7 Commits

Author	SHA1	Message	Date
Max Mayfield	5a1e287ab6	Add console + marketing site to Docker Compose and build-push ... - Console: nginx SPA on port 3010, image reg.dd0c.net/dd0c-console - Marketing: nginx static on port 3011, image reg.dd0c.net/dd0c-marketing - Dockerfiles + .dockerignore for both - build-push.sh updated to include console + marketing targets	2026-03-03 00:36:48 +00:00
Max Mayfield	eb953cdea5	Security hardening: auth encapsulation, pool restriction, rate limiting, invites, async webhooks ... Phase 1 (Security Critical): - Auth plugin encapsulation: replaced global addHook with Fastify plugin scope - Removed startsWith URL matching; public routes registered outside auth scope - JWT verify now enforces algorithms: ['HS256'] (prevents algorithm confusion) - Raw pool no longer exported from db.ts; systemQuery() + getPoolForAuth() instead - withTenant() remains primary tenant-scoped query path Phase 2 (Infrastructure): - docker-compose.yml: all secrets via env var substitution (${VAR:-default}) - Per-service Postgres users (dd0c_drift, dd0c_alert, etc.) in docker-init-db.sh - .env.example with all configurable secrets - build-push.sh uses $REGISTRY_PASSWORD instead of hardcoded - .gitignore excludes .env files - @fastify/rate-limit: 100 req/min global, 5/min login, 3/min signup - CORS_ORIGIN default changed from '*' to 'http://localhost:5173' Phase 3 (Product): - Team invite flow: tenant_invites table, POST /invite, GET /invites, DELETE /invites/:id - Signup accepts optional invite_token to join existing tenant - Async webhook ingestion (P3): LPUSH to Redis, BRPOP worker, dead-letter queue Console: - All 5 product modules wired: drift, alert, portal, cost, run - PageHeader accepts children prop - 71 modules, 70KB gzipped production build All 6 projects compile clean (tsc --noEmit).	2026-03-02 23:53:55 +00:00
Max Mayfield	5bad2481ae	Add /version endpoint to all products + BUILD_SHA/BUILD_TIME in Dockerfiles	2026-03-02 13:53:15 +00:00
Max Mayfield	6b045637be	Switch registry to reg.dd0c.net (HTTPS on 443)	2026-03-02 13:31:11 +00:00
Max Mayfield	6181727406	Add docker login to build-push.sh and watch-loop.sh for registry auth (HTTP secret)	2026-03-02 05:40:02 +00:00
Max Mayfield	6b79d3cbc9	Switch to Brian's registry at 192.168.86.11:30095, add CI build+push+deploy jobs ... - All services pull from 192.168.86.11:30095 instead of localhost:5000 - Removed self-hosted registry container (Brian runs his own) - CI workflows: test → build → push to registry → deploy - build-push.sh and watch-loop.sh updated with new registry address	2026-03-02 05:28:35 +00:00
Max Mayfield	41e016e9a6	Add local Docker registry: registry:2 on :5000, build-push.sh, CI auto-deploy ... - docker-compose services now pull from localhost:5000 instead of building locally - build-push.sh builds + pushes all 5 Node images to local registry - CI workflows get build-push job: test → build → push → deploy - Deploy becomes: docker compose pull && docker compose up -d - Eliminates silent git pull + stale Docker cache issues	2026-03-02 05:15:37 +00:00