From c9649c795b417489620bc7a3c2fae5e6e66f8970 Mon Sep 17 00:00:00 2001 From: Thomas Joise Date: Fri, 17 Jul 2026 22:55:30 +0530 Subject: [PATCH] chore: commit pending working-tree improvements (env doc + headless-Chromium container flags) Two small improvements that were uncommitted in the working tree: - .env.example: document HQ_OWNER_EMAIL; refresh the Postgres section (D19 delivered) - pdf.ts: launch Chromium with --no-sandbox --disable-dev-shm-usage so it runs in a container; inert on a dev machine, and we only ever render our own self-contained HTML Co-Authored-By: Claude Fable 5 --- apps/hq/.env.example | 10 ++++++++-- apps/hq/src/pdf.ts | 6 +++++- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/apps/hq/.env.example b/apps/hq/.env.example index 6636ba9..125070a 100644 --- a/apps/hq/.env.example +++ b/apps/hq/.env.example @@ -8,6 +8,10 @@ HQ_DATA_DIR=/var/lib/sims-hq/data # Port the console listens on (default 5182). HQ_PORT=5182 +# First-boot owner login (created once, on an empty DB). Set this to the REAL owner's +# email so the first employee is them; leave unset and it falls back to owner@sims.local. +# All other staff are created afterwards in the owner-only Employees page. +HQ_OWNER_EMAIL= # --- Security (set BEFORE first real login) --- # Server-held pepper mixed into every password/PIN hash. Without it, a stolen DB @@ -30,5 +34,7 @@ GOOGLE_CLIENT_SECRET= AWS_ACCESS_KEY_ID= AWS_SECRET_ACCESS_KEY= -# --- Postgres (go-live; not yet wired — see docs/DEPLOY-HQ.md) --- -# HQ_PG_URL=postgres://hq:PASSWORD@your-rds-endpoint:5432/hq +# --- Postgres (go-live; D19 delivered — see docs/DEPLOY-HQ.md §7) --- +# When set, the app runs on Postgres; unset → SQLite at HQ_DATA_DIR. Read by server.ts. +# The var name is DATABASE_URL (NOT HQ_PG_URL — the app ignores that). +# DATABASE_URL=postgres://hq:PASSWORD@your-rds-endpoint:5432/hq diff --git a/apps/hq/src/pdf.ts b/apps/hq/src/pdf.ts index 0692227..5f210a6 100644 --- a/apps/hq/src/pdf.ts +++ b/apps/hq/src/pdf.ts @@ -9,7 +9,11 @@ import puppeteer, { type Browser } from 'puppeteer' let browserPromise: Promise | null = null function getBrowser(): Promise { - browserPromise ??= puppeteer.launch() + // --no-sandbox + --disable-dev-shm-usage let Chromium launch inside a container + // (root user, small /dev/shm); both are inert on a normal dev machine. We only ever + // render our own self-contained letterhead HTML (no external fetches), so dropping + // the sandbox here is not exposing us to third-party page content. + browserPromise ??= puppeteer.launch({ args: ['--no-sandbox', '--disable-dev-shm-usage'] }) return browserPromise }