From d7a7db0710cd2930eaff5da6282d8a4ffe173ce3 Mon Sep 17 00:00:00 2001 From: b0txec Date: Sat, 22 Aug 2026 10:41:17 +0300 Subject: [PATCH] Document frontend maintenance release --- docs/DEVELOPMENT_AND_STAGING.md | 2 +- docs/README.md | 6 +++--- docs/UPDATE_ROADMAP.md | 10 ++++++---- docs/VPS_STAGING_PLAN.md | 25 ++++++++++++++++++++++--- 4 files changed, 32 insertions(+), 11 deletions(-) diff --git a/docs/DEVELOPMENT_AND_STAGING.md b/docs/DEVELOPMENT_AND_STAGING.md index 37414de..cf653e8 100644 --- a/docs/DEVELOPMENT_AND_STAGING.md +++ b/docs/DEVELOPMENT_AND_STAGING.md @@ -135,7 +135,7 @@ The temporary VPS must not become another development checkout. The proposed rel Windows source and Git -> Rocky build and verification -> immutable image + checksum -> VPS deployment ``` -Releases are manual during user acceptance and are identified by the source commit SHA. The first installed release was `7dbc55b`; the current UAT release is `16a8c68`. The VPS keeps WeatherTool in its own `/srv/weathertool` tree, publishes the application only to loopback ports, and relies on Cloudflare, Nginx, and Authelia at the public boundary. See `VPS_STAGING_PLAN.md` before changing the VPS deployment. +Releases are manual during user acceptance and are identified by the source commit SHA. The first installed release was `7dbc55b`; the current UAT release is `ef64895`, deployed with its full immutable image tag. Release `16a8c68` is retained as the immediate application rollback. The VPS keeps WeatherTool in its own `/srv/weathertool` tree, publishes the application only to loopback ports, and relies on Cloudflare, Nginx, and Authelia at the public boundary. See `VPS_STAGING_PLAN.md` before changing the VPS deployment. The committed templates live under `deploy/vps/`. They are not a second local development environment. Validate them on Rocky, build the exact Git revision, diff --git a/docs/README.md b/docs/README.md index 88660c8..31f7b83 100644 --- a/docs/README.md +++ b/docs/README.md @@ -13,14 +13,14 @@ This directory contains the working documentation for the WeatherTool modernizat - Faktiskā symbol placement is automatic after manual image selection and is anchored to each rendered temperature badge. - The first **Ūdens temperatūra** workspace is implemented with manual Latvian-named fields and required 1920×1080 and 3840×1440 exports; visual calibration remains in progress. - Confirmed local Monda Regular/Bold files provide interface and generated-graphic typography; weather symbols use normalized transparent image assets. -- Release `16a8c68` was built and checksummed on Rocky, transferred to the VPS, verified, and deployed as the immutable `weathertool:16a8c68` image. Release `7dbc55b` remains available for rollback. +- Release `ef64895` was built from the exact committed Git tree, smoke-tested on Rocky, checksummed on both hosts, and deployed as the immutable full-SHA image `weathertool:ef6489549b990864c59a720f2ba5b25f5caaa4f1`. Release `16a8c68` remains the immediate application rollback image. - The isolated VPS UAT stack is running and healthy: WeatherTool is bound to `127.0.0.1:8002`, Authelia to `127.0.0.1:9091`, and PostgreSQL has no host port. Public access is routed through Cloudflare, Nginx, and Authelia. - Cloudflare delegation is active, strict origin TLS covers only `laikapstak.li` and `auth.laikapstak.li`, and the public Nginx/Authelia login flow is operational without changing the existing HOP site. - The VPS database contains a deliberately limited 14-day, 34-city synthetic dataset for newsroom visual testing. It must be cleared before authorized real-provider ingestion begins. - Approved 1920×1080 and 3840×1440 PNG production bases are now the rendering source for Faktiskā and Ūdens temperatūra; code draws only the changing values, selected weather symbols, and wind data over those fixed newsroom graphics. - Browser branding assets and Latvian Open Graph/Twitter metadata are included for favicon, Apple home-screen icon, and link-preview support. Public crawler access still depends on the Nginx/Authelia policy used for the metadata and preview image. -- Browser verification of release `16a8c68` confirmed both fixed-map workspaces and the favicon. The shared UAT login is ready for the first newsroom-user handoff on 2026-08-21. -- Frontend dependency maintenance is complete through commit `de6f279`: Solid runtime and Vite tooling were updated, obsolete packages were removed, TypeScript checking was added, and a clean Rocky `npm ci`, typecheck, production build, full audit, and