36 lines
2.5 KiB
Markdown
36 lines
2.5 KiB
Markdown
|
# devops + designer — Synology deploy script, .env, and RITM→SNOW link
|
||
|
|
|
||
|
|
**Date:** 2026-08-27
|
||
|
|
|
||
|
|
## Synology deploy (devops) — ported from the Husky template (per user request)
|
||
|
|
Two scripts, matching Husky's proven pattern (superseded my first single-script cut):
|
||
|
|
- **`scripts/push-to-nas.sh`** (local, `npm run deploy`): preflight (SSH key pinned via
|
||
|
|
`-i $NAS_KEY -o IdentitiesOnly=yes` — fixes the WebStorm multi-identity MaxAuthTries
|
||
|
|
failure) → test gate → rsync tree to NAS (openrsync→tar-over-ssh fallback for macOS)
|
||
|
|
→ run `deploy.sh` over SSH forwarding `--pull`/`--fresh`. Excludes node_modules/dist/
|
||
|
|
`.env`/`.deploy.env`/`storage-dump.json`/`.idea`/`claude_artifacts`.
|
||
|
|
- **`scripts/deploy.sh`** (on the NAS): Synology PATH hardening + `DOCKER_SUDO` autodetect
|
||
|
|
→ optional `git pull` → `compose build` → `up -d --remove-orphans` → poll app container
|
||
|
|
for Docker `healthy` (≤120s). `--fresh` = `down --remove-orphans` **never `-v`** → the
|
||
|
|
`forge-db` volume is preserved. Adapted from Husky: removed the `ai.env` check, fixed the
|
||
|
|
`.env` required-vars message, `HOST_PORT_FALLBACK=3089`, corrected all "external Postgres /
|
||
|
|
no volumes" comments (FORGE bundles the db + `forge-db` volume).
|
||
|
|
- **Config baked in** (defaults = the real NAS: `192.168.50.2` / `d.tkachenko` / `2323` /
|
||
|
|
`/volume1/docker/forge` / `~/.ssh/id_ed25519`), overridable via env or an optional
|
||
|
|
`.deploy.env` (`.deploy.env.example`, gitignored). Both scripts `bash -n` clean + executable.
|
||
|
|
- **`.env.example`** rewritten: local vs prod split; compose overrides DATABASE_URL/PORT/NODE_ENV;
|
||
|
|
prod requires `SESSION_SECRET`, `AUTH_USER`, `AUTH_PASS`, `POSTGRES_PASSWORD`. Stale `ADMIN_KEY`
|
||
|
|
removed (tokens are admin-role gated now); port note corrected to the published lane.
|
||
|
|
- **`package.json`** `deploy` script added. **`docs/SETUP.md`** §6 documents the flow.
|
||
|
|
- Secrets never leave the NAS: `.env` is created once on the NAS and is never synced.
|
||
|
|
- NOT run — deploy needs explicit sign-off + a reachable NAS; script is created only.
|
||
|
|
|
||
|
|
## RITM → SNOW link (designer)
|
||
|
|
- The ticket **number is now a link to ServiceNow** in the table Number column and on
|
||
|
|
board cards — inline external-link glyph, opens a new tab, `stopPropagation` so it
|
||
|
|
doesn't also open the detail modal. Removed the now-redundant separate external icons.
|
||
|
|
- `client/src/components/TicketTable/index.tsx` + `.module.scss` (`.numLink`),
|
||
|
|
`components/Board/BoardCard/index.tsx` + `.module.scss`. tsc + build clean.
|
||
|
|
|
||
|
|
## Next: done. (Deploy: fill `.deploy.env`, create the NAS `.env`, `npm run deploy`.)
|