Two issues would each stop a clean production `docker compose up` for the event:
1. Healthchecks probed http://localhost:{3000,3001}, but the app and frontend
bind IPv4 (0.0.0.0) while `localhost` resolves to ::1 (IPv6) first inside the
container — so the probe got "connection refused" and neither container ever
turned healthy. Caddy is gated on `condition: service_healthy` for both, so on
a fresh boot it would block forever and nothing gets served. Switch both probes
to 127.0.0.1. (Verified: both containers now report healthy.)
2. The prod caddy service never received DOMAIN, so the Caddyfile's `{$DOMAIN}`
site address expanded to empty — malformed site block, no TLS, no serving. Add
`environment: { DOMAIN: ${DOMAIN} }` to the caddy service.
Also make .env.example honest and event-ready:
- Add DATABASE_MAX_CONNECTIONS (real env lever; recommend 30 for ~100 guests).
- The DEFAULT_* upload/rate/capacity vars are NOT read from env — they are seeded
into the DB config table and managed at runtime via the admin dashboard. Replace
the misleading entries (e.g. upload rate showed 10; live value is 100 via
migration 015) with a note pointing to the admin UI and the real seeded defaults.
- Document that raising COMPRESSION_WORKER_CONCURRENCY also needs the app memory
limit raised (ffmpeg), so a video burst can't OOM the box.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Two latent production pitfalls, both proven by probing Compose's env_file resolution:
- A bcrypt ADMIN_PASSWORD_HASH is full of $; Compose env_file interpolation AND
dotenvy variable substitution both eat the $… segments (as unset vars), corrupting
the hash so every admin login 401s. Single-quote it so both read it literally —
verified correct for env_file (container) and dotenvy 0.15.7 strong-quote (native).
Updated .env.example with the quotes + a warning comment.
- MEDIA_PATH: pin it to the /media mount in the app 'environment:' block so a stray
host path in .env can't leak in and make every upload 500 with EACCES. environment
overrides env_file, so the container is always correct.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CR1: the lightbox comment button POSTed to /upload/{id}/comment (singular);
no such route exists, so every UI-submitted comment 404'd and was lost.
Fixed to /comments (plural). The prior e2e passed because its seed helper
POSTs the API directly — added comment-ui.spec.ts which drives the real
component so this can't regress silently again.
CR2: export archives (Gallery.zip / Memories.zip / HTML viewer) were written
under media_path, which is a public ServeDir — so GET /media/exports/
Gallery.zip served the entire event (every photo, caption, comment,
uploader name) to any anonymous visitor at a guessable URL, bypassing the
ticket + release gate. Moved exports to a separate EXPORT_PATH (=/exports)
on its own volume (Dockerfile chown, compose volume, gated handler reads
the new path). export-leak.spec.ts asserts /media/exports/Gallery.zip → 404.
Riders (git can't split hunks): LightboxModal also gains H3 live-eviction on
comment-deleted/upload-deleted; config.rs also wires compression_concurrency
from boot config (medium).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
C1: reset_user_pin wrote to a non-existent column (pin_failed_attempts);
the real column is failed_pin_attempts, so every PIN reset 500'd. Fixed
the column name; new e2e (pin-reset.spec.ts) proves a reset returns a
usable PIN and the target can recover with it.
C2: config.rs::validate_secrets now rejects placeholder-ish secrets
(change_me/dev_secret/placeholder), enforces len>=32 in prod, and
requires a real ADMIN_PASSWORD_HASH. docker-compose.yml sets
APP_ENV=production so the guard actually runs. Corrected the false
"fixed" claim in SECURITY-BACKLOG.md. .env.example documents the rule.
Riders in these files (documented here since git can't split hunks):
- host.rs also carries the event-scoped ban_user fix and the
close_event/open_event no-op broadcast guard (medium).
- docker-compose.yml also adds ORIGIN (H6), app/frontend healthchecks with
Caddy waiting on health, and per-service memory limits (medium).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
