoir/famapp:vX.Y.Z`), not `latest`, after first deploy.
|
|
|
|
## Code-side guard
|
|
|
|
`src/lib/dev-login-config.ts` throws on import if `NODE_ENV=production` and `ENABLE_DEV_LOGIN=true`. Container will refuse to start.
|
|
|
|
- [ ] Confirm guard is still present (do not remove without updating this checklist).
|
|
|
|
## Smoke after deploy
|
|
|
|
- [ ] `https://fam.ginnoir.com/login` shows only **Sign in with SSO** (no Dev login button).
|
|
- [ ] Real Authentik sign-in succeeds, lands on dashboard.
|
|
- [ ] First user appears in DB with household membership, default calendars, default lists.
|
|
- [ ] No `dev@famapp.local` row in production `users` table.
|
|
- [ ] Push opt-in works (settings → enable → test notification arrives).
|
|
- [ ] A share link created from `/settings` resolves at `/s/<token>` while signed out.
|
|
|
|
## Backup / rollback
|
|
|
|
- [ ] Last `famapp-backup` cron run succeeded (check container logs).
|
|
- [ ] Previous image tag is known and recorded in `CHANGELOG.md`, so rollback = bump `FAMAPP_IMAGE` and `docker compose up -d famapp`.
|