deploy/PATHS-AND-NAMES.md now reflects reality: Docker Compose V2 isn't
installed on the box (raw docker build/run instead), DB connection lives in
db-pg.ts not server.ts, real password is committed (accepted, not a
CHANGE_ME_PASSWORD placeholder). docs/DEPLOY-HQ.md marked superseded — it
described an RDS/GoDaddy/.com plan that isn't what shipped. STATUS.md and
06-DECISIONS.md (D39) record the actual go-live: real data carried over from
local Postgres (not "born empty + APEX import"), and the npm/cli#4828
Dockerfile fix.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Team decision: production DB connection and first-boot owner email are hardcoded in the app instead of a .env file, matching the box's other apps. Gated to NODE_ENV=production so dev/tests keep using SQLite (389 tests green). Committed value is the CHANGE_ME_PASSWORD placeholder; the real password is set only on the box, never pushed. server.ts: HARDCODED_DATABASE_URL. seed.ts: OWNER_EMAIL default. docker-compose.yml: drop env_file. docs: PATHS-AND-NAMES.md + .env.example updated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
With the app's trust-proxy=1, an appended client-supplied XFF header would let a
caller spoof req.ip and bypass the per-IP login/reveal rate limiters. Replacing
with $remote_addr (the unforgeable socket peer) keys the limiters on the true
client.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
One name end to end: deploy/nginx-hq.conf -> deploy/sims.hq.conf matching /etc/nginx/conf.d/sims.hq.conf. Add deploy/PATHS-AND-NAMES.md as the single production reference (paths, names, ports, everyday commands).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Production hosting artifacts (D20 hosting slice), previously untracked:
- Dockerfile: node:20-bookworm image, Chromium libs for puppeteer, builds
web + server, runs server.cjs on 5182
- docker-compose.yml: single hq service, external accurate-postgres via
host.docker.internal, localhost-bound (host nginx terminates TLS), env_file
- deploy/nginx-hq.conf: the reverse-proxy config
No secrets — .env and data stay gitignored and out of the image (.dockerignore).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Thomas Joise
Thomas Joise