Claude Opus 5
b96997501a
All checks were successful
CI / Build container images (pull_request) Successful in 3m53s
CI / Auth e2e pack (pull_request) Successful in 8m42s
CI / Auth e2e pack (push) Successful in 8m41s
CI / Lint, typecheck, test (pull_request) Successful in 6m30s
CI / Import/export fidelity gate (pull_request) Successful in 58s
CD / Build and push images (push) Successful in 18s
CD / Smoke tests against Test (push) Successful in 1m19s
CD / Deploy to Test (push) Successful in 16s
CD / Promote to Int (push) Successful in 12s
CI / Lint, typecheck, test (push) Successful in 6m41s
CI / Build container images (push) Has been skipped
CI / Import/export fidelity gate (push) Successful in 52s
An operator holding a font licence could only use it by baking the file into a custom image, which tied every change to a rebuild and left the file out of the backup. ADR 0016 said there is no runtime font management. It also listed this exact case under "Alternatives considered" — *may become a Site-Admin- level feature later*. The amendment takes that option and answers the two objections it raised: licensing risk (Site Admins only, licence recorded with the family) and file-format attack surface (magic-byte check and a size cap, never a parse). - `CUSTOM_FONTS_DIR` (default `./data/fonts`) — a sibling of uploads and plugins, NOT inside the image-baked `FONTS_DIR`, where a deploy would overwrite it and no backup would ever see it. - One list of data directories (`apps/backup/src/data-dirs.ts`) now feeds both the nightly archive and the restore, so they cannot drift. #306 and #307 add one line each instead of a second mechanism. - Both Dockerfiles bake the path. The backup image sets its volume paths itself ("self-sufficient without compose env" — #71's lesson) and reads no *_DIR from compose; without the ENV entry the archive would have skipped the directory silently. - The PDF path already read WOFF2 from disk at request time, so it only had to pick the other base directory for a custom family. - `fontStack`/`fontEntry` take the instance's uploaded families as an argument — they are runtime data. The catalog is searched first, and a colliding family name is rejected at upload, so a custom font can never shadow a catalog one. - Deletion is never blocked by usage: an unknown family already falls back to the system stack, so affected ponds degrade instead of breaking. The count of affected ponds travels into the audit entry. - Audit catalogue v1.6 (`font.uploaded`, `font.deleted`). Verified: api full suite against a fresh database, 102 files / 571 tests. The upload suite writes into a real temp directory and reads the bytes back off disk, so the storage layer is exercised rather than mocked.
34 lines
1.4 KiB
Docker
34 lines
1.4 KiB
Docker
# Build context is the repository root (workspace build):
|
|
# docker build -f apps/backup/Dockerfile .
|
|
|
|
FROM node:22.15.1-alpine AS build
|
|
WORKDIR /repo
|
|
RUN npm install -g pnpm@11
|
|
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json tsconfig.base.json ./
|
|
COPY packages/shared ./packages/shared
|
|
COPY apps/backup ./apps/backup
|
|
RUN pnpm install --frozen-lockfile --filter @dorfteich/backup... \
|
|
&& pnpm --filter @dorfteich/shared build \
|
|
&& pnpm --filter @dorfteich/backup build \
|
|
# Self-contained production bundle (prod deps only) at /out.
|
|
&& pnpm --filter @dorfteich/backup deploy --prod --legacy /out \
|
|
&& cp -r apps/backup/dist /out/dist
|
|
|
|
FROM node:22.15.1-alpine
|
|
ARG APP_VERSION=0.0.0-dev
|
|
ENV NODE_ENV=production APP_VERSION=${APP_VERSION} \
|
|
# Baked-in volume paths (self-sufficient without compose env, like the
|
|
# api image's PLUGINS_DIR — issue #71's lesson).
|
|
BACKUPS_DIR=/backups UPLOADS_DIR=/data/uploads PLUGINS_DIR=/data/plugins \
|
|
CUSTOM_FONTS_DIR=/data/fonts \
|
|
SECRETS_FILE=/data/secrets/secrets.env
|
|
# pg_dump/pg_restore matching the stack's postgres:17 server, GNU tar for the
|
|
# volume archives, tzdata so BACKUP_TIME honors a configured TZ, and
|
|
# rsync + ssh for the optional off-host mirror (issue #84).
|
|
RUN apk add --no-cache postgresql17-client tar tzdata rsync openssh-client \
|
|
&& mkdir -p /backups && chown node:node /backups
|
|
WORKDIR /app
|
|
COPY --from=build --chown=node:node /out /app
|
|
USER node
|
|
CMD ["node", "dist/index.js"]
|