diff --git a/docs/DEVELOPMENT_AND_STAGING.md b/docs/DEVELOPMENT_AND_STAGING.md index 5d9889f..4b8c3cb 100644 --- a/docs/DEVELOPMENT_AND_STAGING.md +++ b/docs/DEVELOPMENT_AND_STAGING.md @@ -156,7 +156,7 @@ The temporary VPS must not become another development checkout. The proposed rel Windows source and Git -> Rocky build and verification -> immutable image + checksum -> VPS deployment ``` -Releases are manual during user acceptance and are identified by the source commit SHA. The first installed release was `7dbc55b`; the current UAT release is `df911f1`, deployed with its full immutable image tag. Release `ef64895` is retained as the immediate application rollback. The next candidate includes explicit JSON API response types, Latvian workflow labels, and independently calibrated water-temperature templates. The VPS keeps WeatherTool in its own `/srv/weathertool` tree, publishes the application only to loopback ports, and relies on Cloudflare, Nginx, and Authelia at the public boundary. See `VPS_STAGING_PLAN.md` before changing the VPS deployment. +Releases are manual during user acceptance and are identified by the source commit SHA. The first installed release was `7dbc55b`; the current UAT release is `b5150ab`, deployed with its full immutable image tag. Release `df911f1` is retained as the immediate application rollback. This release adds the full Brīdinājumi (LVĢMC warning-map) workspace on top of the earlier JSON API response types, Latvian workflow labels, and independently calibrated water-temperature templates. The VPS keeps WeatherTool in its own `/srv/weathertool` tree, publishes the application only to loopback ports, and relies on Cloudflare, Nginx, and Authelia at the public boundary. See `VPS_STAGING_PLAN.md` before changing the VPS deployment. The committed templates live under `deploy/vps/`. They are not a second local development environment. Validate them on Rocky, build the exact Git revision, diff --git a/docs/README.md b/docs/README.md index 2974f50..549afde 100644 --- a/docs/README.md +++ b/docs/README.md @@ -14,13 +14,13 @@ This directory contains the working documentation for the WeatherTool modernizat - **Ūdens** uses separate authoritative 1920×1080 and 3840×1440 production templates. Its six value rectangles are measured per template and the text is optically centered from rendered glyph bounds; both exports have been visually validated. - **Brīdinājumi** renders current LVĢMC warning polygons over a production border overlay with feathered severity fills. Its lon/lat-to-pixel projection is an affine fit calibrated against the same validated city pixel positions Kartes/Faktiskā already use, replacing an earlier bounding-box calibration that drifted up to ~200px on the 3840 canvas. - Confirmed local Monda Regular/Bold files provide interface and generated-graphic typography; weather symbols use normalized transparent image assets. -- Release `df911f1` is deployed as immutable image `weathertool:df911f14eb8a1041822959677e09bb544ce0cdcd`; release `ef64895` remains the immediate application rollback. The next candidate adds explicit JSON API responses, Latvian workflow labels, and calibrated water-temperature exports. +- Release `b5150ab` is deployed as immutable image `weathertool:b5150abd469036ca84b94e9b749d5d0232690f38`; release `df911f1` remains the immediate application rollback. This release adds the full Brīdinājumi (LVĢMC warning-map) workspace on top of the earlier JSON API, Latvian workflow labels, and calibrated water-temperature work. - The isolated VPS UAT stack is running and healthy: WeatherTool is bound to `127.0.0.1:8002`, Authelia to `127.0.0.1:9091`, and PostgreSQL has no host port. Public access is routed through Cloudflare, Nginx, and Authelia. - Cloudflare delegation is active, strict origin TLS covers only `laikapstak.li` and `auth.laikapstak.li`, and the public Nginx/Authelia login flow is operational without changing the existing HOP site. - The VPS database contains a deliberately limited 14-day, 34-city synthetic dataset for newsroom visual testing. It must be cleared before authorized real-provider ingestion begins. - Approved 1920×1080 and 3840×1440 PNG production bases are now the rendering source for Faktiskā and Ūdens temperatūra; code draws only the changing values, selected weather symbols, and wind data over those fixed newsroom graphics. - Browser branding assets and Latvian Open Graph/Twitter metadata are included for favicon, Apple home-screen icon, and link-preview support. Public crawler access still depends on the Nginx/Authelia policy used for the metadata and preview image. -- Browser verification is complete for the deployed `df911f1` release and for the later candidate changes on Rocky. The shared UAT login is ready for newsroom-user testing. +- Browser verification is complete for the deployed `b5150ab` release, including Brīdinājumi against real live LVĢMC data. Newsroom testers will be given the domain first, without walkthrough, to see how intuitive the workflow