production-only audit all pass with zero known vulnerabilities. These commits are newer than the currently deployed VPS release `16a8c68`. +- Browser verification of release `16a8c68` confirmed both fixed-map workspaces and the favicon. The shared UAT login is ready for newsroom-user testing; equivalent visual verification of the dependency-maintenance release remains a UAT checkpoint. +- Frontend dependency maintenance is complete through commit `de6f279`: Solid runtime and Vite tooling were updated, obsolete packages were removed, TypeScript checking was added, and a clean Rocky `npm ci`, typecheck, production build, full audit, and production-only audit all pass with zero known vulnerabilities. Documentation commit `ef64895` containing that reviewed dependency state is the current VPS release. - This is not yet approved or hardened for workplace production. ## Documents diff --git a/docs/UPDATE_ROADMAP.md b/docs/UPDATE_ROADMAP.md index aa83594..96acaa9 100644 --- a/docs/UPDATE_ROADMAP.md +++ b/docs/UPDATE_ROADMAP.md @@ -7,7 +7,7 @@ This document tracks proposed WeatherTool improvements. Work should be delivered - **Windows development:** source editing and Git workflow only; Docker runtime testing is performed on Rocky. - **Rocky staging:** production-like Docker deployment at `http://192.168.1.101:9190`. - **Git over SSH:** Windows pushes reviewed commits to a private bare repository on Rocky; the Rocky staging checkout pulls those commits and rebuilds. -- **Temporary VPS staging:** release `16a8c68` is publicly operational behind Cloudflare strict TLS, Nginx, and Authelia with a limited 14-day synthetic dataset. +- **Temporary VPS staging:** release `ef64895` is publicly operational behind Cloudflare strict TLS, Nginx, and Authelia with a limited 14-day synthetic dataset. - **Workplace production:** remains separate until changes are reviewed, tested, and explicitly approved for workplace use. Do not synchronize `.env`, database directories, generated dependencies, build output, or provider credentials between machines. @@ -73,7 +73,8 @@ The first observed frontend install reported 15 vulnerabilities: 1 critical, 10 - [x] Replace or remove obsolete frontend packages where appropriate. - [x] Add a committed TypeScript typecheck command and validate the updated frontend with a clean `npm ci`, typecheck, and production build. - [x] Resolve the remaining transitive build-tool advisories after reviewing the proposed `npm audit fix` changes; verify full and production-only audits at zero. -- [ ] Rebuild, deploy, and visually compare every page in a commit-addressed VPS release containing `de6f279` or later. (Rocky clean-install build verification is complete.) +- [x] Build, smoke-test, checksum, transfer, and deploy a commit-addressed VPS release containing `de6f279` or later without restarting PostgreSQL or Authelia. (`ef64895` deployed 2026-08-22.) +- [ ] Visually compare every page and representative exported PNG in the deployed dependency-maintenance release. - [ ] Update Scala within the supported 2.13 line before considering larger migration. - [ ] Update http4s, Doobie, Circe, Cats Effect, Logback, and test libraries in compatible groups. - [ ] Replace release-candidate dependencies with stable releases where possible. @@ -154,13 +155,13 @@ Status: in progress - [x] Provision a dedicated `/srv/weathertool` tree, Compose project, private network, database storage, and loopback-only application and Authelia ports. - [x] Configure Authelia with one temporary shared account, Argon2id password storage, rate limiting, and temporary IP bans. - [x] Add an exact-host Cloudflare origin certificate and Nginx authorization routing without disrupting the existing HOP site. -- [x] Build and verify commit-addressed images on Rocky, transfer and checksum-verify them on the VPS, and update the application-only service to `weathertool:16a8c68` without restarting PostgreSQL or Authelia. +- [x] Build and verify commit-addressed images on Rocky, transfer and checksum-verify them on the VPS, and update only the application service. Current full-SHA image: `weathertool:ef6489549b990864c59a720f2ba5b25f5caaa4f1`; PostgreSQL and Authelia were not restarted. - [ ] Complete UAT verification: public authentication and application health pass; direct-origin blocking, logout, throttling, PNG downloads, backups, logs, and rollback remain. - [ ] Run the month-long user test with manual releases and record feedback before any workplace-production decision. ## Known current limitations -- The fixed production PNG bases