feat(config): make Docker onboarding YAML-first #114

Merged

eleith merged 1 commits from feat/yaml-first-onboarding into main 2026-11-02 03:11:37 +00:00

Conversation 0 Commits 1 Files Changed 27

+471 -222

eleith-gitea-agent Bot commented 2026-11-02 03:04:28 +00:00

Copy link

Copy source

Summary

Closes #102.

• Make YAML the normal configuration path and .env optional across the documented, source-build and development Compose setups. Retain interpolation and advanced environment/Compose overrides; WHEN_HTTP_PORT changes only the published host port, not container ports, healthchecks or internal service URLs.
• Add optional auth.secret. Explicit YAML takes precedence over existing AUTH_SECRET; when neither is configured, generate a cryptographically random key at web auth startup. Restarting signs users out only with the generated-key default. Stable keys retain the existing seven-day, non-refreshing sessions. Invalid configured keys fail before database side effects.
• Align the YAML example and CLI starter, leaving real passwords blank rather than publishing a usable admin login. Create CLI files privately (0600, exclusive creation). Report YAML syntax positions/codes without echoing inline credentials.
• Shorten setup/deployment guidance while retaining explicit trusted-proxy, private-backend, credential and SQLite persistence requirements. No custom server/bootstrap, auth database, secret persistence file, dependency or CI-policy changes.
• Apply owner follow-up comments: reuse flow-owned original-start availability in the wizard, remove the quoted nonessential config-reference row, and keep apps/web/mise.toml unchanged.

Validation

• Coverage suites: 1,892 tests / 153 files passed (config145, CLI49, web1,113, worker compatibility585); thresholds unchanged. Types, lint and production builds passed. No worker source changes.
• Fresh web checks after the wizard simplification: 1,113 tests, svelte-check 0 errors / 0 warnings, lint/build, and the existing UTC+14 unavailable-original browser journey passed (one worker, stop-first-failure, no retries).
• Isolated native production startup with synthetic literal YAML, fresh default databases, no .env and no AUTH_SECRET passed: credentials login, secure cookie, protected admin page, restart invalidation and natural shutdown. An invalid configured key was rejected before database creation.
• Independent code/security, readability and test-value reviews completed; findings addressed. Formatting, local docs links and static Compose YAML checks passed.

Docker verification boundary

The owner ran mise docker up successfully. This verifies the existing development setup boots; it can use fnox/local Compose overrides. A clean, env-free Docker Compose first install has not been run. The env-free production evidence above uses the native Node entrypoint, not Docker; static YAML inspection is not claimed as native Compose validation.

Root mise.toml and pnpm-lock.yaml owner edits are excluded in full and preserved. Local checks used the installed dependency graph. Patch changesets cover web/CLI; no version, release, deployment or merge action. Owner will land the PR.

## Summary Closes #102. - Make YAML the normal configuration path and .env optional across the documented, source-build and development Compose setups. Retain interpolation and advanced environment/Compose overrides; WHEN_HTTP_PORT changes only the published host port, not container ports, healthchecks or internal service URLs. - Add optional auth.secret. Explicit YAML takes precedence over existing AUTH_SECRET; when neither is configured, generate a cryptographically random key at web auth startup. Restarting signs users out only with the generated-key default. Stable keys retain the existing seven-day, non-refreshing sessions. Invalid configured keys fail before database side effects. - Align the YAML example and CLI starter, leaving real passwords blank rather than publishing a usable admin login. Create CLI files privately (0600, exclusive creation). Report YAML syntax positions/codes without echoing inline credentials. - Shorten setup/deployment guidance while retaining explicit trusted-proxy, private-backend, credential and SQLite persistence requirements. No custom server/bootstrap, auth database, secret persistence file, dependency or CI-policy changes. - Apply owner follow-up comments: reuse flow-owned original-start availability in the wizard, remove the quoted nonessential config-reference row, and keep apps/web/mise.toml unchanged. ## Validation - Coverage suites: **1,892 tests / 153 files passed** (config145, CLI49, web1,113, worker compatibility585); thresholds unchanged. Types, lint and production builds passed. No worker source changes. - Fresh web checks after the wizard simplification: 1,113 tests, svelte-check **0 errors / 0 warnings**, lint/build, and the existing UTC+14 unavailable-original browser journey passed (one worker, stop-first-failure, no retries). - Isolated native production startup with synthetic literal YAML, fresh default databases, no .env and no AUTH_SECRET passed: credentials login, secure cookie, protected admin page, restart invalidation and natural shutdown. An invalid configured key was rejected before database creation. - Independent code/security, readability and test-value reviews completed; findings addressed. Formatting, local docs links and static Compose YAML checks passed. ## Docker verification boundary The owner ran **mise docker up successfully**. This verifies the existing development setup boots; it can use fnox/local Compose overrides. A clean, env-free **Docker Compose first install has not been run**. The env-free production evidence above uses the native Node entrypoint, not Docker; static YAML inspection is not claimed as native Compose validation. Root mise.toml and pnpm-lock.yaml owner edits are excluded in full and preserved. Local checks used the installed dependency graph. Patch changesets cover web/CLI; no version, release, deployment or merge action. Owner will land the PR.

eleith-gitea-agent Bot added 1 commit 2026-11-02 03:04:28 +00:00

feat(config): make Docker onboarding YAML-first e11ef0d16f

eleith merged commit e11ef0d16f into main 2026-11-02 03:11:37 +00:00

eleith deleted branch feat/yaml-first-onboarding 2026-11-02 03:11:37 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

blocked

Waiting on a prerequisite before work can proceed

bug

Something is not working

enhancement

New feature

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

eleith-gitea-agent Bot eleith (eleith)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: eleith/when#114