# devops + designer — Synology deploy script, .env, and RITM→SNOW link

**Date:** 2026-08-27

## Synology deploy (devops) — ported from the Husky template (per user request)
Two scripts, matching Husky's proven pattern (superseded my first single-script cut):
- **`scripts/push-to-nas.sh`** (local, `npm run deploy`): preflight (SSH key pinned via
  `-i $NAS_KEY -o IdentitiesOnly=yes` — fixes the WebStorm multi-identity MaxAuthTries
  failure) → test gate → rsync tree to NAS (openrsync→tar-over-ssh fallback for macOS)
  → run `deploy.sh` over SSH forwarding `--pull`/`--fresh`. Excludes node_modules/dist/
  `.env`/`.deploy.env`/`storage-dump.json`/`.idea`/`claude_artifacts`.
- **`scripts/deploy.sh`** (on the NAS): Synology PATH hardening + `DOCKER_SUDO` autodetect
  → optional `git pull` → `compose build` → `up -d --remove-orphans` → poll app container
  for Docker `healthy` (≤120s). `--fresh` = `down --remove-orphans` **never `-v`** → the
  `forge-db` volume is preserved. Adapted from Husky: removed the `ai.env` check, fixed the
  `.env` required-vars message, `HOST_PORT_FALLBACK=3089`, corrected all "external Postgres /
  no volumes" comments (FORGE bundles the db + `forge-db` volume).
- **Config baked in** (defaults = the real NAS: `192.168.50.2` / `d.tkachenko` / `2323` /
  `/volume1/docker/forge` / `~/.ssh/id_ed25519`), overridable via env or an optional
  `.deploy.env` (`.deploy.env.example`, gitignored). Both scripts `bash -n` clean + executable.
- **`.env.example`** rewritten: local vs prod split; compose overrides DATABASE_URL/PORT/NODE_ENV;
  prod requires `SESSION_SECRET`, `AUTH_USER`, `AUTH_PASS`, `POSTGRES_PASSWORD`. Stale `ADMIN_KEY`
  removed (tokens are admin-role gated now); port note corrected to the published lane.
- **`package.json`** `deploy` script added. **`docs/SETUP.md`** §6 documents the flow.
- Secrets never leave the NAS: `.env` is created once on the NAS and is never synced.
- NOT run — deploy needs explicit sign-off + a reachable NAS; script is created only.

## RITM → SNOW link (designer)
- The ticket **number is now a link to ServiceNow** in the table Number column and on
  board cards — inline external-link glyph, opens a new tab, `stopPropagation` so it
  doesn't also open the detail modal. Removed the now-redundant separate external icons.
- `client/src/components/TicketTable/index.tsx` + `.module.scss` (`.numLink`),
  `components/Board/BoardCard/index.tsx` + `.module.scss`. tsc + build clean.

## Next: done. (Deploy: fill `.deploy.env`, create the NAS `.env`, `npm run deploy`.)