Team decision: production DB connection and first-boot owner email are hardcoded in the app instead of a .env file, matching the box's other apps. Gated to NODE_ENV=production so dev/tests keep using SQLite (389 tests green). Committed value is the CHANGE_ME_PASSWORD placeholder; the real password is set only on the box, never pushed. server.ts: HARDCODED_DATABASE_URL. seed.ts: OWNER_EMAIL default. docker-compose.yml: drop env_file. docs: PATHS-AND-NAMES.md + .env.example updated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
With the app's trust-proxy=1, an appended client-supplied XFF header would let a
caller spoof req.ip and bypass the per-IP login/reveal rate limiters. Replacing
with $remote_addr (the unforgeable socket peer) keys the limiters on the true
client.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
One name end to end: deploy/nginx-hq.conf -> deploy/sims.hq.conf matching /etc/nginx/conf.d/sims.hq.conf. Add deploy/PATHS-AND-NAMES.md as the single production reference (paths, names, ports, everyday commands).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Production hosting artifacts (D20 hosting slice), previously untracked:
- Dockerfile: node:20-bookworm image, Chromium libs for puppeteer, builds
web + server, runs server.cjs on 5182
- docker-compose.yml: single hq service, external accurate-postgres via
host.docker.internal, localhost-bound (host nginx terminates TLS), env_file
- deploy/nginx-hq.conf: the reverse-proxy config
No secrets — .env and data stay gitignored and out of the image (.dockerignore).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Thomas Joise