bot/WeatherTool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document production-assets UAT deployment

Browse Source
This commit is contained in:
b0txec
2026-08-20 22:48:22 +03:00
parent 16a8c685e7
commit 4ba5efc0aa
4 changed files with 32 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/UPDATE_ROADMAP.md
+5 -3
View File
@@ -7,7 +7,7 @@ This document tracks proposed WeatherTool improvements. Work should be delivered
- **Windows development:** source editing and Git workflow only; Docker runtime testing is performed on Rocky.
- **Rocky staging:** production-like Docker deployment at `http://192.168.1.101:9190`.
- **Git over SSH:** Windows pushes reviewed commits to a private bare repository on Rocky; the Rocky staging checkout pulls those commits and rebuilds.
- **Temporary VPS staging:** release `7dbc55b` is publicly operational behind Cloudflare strict TLS, Nginx, and Authelia with a limited 14-day synthetic dataset.
- **Temporary VPS staging:** release `16a8c68` is publicly operational behind Cloudflare strict TLS, Nginx, and Authelia with a limited 14-day synthetic dataset.
- **Workplace production:** remains separate until changes are reviewed, tested, and explicitly approved for workplace use.
Do not synchronize `.env`, database directories, generated dependencies, build output, or provider credentials between machines.
@@ -68,6 +68,7 @@ Status: pending
The first observed frontend install reported 15 vulnerabilities: 1 critical, 10 high, 3 moderate, and 1 low. Exact advisories must be reviewed before choosing upgrades.
- [ ] Capture and review the full npm audit report.
- [x] Establish that the production dependency audit is primarily blocked by `solid-js@1.9.4` resolving vulnerable `seroval@1.2.0`; confirm that the full audit also contains development-tool advisories.
- [ ] Update direct frontend dependencies in controlled groups.
- [ ] Replace or remove obsolete frontend packages where appropriate.
- [ ] Rebuild and visually compare every page after frontend upgrades.
@@ -151,13 +152,13 @@ Status: in progress
- [x] Provision a dedicated `/srv/weathertool` tree, Compose project, private network, database storage, and loopback-only application and Authelia ports.
- [x] Configure Authelia with one temporary shared account, Argon2id password storage, rate limiting, and temporary IP bans.
- [x] Add an exact-host Cloudflare origin certificate and Nginx authorization routing without disrupting the existing HOP site.
- [x] Build and verify commit-addressed image `weathertool:7dbc55b` on Rocky, then transfer and checksum-verify its image archive on the VPS.
- [x] Build and verify commit-addressed images on Rocky, transfer and checksum-verify them on the VPS, and update the application-only service to `weathertool:16a8c68` without restarting PostgreSQL or Authelia.
- [ ] Complete UAT verification: public authentication and application health pass; direct-origin blocking, logout, throttling, PNG downloads, backups, logs, and rollback remain.
- [ ] Run the month-long user test with manual releases and record feedback before any workplace-production decision.
## Known current limitations
- The new fixed production PNG bases and social metadata are implemented locally and require a Rocky build plus UAT release before newsroom validation.
- The fixed production PNG bases and browser/social metadata are deployed in UAT release `16a8c68`; newsroom workflow validation begins with the first tester handoff on 2026-08-21.
- Link-preview crawlers cannot authenticate through Authelia; the final Nginx policy must deliberately expose only the minimum preview metadata/assets if WhatsApp previews are required.
- Staging uses synthetic PostgreSQL station data.
@@ -186,3 +187,4 @@ Record completed work here by date and commit after the Git workflow is establis
| 2026-08-19 | `1868041`–`6c9290b` | Add Ūdens temperatūra, bundle and load Monda, fix overlay scaling, and center its locked nameplate | Yes |
| 2026-08-19 | `0d641bd` | Replace runtime Daira glyph rendering with normalized transparent image assets | Yes |
| 2026-08-20 | `754415a` | Match editable title/source overlays to production-safe right margins | Yes |
| 2026-08-20 | `16a8c68` | Deploy approved production map bases, normalized branding assets, favicon, Apple icon, and social metadata to public UAT | Yes — Rocky build and VPS/browser smoke checks |