dorfteich/apps/api/src
Claude Fable 5 20677ea247
Some checks failed
CI / Lint, typecheck, test (pull_request) Successful in 7m58s
CI / Build container images (pull_request) Successful in 1m11s
CI / Auth e2e pack (pull_request) Successful in 9m12s
CI / Import/export fidelity gate (pull_request) Successful in 59s
CD / Deploy to Test (push) Blocked by required conditions
CD / Smoke tests against Test (push) Blocked by required conditions
CI / Auth e2e pack (push) Blocked by required conditions
CI / Import/export fidelity gate (push) Blocked by required conditions
CI / Build container images (push) Blocked by required conditions
CD / Build and push images (push) Has been cancelled
CI / Lint, typecheck, test (push) Has been cancelled
CD / Promote to Int (push) Blocked by required conditions
Self-hosting findings: URL-safe password advice, operator-readable pre-seed errors (#324, #325)
Two findings from Stefan's manual clean install per the guide, both
ending in an api restart loop that was hard to diagnose:

- #324: the guide recommended `openssl rand -base64 32` for
  POSTGRES_PASSWORD, but the compose interpolates the password unescaped
  into DATABASE_URL — base64's `/`, `+`, `=` break the URL. Misleadingly,
  db stays healthy (it gets the password as a plain env var) while
  api/collab/backup crash. Guide and .env.example now recommend
  `openssl rand -hex 24` for both secrets and say why; Troubleshooting
  gained the symptom line.
- #325: SETUP_ADMIN_PASSWORD's minimum (10 chars,
  packages/shared/src/auth.ts) was undocumented, and a violation crashed
  the boot with a raw ZodError naming schema fields and i18n keys.
  Failing the boot stays — deliberately, no half-seeded instance — but
  preseedFromEnv now translates validation errors into operator terms
  ("Pre-seeding failed: SETUP_ADMIN_PASSWORD must be at least 10
  characters. Fix .env and recreate the api container."). Documented in
  the guide's first-run section, .env.example, and Troubleshooting; new
  test pins the message and that nothing is half-seeded afterwards.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017aviRTgWCcAHUh1SBoxf6P
2026-08-04 12:44:16 +02:00
..
admin #306: instance branding — logo and favicon, cropped in the browser 2026-08-01 19:30:52 +02:00
audit #305: a full pond archive before deletion and before purge 2026-08-01 20:24:35 +02:00
auth #302: configurable pond start page, created with every new pond 2026-08-01 08:06:35 +02:00
backup #192: deploy-level backup target allowlist 2026-07-30 12:17:14 +02:00
branding #307: pond-level branding overrides the instance logo and favicon 2026-08-01 20:44:02 +02:00
comments Notify watchers about page changes and comments, with an in-app center (#94) 2026-07-11 23:20:25 +02:00
common #197: security response headers and an explicitly restrictive CORS policy 2026-07-30 17:13:24 +02:00
compaction Fix compaction test Bytes typing for strict typecheck (#40) 2026-07-09 08:23:55 +02:00
config Add backup sidecar: nightly dump, volume archive, prune, status, restore (#83) 2026-07-11 17:29:15 +02:00
favorites Favorites: personal page stars, golden icons, sidebar filter (#132) 2026-07-16 12:03:55 +02:00
files #302: configurable pond start page, created with every new pond 2026-08-01 08:06:35 +02:00
fonts #304: declare the font-list route's access rule explicitly 2026-08-01 18:46:47 +02:00
grants #217: map IdP groups and roles onto the permission model 2026-07-31 13:09:11 +02:00
health Nextcloud backup target: admin-configured, manual + scheduled uploads, in-app restore (#103) 2026-07-12 10:39:18 +02:00
home Editable landing page for the Site Admin 2026-07-12 23:50:16 +02:00
i18n #302: configurable pond start page, created with every new pond 2026-08-01 08:06:35 +02:00
import-export #305: a full pond archive before deletion and before purge 2026-08-01 20:24:35 +02:00
inspector Add effective-permissions inspector (#57) 2026-07-10 00:00:27 +02:00
labels Wire real permissions into collab tokens and revocation (#53) 2026-07-09 18:48:42 +02:00
legal Add instance legal pages with public rendering and footer links (#82) 2026-07-11 16:40:04 +02:00
links Fix latenten Flake in links.service.db.test (Phantom-Sortierung) 2026-07-19 06:12:55 +02:00
mail #234: retention for mail_outbox 2026-07-30 22:17:28 +02:00
mcp #222: read-access trail for classified pages 2026-07-31 12:12:55 +02:00
members #302: configurable pond start page, created with every new pond 2026-08-01 08:06:35 +02:00
notifications #296: remove the unsubscribe-token dual-verify window early 2026-07-31 23:03:03 +02:00
pages test: give the 10k-iteration sort-key property test its own timeout 2026-08-02 14:01:14 +02:00
permissions #302: configurable pond start page, created with every new pond 2026-08-01 08:06:35 +02:00
plugins #302: configurable pond start page, created with every new pond 2026-08-01 08:06:35 +02:00
ponds #302: configurable pond start page, created with every new pond 2026-08-01 08:06:35 +02:00
prisma Add Prisma with PostgreSQL, automatic migrations, and /readyz 2026-07-04 19:16:44 +02:00
public #222: read-access trail for classified pages 2026-07-31 12:12:55 +02:00
public-api #222: read-access trail for classified pages 2026-07-31 12:12:55 +02:00
quotas Quota foundation: overrides, resolution, race-safe consumption (#22) 2026-07-05 20:55:59 +02:00
rate-limit Add DB-backed rate limiting with guard and decorator 2026-07-05 00:43:54 +02:00
read-trail #215: trusted reverse-proxy header / mTLS client-certificate path 2026-07-31 12:50:09 +02:00
scheduler Nextcloud backup target: admin-configured, manual + scheduled uploads, in-app restore (#103) 2026-07-12 10:39:18 +02:00
search #211: classification through feeds, public API, search and the no-JS shell 2026-07-31 07:23:53 +02:00
settings #306: instance branding — logo and favicon, cropped in the browser 2026-08-01 19:30:52 +02:00
setup Self-hosting findings: URL-safe password advice, operator-readable pre-seed errors (#324, #325) 2026-08-04 12:44:16 +02:00
testing #302: configurable pond start page, created with every new pond 2026-08-01 08:06:35 +02:00
trash #307: pond-level branding overrides the instance logo and favicon 2026-08-01 20:44:02 +02:00
users #216: hard AUTH_LOCAL_ENABLED switch over every local credential flow 2026-07-31 12:58:07 +02:00
versions Editor shortcuts: "e" edits, the platform chord+S snapshots versions 2026-07-15 13:17:09 +02:00
watches Add watches: follow pages and ponds with auto-watch preferences (#93) 2026-07-11 22:59:11 +02:00
app.module.ts #306: instance branding — logo and favicon, cropped in the browser 2026-08-01 19:30:52 +02:00
main.ts Remove an unused eslint-disable directive in main.ts 2026-07-12 20:45:29 +02:00