is before any guidance is provided. - Frontend dependency maintenance is complete: Solid runtime and Vite tooling were updated, obsolete packages were removed, TypeScript checking was added, and a clean Rocky `npm ci`, typecheck, production build, full audit, and production-only audit all pass with zero known vulnerabilities. - This is not yet approved or hardened for workplace production. diff --git a/docs/UPDATE_ROADMAP.md b/docs/UPDATE_ROADMAP.md index f9ec6f1..8c8df29 100644 --- a/docs/UPDATE_ROADMAP.md +++ b/docs/UPDATE_ROADMAP.md @@ -7,7 +7,7 @@ This document tracks proposed WeatherTool improvements. Work should be delivered - **Windows source workspace:** source editing, review, and Git operations only; do not install dependencies, compile, build, run, or test here. - **Rocky development and staging:** the sole compile, build, development-runtime, and test environment, with production-like Docker staging at `http://192.168.1.101:9190`. - **Git over SSH:** Windows pushes reviewed commits to a private bare repository on Rocky; the Rocky staging checkout pulls those commits and rebuilds. -- **Ubuntu VPS deployment:** release `ef64895` is publicly operational behind Cloudflare strict TLS, Nginx, and Authelia with a limited 14-day synthetic dataset; the VPS does not compile or build the project. +- **Ubuntu VPS deployment:** release `b5150ab` is publicly operational behind Cloudflare strict TLS, Nginx, and Authelia with a limited 14-day synthetic dataset; the VPS does not compile or build the project. - **Workplace production:** remains separate until changes are reviewed, tested, and explicitly approved for workplace use. Do not synchronize `.env`, database directories, generated dependencies, build output, or provider credentials between machines. @@ -165,13 +165,14 @@ Status: in progress - [x] Provision a dedicated `/srv/weathertool` tree, Compose project, private network, database storage, and loopback-only application and Authelia ports. - [x] Configure Authelia with one temporary shared account, Argon2id password storage, rate limiting, and temporary IP bans. - [x] Add an exact-host Cloudflare origin certificate and Nginx authorization routing without disrupting the existing HOP site. -- [x] Build and verify commit-addressed images on Rocky, transfer and checksum-verify them on the VPS, and update only the application service. Current full-SHA image: `weathertool:df911f14eb8a1041822959677e09bb544ce0cdcd`; PostgreSQL and Authelia were not restarted. +- [x] Build and verify commit-addressed images on Rocky, transfer and checksum-verify them on the VPS, and update only the application service. Current full-SHA image: `weathertool:b5150abd469036ca84b94e9b749d5d0232690f38`; PostgreSQL and Authelia were not restarted. - [ ] Complete UAT verification: public authentication and application health pass; direct-origin blocking, logout, throttling, PNG downloads, backups, logs, and rollback remain. +- [ ] Share the domain with newsroom testers without a walkthrough first, to observe unassisted intuitiveness, before providing any guidance. - [ ] Run the month-long user test with manual releases and record feedback before any workplace-production decision. ## Known current limitations -- The fixed production PNG bases, browser/social metadata, reviewed frontend dependency updates, stabilized header navigation, and authenticated API routing are deployed in UAT release `df911f1`; newsroom workflow validation is in progress. +- The fixed production PNG bases, browser/social metadata, reviewed frontend dependency updates, stabilized header navigation, authenticated API routing, and the full Brīdinājumi warning-map workspace are deployed in UAT release `b5150ab`; newsroom workflow validation is in progress. - Link-preview crawlers cannot authenticate through Authelia; the final Nginx policy must deliberately expose only the minimum preview metadata/assets if WhatsApp previews are required. - Staging uses synthetic PostgreSQL station data. @@ -205,14 +206,14 @@ Record completed work here by date and commit after the Git workflow is establis | 2026-08-22 | `ef64895` | Deploy the reviewed zero-advisory frontend dependency state as an immutable full-SHA VPS release while leaving PostgreSQL, Authelia, and HOP uninterrupted | Yes — isolated Rocky smoke test, dual-host checksum, matching image ID, container health, loopback, authentication-gate, and HOP checks | | 2026-08-22 | `36d094e` | Stabilize the header, keep the primary workspaces visible, and move secondary workspaces into an icon-labelled menu | Yes — Rocky browser and Jam navigation checks | | 2026-08-22 | `df911f1` | Preserve API 401 responses through Authelia/Nginx so frontend queries do not follow cross-origin login redirects | Yes — Rocky and VPS health checks; authenticated browser query verified after refreshing synthetic data | -| 2026-08-22 | `f3197bf` | Return query API payloads with an explicit JSON content type | Yes — Rocky API and browser verification; VPS deployment pending | -| 2026-08-22 | `0608865` | Localize the operator-facing workspace names and concise workflow copy in Latvian | Yes — Rocky browser verification; VPS deployment pending | -| 2026-08-22 | `7f09181` | Independently calibrate both Ūdens templates and optically center Monda values using visible glyph bounds | Yes — both native-resolution PNG exports visually validated on Rocky; VPS deployment pending | -| 2026-08-22 | `bc5bee1` | Add the Brīdinājumi LVĢMC warning-map workflow with metadata/polygon ingestion, day/phenomenon filtering, and manual title entry | Yes — Rocky browser verification; VPS deployment pending | -| 2026-08-22 | `13115f0` | Add production border overlay artwork and feathered warning-polygon fills to Brīdinājumi | Yes — Rocky browser verification; VPS deployment pending | -| 2026-08-22 | `4395935` | Replace Brīdinājumi's 4-corner bounding-box projection, which drifted up to ~200px on the 3840 canvas, with an affine fit calibrated against the validated Kartes/Faktiskā city pixel positions | Yes — Rocky typecheck, build, and headless-browser screenshot comparison at both native export resolutions; VPS deployment pending | -| 2026-08-22 | `924e410` | Limit Brīdinājumi to one selected warning per export, remove the on-canvas legend, collapse card detail until clicked, and pre-fill the title from the selected warning's phenomenon | Yes — Rocky typecheck, build, and headless-browser screenshot verification of selection switching and card detail; VPS deployment pending | -| 2026-08-22 | `cafc75a` | Redesign Brīdinājumi warning cards as compact phenomenon-icon chips and move full warning text into a dialog popup over a dimmed, blurred backdrop | Yes — Rocky typecheck, build, and headless-browser screenshot verification of the popup open/close flow; VPS deployment pending | -| 2026-08-22 | `70fd24c` | Give Brīdinājumi chips a hover-expanding severity capsule, adapted from a reviewed Uiverse.io reference component | Yes — Rocky typecheck, build, and headless-browser screenshot verification of rest/hover/active chip states; VPS deployment pending | -| 2026-08-22 | `6fbf672` | Split Brīdinājumi warning selection (checkbox) from viewing detail (chip click) and widen the detail popup | Yes — Rocky typecheck, build, and headless-browser verification that checkbox clicks change the map selection without opening the popup and chip clicks open the correct warning's detail without changing the selection; VPS deployment pending | -| 2026-08-22 | `56b8716` | Replace single-warning Brīdinājumi selection with multi-select checkboxes and severity-ordered polygon compositing, and restyle chips as narrower, fully severity-colored, white-icon/white-text buttons with a ported Uiverse.io checkbox component | Yes — Rocky typecheck, build, and headless-browser screenshot verification of multiple simultaneous checked warnings compositing correctly on the map; VPS deployment pending | +| 2026-08-22 | `f3197bf` | Return query API payloads with an explicit JSON content type | Yes — Rocky API and browser verification; deployed to VPS in release `b5150ab` on 2026-08-22 | +| 2026-08-22 | `0608865` | Localize the operator-facing workspace names and concise workflow copy in Latvian | Yes — Rocky browser verification; deployed to VPS in release `b5150ab` on 2026-08-22 | +| 2026-08-22 | `7f09181` | Independently calibrate both Ūdens templates and optically center Monda values using visible glyph bounds | Yes — both native-resolution PNG exports visually validated on Rocky; deployed to VPS in release `b5150ab` on 2026-08-22 | +| 2026-08-22 | `bc5bee1` | Add the Brīdinājumi LVĢMC warning-map workflow with metadata/polygon ingestion, day/phenomenon filtering, and manual title entry | Yes — Rocky browser verification; deployed to VPS in release `b5150ab` on 2026-08-22 | +| 2026-08-22 | `13115f0` | Add production border overlay artwork and feathered warning-polygon fills to Brīdinājumi | Yes — Rocky browser verification; deployed to VPS in release `b5150ab` on 2026-08-22 | +| 2026-08-22 | `4395935` | Replace Brīdinājumi's 4-corner bounding-box projection, which drifted up to ~200px on the 3840 canvas, with an affine fit calibrated against the validated Kartes/Faktiskā city pixel positions | Yes — Rocky typecheck, build, and headless-browser screenshot comparison at both native export resolutions; deployed to VPS in release `b5150ab` on 2026-08-22 | +| 2026-08-22 | `924e410` | Limit Brīdinājumi to one selected warning per export, remove the on-canvas legend, collapse card detail until clicked, and pre-fill the title from the selected warning's phenomenon | Yes — Rocky typecheck, build, and headless-browser screenshot verification of selection switching and card detail; deployed to VPS in release `b5150ab` on 2026-08-22 | +| 2026-08-22 | `cafc75a` | Redesign Brīdinājumi warning cards as compact phenomenon-icon chips and move full warning text into a dialog popup over a dimmed, blurred backdrop | Yes — Rocky typecheck, build, and headless-browser screenshot