forge/claude_artifacts/devops-20260827-182020.md

devops + designer — Synology deploy script, .env, and RITM→SNOW link

Date: 2026-08-27

Synology deploy (devops) — ported from the Husky template (per user request)

Two scripts, matching Husky's proven pattern (superseded my first single-script cut):

• scripts/push-to-nas.sh (local, npm run deploy): preflight (SSH key pinned via -i $NAS_KEY -o IdentitiesOnly=yes — fixes the WebStorm multi-identity MaxAuthTries failure) → test gate → rsync tree to NAS (openrsync→tar-over-ssh fallback for macOS) → run deploy.sh over SSH forwarding --pull/--fresh. Excludes node_modules/dist/ .env/.deploy.env/storage-dump.json/.idea/claude_artifacts.
• scripts/deploy.sh (on the NAS): Synology PATH hardening + DOCKER_SUDO autodetect → optional git pull → compose build → up -d --remove-orphans → poll app container for Docker healthy (≤120s). --fresh = down --remove-orphans never -v → the forge-db volume is preserved. Adapted from Husky: removed the ai.env check, fixed the .env required-vars message, HOST_PORT_FALLBACK=3089, corrected all "external Postgres / no volumes" comments (FORGE bundles the db + forge-db volume).
• Config baked in (defaults = the real NAS: 192.168.50.2 / d.tkachenko / 2323 / /volume1/docker/forge / ~/.ssh/id_ed25519), overridable via env or an optional .deploy.env (.deploy.env.example, gitignored). Both scripts bash -n clean + executable.
• .env.example rewritten: local vs prod split; compose overrides DATABASE_URL/PORT/NODE_ENV; prod requires SESSION_SECRET, AUTH_USER, AUTH_PASS, POSTGRES_PASSWORD. Stale ADMIN_KEY removed (tokens are admin-role gated now); port note corrected to the published lane.
• package.json deploy script added. docs/SETUP.md §6 documents the flow.
• Secrets never leave the NAS: .env is created once on the NAS and is never synced.
• NOT run — deploy needs explicit sign-off + a reachable NAS; script is created only.

RITM → SNOW link (designer)

• The ticket number is now a link to ServiceNow in the table Number column and on board cards — inline external-link glyph, opens a new tab, stopPropagation so it doesn't also open the detail modal. Removed the now-redundant separate external icons.
• client/src/components/TicketTable/index.tsx + .module.scss (.numLink), components/Board/BoardCard/index.tsx + .module.scss. tsc + build clean.

Next: done. (Deploy: fill .deploy.env, create the NAS .env, npm run deploy.)