ekklesiaandClaude Opus 5.5
167b4c4f14
CI / verify (pull_request) Successful in 54s
CI / infrastructure-smoke (pull_request) Successful in 21s
CI / migration-smoke (pull_request) Successful in 1m48s
CI / image-build (pull_request) Successful in 27s
CI / deploy-smoke (pull_request) Successful in 42s
Implement ADR 0044's reference deployment as a base Compose file plus overlays, so an installation that already runs a proxy can use the base alone. - compose.yaml: api, postgres, object-storage, and the operator-only migrate (profile ops, plan by default). No published port. api and migrate run init, read-only, tmpfs /tmp, cap_drop ALL, no-new-privileges. postgres is only on the internal data network. - TLS everywhere from one installation-private CA: PostgreSQL TLS 1.3 only, with pg_hba rejecting every non-TLS connection, and the API on verify-full via EKKLESIA_DATABASE_CA (PEM text). SeaweedFS serves S3 over HTTPS (ADR 0030 requires https in production), trusted by the API through NODE_EXTRA_CA_CERTS. No Core change. - compose.proxy.yaml + Caddyfile.example: Caddy pinned by digest, ACME HTTP-01 (DNS-01 documented), routes /, /api/*, /display/*, /assets/* to api and refuses everything else; the storage hostname preserves Host. The API trusts exactly the proxy's fixed /32 on an edge network whose dynamic range excludes the fixed addresses; Caddy overwrites X-Forwarded-For and strips caller-supplied forwarding headers. - compose.tunnel.yaml: cloudflared pinned by digest, token from its own env file; Caddy honors CF-Connecting-IP only from its fixed address. - Four per-service root-owned env files, examples with no values; scripts/init-tls.sh (idempotent, never overwrites a key) and scripts/gen-secrets.sh (prints only). - CI: pnpm deploy:config in ci:verify for all three combinations, and a deploy-smoke job (scripts/smoke-deploy.sh) proving readiness, the Dashboard, signed storage delivery, the client-address chain, initial owner sign-in/out, verify-full database TLS, and Doctor through the proxy, against disposable services. tests/deploy.test.ts pins the structural guarantees. - ADR 0044 (still Proposed) amended to match: API-to-storage HTTPS, DNS-01 needs a custom Caddy build and tunnel-only needs DNS-01, the tunnel's origin TLS settings live in the Cloudflare dashboard, port 80 serves HTTP-01, and secrets are one env file per service. Co-Authored-By: Claude Opus 5.5 <[email protected]>
55 lines
3.0 KiB
JSON
55 lines
3.0 KiB
JSON
{
|
|
"name": "ekklesia",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"description": "Open, modular church technology platform",
|
|
"engines": {
|
|
"node": ">=24.11.0 <25",
|
|
"pnpm": ">=11.12.0 <12"
|
|
},
|
|
"packageManager": "[email protected]",
|
|
"scripts": {
|
|
"api:start": "turbo run build && node --env-file-if-exists=.env apps/api/dist/server.js",
|
|
"authorization:bootstrap-owner": "turbo run build && node --env-file-if-exists=.env core/dist/cli/bootstrap-platform-owner.js",
|
|
"boundaries": "node scripts/check-boundaries.ts",
|
|
"build": "turbo run build",
|
|
"ci:verify": "pnpm verify && pnpm infrastructure:config && pnpm deploy:config",
|
|
"deploy:config": "bash scripts/check-deploy-config.sh",
|
|
"deploy:smoke": "bash scripts/smoke-deploy.sh",
|
|
"doctor": "node scripts/run-doctor.ts",
|
|
"format": "biome format --write .",
|
|
"format:check": "biome format .",
|
|
"identity:create-initial-owner": "turbo run build && node --env-file-if-exists=.env core/dist/cli/create-initial-owner.js",
|
|
"identity:schema:validate": "turbo run build && node core/dist/cli/validate-identity-schema.js",
|
|
"infrastructure:config": "docker compose --env-file .env.example -f infrastructure/compose.yaml config --quiet",
|
|
"infrastructure:down": "docker compose --env-file .env -f infrastructure/compose.yaml down",
|
|
"infrastructure:logs": "docker compose --env-file .env -f infrastructure/compose.yaml logs --follow",
|
|
"infrastructure:smoke": "bash scripts/smoke-infrastructure.sh",
|
|
"infrastructure:up": "docker compose --env-file .env -f infrastructure/compose.yaml up --detach --wait",
|
|
"lint": "turbo run lint lint:root",
|
|
"lint:root": "biome lint .",
|
|
"migrations:apply": "turbo run build && node --env-file-if-exists=.env core/dist/cli/apply-migrations.js",
|
|
"migrations:plan": "turbo run build && node --env-file-if-exists=.env core/dist/cli/plan-migrations.js",
|
|
"migrations:validate": "turbo run build && node core/dist/cli/validate-migrations.js",
|
|
"modules:disable": "turbo run build && node --env-file-if-exists=.env core/dist/cli/set-module-enabled.js --disable",
|
|
"modules:enable": "turbo run build && node --env-file-if-exists=.env core/dist/cli/set-module-enabled.js --enable",
|
|
"modules:validate": "turbo run build && node core/dist/cli/validate-modules.js",
|
|
"test": "turbo run test test:root",
|
|
"test:migrations:integration": "pnpm build && bash scripts/test-migrations-integration.sh",
|
|
"test:root": "vitest run --config vitest.config.ts",
|
|
"test:watch": "vitest",
|
|
"typecheck": "turbo run typecheck typecheck:root",
|
|
"typecheck:root": "tsc --noEmit --project tsconfig.json",
|
|
"verify": "pnpm format:check && pnpm lint && pnpm boundaries && pnpm typecheck && pnpm test && pnpm modules:validate && pnpm migrations:validate && pnpm identity:schema:validate && pnpm build"
|
|
},
|
|
"devDependencies": {
|
|
"@biomejs/biome": "2.5.3",
|
|
"@types/node": "24.13.3",
|
|
"turbo": "2.10.4",
|
|
"typescript": "7.0.2",
|
|
"vitest": "4.1.10",
|
|
"yaml": "2.9.0"
|
|
}
|
|
}
|