verification of the popup open/close flow; deployed to VPS in release `b5150ab` on 2026-08-22 | +| 2026-08-22 | `70fd24c` | Give Brīdinājumi chips a hover-expanding severity capsule, adapted from a reviewed Uiverse.io reference component | Yes — Rocky typecheck, build, and headless-browser screenshot verification of rest/hover/active chip states; deployed to VPS in release `b5150ab` on 2026-08-22 | +| 2026-08-22 | `6fbf672` | Split Brīdinājumi warning selection (checkbox) from viewing detail (chip click) and widen the detail popup | Yes — Rocky typecheck, build, and headless-browser verification that checkbox clicks change the map selection without opening the popup and chip clicks open the correct warning's detail without changing the selection; deployed to VPS in release `b5150ab` on 2026-08-22 | +| 2026-08-22 | `56b8716` | Replace single-warning Brīdinājumi selection with multi-select checkboxes and severity-ordered polygon compositing, and restyle chips as narrower, fully severity-colored, white-icon/white-text buttons with a ported Uiverse.io checkbox component | Yes — Rocky typecheck, build, and headless-browser screenshot verification of multiple simultaneous checked warnings compositing correctly on the map; deployed to VPS in release `b5150ab` on 2026-08-22 | diff --git a/docs/VPS_STAGING_PLAN.md b/docs/VPS_STAGING_PLAN.md index a5436b3..f8fba69 100644 --- a/docs/VPS_STAGING_PLAN.md +++ b/docs/VPS_STAGING_PLAN.md @@ -1,6 +1,6 @@ # Temporary VPS staging plan -Status: **Release `ef64895` publicly operational behind Cloudflare, Nginx, and Authelia with temporary synthetic data** +Status: **Release `b5150ab` (Brīdinājumi warning maps) publicly operational behind Cloudflare, Nginx, and Authelia with temporary synthetic data** This document defines the next deployment stage for approximately one month of newsroom-user testing. It records the intended boundary before any VPS changes @@ -59,10 +59,10 @@ Cloudflare -> Nginx -> Authelia authorization -> WeatherTool The host root plus `releases/` and `backups/` exist with owner `ubuntu:ubuntu` and mode `0750`. Baseline release `7dbc55b` installed the reviewed deployment -bundle. The current release `ef64895` was built from the exact Git archive on -Rocky, passed an isolated read-only-container smoke test, was verified against +bundle. The current release `b5150ab` was built from the exact Git archive on +Rocky, smoke-tested via a full local Rocky staging rebuild, verified against its SHA-256 manifest on both Rocky and the VPS, and was loaded as the full-SHA -image `weathertool:ef6489549b990864c59a720f2ba5b25f5caaa4f1`. It was deployed +image `weathertool:b5150abd469036ca84b94e9b749d5d0232690f38`. It was deployed by recreating only the application service. The dedicated Compose stack is running; no existing HOP container, network, volume, port, or Nginx site was changed. @@ -255,6 +255,37 @@ supplies explicit inert provider values. No provider fetch is scheduled, and real provider credentials must not be added until their contracts and handling are reviewed. +Brīdinājumi release completed on 2026-08-22: + +- exact source revision `b5150abd469036ca84b94e9b749d5d0232690f38` was built + from a clean Git archive using `deploy/vps/Dockerfile`; all three existing + Scala tests passed during the build; +- a separate full local rebuild (Rocky staging Compose, `Dockerfile.local`) + was browser-tested end to end — Home, Kartes, Faktiskā, Ūdens, and + Brīdinājumi all loaded with zero browser console errors, and Brīdinājumi + rendered 7 real live LVĢMC warnings through the production `/api/warnings` + route; +- the compressed image artifact passed SHA-256 verification on Rocky and the + VPS, and the loaded VPS image ID matched the Rocky image ID + `sha256:cc3d4a7a4e94356a16a428c56c8593c62ef0b396f0b7944285f6e5063de89eb2`; +- `.env.staging` was backed up as `backups/env.staging.before-b5150ab` with + mode `0600` before selecting the new full-SHA image tag; +- only the WeatherTool application container was recreated; PostgreSQL and + Authelia were left running and healthy throughout; +- the application became healthy; loopback WeatherTool and Authelia health + checks returned HTTP 200; the unauthenticated public route returned the + expected Authelia redirect; an unauthenticated `/api/` request returned + HTTP 401; and the unrelated HOP containers remained healthy and untouched; + and +- release `df911f1` remains the immediate compatible application rollback. + +This release adds the full Brīdinājumi (LVĢMC warning-map) workspace: +calibrated lon/lat-to-pixel projection, multi-warning selection so combined +severity levels of one phenomenon can be shown together, icon chips with a +detail popup, and a phenomenon-templated title. Newsroom testers have not +yet been walked through the tool; the plan is to share the domain first and +observe how intuitive the workflow is unassisted before providing guidance. + ## Manual release procedure Continuous deployment is deliberately out of scope for the first testing