From e16bccc2f52a876f39df78b5128bc23ceb55e43f Mon Sep 17 00:00:00 2001 From: Julian Cuni Date: Mon, 29 Jun 2026 13:12:20 +0200 Subject: [PATCH 1/4] chore(deploy): park-buzi TAG is a placeholder, pinned at deploy time A committed stage- can never match the commit that introduces it (the pin commit changes HEAD), so a hardcoded sha here is always stale by one. Make it an explicit placeholder (stage-REPLACE_WITH_BUILT_SHA); the real immutable sha is set when you deploy from Komodo Core after CI builds :stage-. No moving tag on a booth still holds. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V --- komodo/resources.toml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/komodo/resources.toml b/komodo/resources.toml index 96de3e6..b1ef16f 100644 --- a/komodo/resources.toml +++ b/komodo/resources.toml @@ -46,9 +46,10 @@ registry_provider = "git.infra.msai.al" registry_account = "komodo" environment = """ REGISTRY=git.infra.msai.al/mca/parking_solution -# Staging booth: pin an immutable stage- per deploy (bump after merging dev → stage and -# CI builds it). The moving `:stage` tag exists as the pointer; we deploy the sha, not the mover. -TAG=stage-84f00db +# Staging booth: pin an immutable stage- per deploy. PLACEHOLDER below — after merging +# dev → stage and CI builds :stage-, set this to that exact sha (or override TAG in Core at +# deploy). The moving `:stage` tag exists as the pointer; we deploy the sha, not the mover. +TAG=stage-REPLACE_WITH_BUILT_SHA COOKIE_SECURE=0 VISION_ENABLED=1 WS_ALLOWED_ORIGINS= From 652d6599d3a7436cad5153091922146a3fa07207 Mon Sep 17 00:00:00 2001 From: Julian Cuni Date: Mon, 29 Jun 2026 15:19:20 +0200 Subject: [PATCH 2/4] ci(build-images): trigger on komodo/** too MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A push only builds if it touches a path in the filter. The first stage commit was komodo-only, so no :stage image was ever built. Add komodo/** so IaC/Stack changes (and a komodo-only push to stage) also build+check — a deploy-config change gets the same sanity pass before it reaches a booth. This commit itself touches the workflow file (already filtered), so it triggers the build that produces the first :stage image. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V --- .gitea/workflows/build-images.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.gitea/workflows/build-images.yml b/.gitea/workflows/build-images.yml index 1e81a52..75adfd1 100644 --- a/.gitea/workflows/build-images.yml +++ b/.gitea/workflows/build-images.yml @@ -21,6 +21,10 @@ on: - 'docker-compose*.yml' - '.dockerignore' - '.gitea/workflows/build-images.yml' + # Deploy/IaC changes (compose above, plus the Komodo Stack defs) also rebuild — so a + # promotion or a Stack tweak gets the same build+checks sanity pass before it reaches a + # booth, and a komodo-only push to `stage` still produces a :stage image. + - 'komodo/**' workflow_dispatch: env: From 07295f8063807670fd969e2393f7ca12c80ab0ce Mon Sep 17 00:00:00 2001 From: Julian Cuni Date: Mon, 29 Jun 2026 15:27:31 +0200 Subject: [PATCH 3/4] deploy(park-buzi): pin TAG=stage-39c778f The first :stage image is built and in the registry (stage-39c778f). Pin it in the IaC so git matches Core's Stack env and a ResourceSync won't revert TAG to the placeholder. Bump this on each promotion. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V --- komodo/resources.toml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/komodo/resources.toml b/komodo/resources.toml index b1ef16f..2a2de15 100644 --- a/komodo/resources.toml +++ b/komodo/resources.toml @@ -46,10 +46,10 @@ registry_provider = "git.infra.msai.al" registry_account = "komodo" environment = """ REGISTRY=git.infra.msai.al/mca/parking_solution -# Staging booth: pin an immutable stage- per deploy. PLACEHOLDER below — after merging -# dev → stage and CI builds :stage-, set this to that exact sha (or override TAG in Core at -# deploy). The moving `:stage` tag exists as the pointer; we deploy the sha, not the mover. -TAG=stage-REPLACE_WITH_BUILT_SHA +# Staging booth: pinned immutable stage-. After each promotion (merge dev → stage, CI builds +# :stage-), bump this to the new sha and re-sync/deploy from Core. The moving `:stage` tag +# exists as the pointer; we deploy the sha, not the mover. +TAG=stage-39c778f COOKIE_SECURE=0 VISION_ENABLED=1 WS_ALLOWED_ORIGINS= From 8f32d90d2819348220ce3589e238c04ea1458a6a Mon Sep 17 00:00:00 2001 From: Julian Cuni Date: Mon, 29 Jun 2026 15:56:39 +0200 Subject: [PATCH 4/4] fix(compose): pass BACKUP_KEY through to the server container MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The server's compose environment: block is an allowlist — it only forwards the vars it names. BACKUP_KEY was never added when the backup feature landed, so even though Komodo wrote BACKUP_KEY into the Stack .env, compose dropped it and the container came up without it (docker inspect showed JWT/SIGN present, BACKUP_KEY absent — not empty, absent). The Backup screen correctly reported 'BACKUP_KEY missing'. Add BACKUP_KEY: ${BACKUP_KEY:-} next to EVENT_SIGNING_KEY (optional, empty default — backups stay off until it's set). The prod overlay only merges VISION_URL, so the base addition flows through to prod. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V --- docker-compose.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docker-compose.yml b/docker-compose.yml index 17ae275..a6d35ee 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -24,6 +24,10 @@ services: # Dedicated ledger-signing key. Falls back to JWT_SECRET (with a warning) if empty; # set a distinct one in prod. See apps/server/.env.example + local-jwt-auth. EVENT_SIGNING_KEY: ${EVENT_SIGNING_KEY:-} + # Dedicated backup-ENCRYPTION key (separate from the signing key). Empty = backups stay + # off (the in-UI target + retention do nothing without it). Per-booth + unique; escrow it + # offsite. See apps/server/.env.example + wiki/concepts/backup-recovery.md. + BACKUP_KEY: ${BACKUP_KEY:-} # CRITICAL on the plain-HTTP booth LAN: cookies are Secure (HTTPS-only) by DEFAULT, # so without COOKIE_SECURE=0 the auth cookie is never sent over http and operators # CANNOT LOG IN. Leave unset only behind TLS. See disk-os-hardening "deploy-time runbook".