and browser/social metadata are deployed in UAT release `16a8c68`; newsroom workflow validation begins with the first tester handoff on 2026-08-21. +- The fixed production PNG bases, browser/social metadata, and reviewed frontend dependency updates are deployed in UAT release `ef64895`; newsroom workflow validation is in progress. - Link-preview crawlers cannot authenticate through Authelia; the final Nginx policy must deliberately expose only the minimum preview metadata/assets if WhatsApp previews are required. - Staging uses synthetic PostgreSQL station data. @@ -191,3 +192,4 @@ Record completed work here by date and commit after the Git workflow is establis | 2026-08-20 | `754415a` | Match editable title/source overlays to production-safe right margins | Yes | | 2026-08-20 | `16a8c68` | Deploy approved production map bases, normalized branding assets, favicon, Apple icon, and social metadata to public UAT | Yes — Rocky build and VPS/browser smoke checks | | 2026-08-21 | `5007517`–`de6f279` | Update Solid runtime and frontend build tooling, add type checking, remove obsolete packages, prune the lockfile, and resolve all npm advisories | Yes — clean `npm ci`, typecheck, production build, full audit, and production-only audit | +| 2026-08-22 | `ef64895` | Deploy the reviewed zero-advisory frontend dependency state as an immutable full-SHA VPS release while leaving PostgreSQL, Authelia, and HOP uninterrupted | Yes — isolated Rocky smoke test, dual-host checksum, matching image ID, container health, loopback, authentication-gate, and HOP checks | diff --git a/docs/VPS_STAGING_PLAN.md b/docs/VPS_STAGING_PLAN.md index 1e7fd06..88f727c 100644 --- a/docs/VPS_STAGING_PLAN.md +++ b/docs/VPS_STAGING_PLAN.md @@ -1,6 +1,6 @@ # Temporary VPS staging plan -Status: **Release `16a8c68` publicly operational behind Cloudflare, Nginx, and Authelia with temporary synthetic data** +Status: **Release `ef64895` publicly operational behind Cloudflare, Nginx, and Authelia with temporary synthetic data** This document defines the next deployment stage for approximately one month of newsroom-user testing. It records the intended boundary before any VPS changes @@ -59,8 +59,10 @@ Cloudflare -> Nginx -> Authelia authorization -> WeatherTool The host root plus `releases/` and `backups/` exist with owner `ubuntu:ubuntu` and mode `0750`. Baseline release `7dbc55b` installed the reviewed deployment -bundle. Release `16a8c68` was then built on Rocky, verified against its SHA-256 -manifest on both Rocky and the VPS, loaded as `weathertool:16a8c68`, and deployed +bundle. The current release `ef64895` was built from the exact Git archive on +Rocky, passed an isolated read-only-container smoke test, was verified against +its SHA-256 manifest on both Rocky and the VPS, and was loaded as the full-SHA +image `weathertool:ef6489549b990864c59a720f2ba5b25f5caaa4f1`. It was deployed by recreating only the application service. The dedicated Compose stack is running; no existing HOP container, network, volume, port, or Nginx site was changed. @@ -223,6 +225,23 @@ UAT application update completed on 2026-08-20: - `weathertool:7dbc55b` plus the protected pre-update environment copy remain available as the immediate application rollback path. +Frontend-maintenance release completed on 2026-08-22: + +- exact source revision `ef6489549b990864c59a720f2ba5b25f5caaa4f1` was built + from a clean Git archive and passed a Rocky smoke test using a read-only root + filesystem and explicitly owned temporary application storage; +- the compressed image artifact passed SHA-256 verification on Rocky and the + VPS, and the loaded VPS image ID matched the Rocky image ID + `sha256:cb0f579f0e3342923c70b5e7a7978d3a1b7ca04d7704e6be4149fd6457447ef5`; +- `.env.staging` was backed up as `backups/env.staging.before-ef64895` with mode + `0600` before selecting the new full-SHA image tag; +- only the WeatherTool application container was recreated; the 38-hour + PostgreSQL and Authelia containers remained running and healthy; +- the application became healthy, loopback WeatherTool and Authelia health + checks returned HTTP 200, the unauthenticated WeatherTool route returned the + expected Authelia 302, and the existing HOP route retained HTTP 302; and +- release `16a8c68` remains the immediate compatible application rollback. + The shortened seed exists only to support visual user testing. Before real API credentials or scheduled ingestion are enabled, clear the synthetic `weather` table in a controlled maintenance step while scheduled jobs remain disabled.