Scaffold Phase 0: Django project, deploy config, base layout
Django 5.2 with dev/test/prod settings, SQLite tuned for Litestream
(WAL, IMMEDIATE transactions), ULID primary keys via a shared base
model, and a custom User model ahead of the first migration.
Minimal accessible base template with dark mode via color-scheme and
an optional theme picker. /healthz answers before host validation so
Fly checks pass.
Dockerfile (dev and prod targets), compose for local dev, fly.toml
with placeholder app/region, Litestream backups to B2, and a Forgejo
Actions workflow. Migrations run in bin/start because Fly release
machines don't mount volumes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 06:59:34 -04:00
|
|
|
#!/bin/sh
|
|
|
|
|
# Production entrypoint. Migrations run here rather than in Fly's release_command,
|
|
|
|
|
# because release machines don't mount the volume that holds the SQLite database.
|
|
|
|
|
set -eu
|
|
|
|
|
|
2026-10-27 08:42:19 -04:00
|
|
|
# The volume is mounted owned by root. Take ownership for the app user, then rerun as it.
|
|
|
|
|
if [ "$(id -u)" = 0 ]; then
|
Harden for launch: limits, CSP, moderation, admin 2FA (Phase 5)
- Rate limits in the shared cache for comments, issues, uploads and
invites; a limited HTMX reply keeps the draft.
- Content-Security-Policy (self only, no inline script or style, bucket
origin for images and frames) and Permissions-Policy on every page.
htmx configured not to inject styles or eval.
- Moderation: deactivating a user ends their sessions and keeps their
content; deleted accounts show as "ghost"; reserved usernames; the
admin won't delete an org's last owner.
- Admin requires a TOTP code (django-otp), with add_admin_totp to enrol.
- Email provider chosen by environment through django-anymail.
- Playwright browser tests: axe WCAG 2.1 AA on every page in light and
dark, no CSP violations, keyboard walkthrough, theme toggle. Explicit
Canvas/CanvasText on :root fixes dark-mode contrast detection.
- bin/start creates the data dir if missing; docs/operations.md runbook.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 10:51:06 -04:00
|
|
|
mkdir -p "${INTENT_DATA_DIR:?}"
|
|
|
|
|
chown -R app:app "$INTENT_DATA_DIR"
|
2026-10-27 08:42:19 -04:00
|
|
|
exec setpriv --reuid=app --regid=app --init-groups env HOME=/home/app "$0" "$@"
|
|
|
|
|
fi
|
|
|
|
|
|
Scaffold Phase 0: Django project, deploy config, base layout
Django 5.2 with dev/test/prod settings, SQLite tuned for Litestream
(WAL, IMMEDIATE transactions), ULID primary keys via a shared base
model, and a custom User model ahead of the first migration.
Minimal accessible base template with dark mode via color-scheme and
an optional theme picker. /healthz answers before host validation so
Fly checks pass.
Dockerfile (dev and prod targets), compose for local dev, fly.toml
with placeholder app/region, Litestream backups to B2, and a Forgejo
Actions workflow. Migrations run in bin/start because Fly release
machines don't mount volumes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 06:59:34 -04:00
|
|
|
DB="${INTENT_DATA_DIR:?}/db.sqlite3"
|
|
|
|
|
SERVER="gunicorn config.wsgi --bind 0.0.0.0:8000 --workers 3 --access-logfile -"
|
|
|
|
|
|
|
|
|
|
if [ -z "${LITESTREAM_BUCKET:-}" ]; then
|
|
|
|
|
echo "LITESTREAM_BUCKET not set: running without backups" >&2
|
|
|
|
|
python manage.py migrate --noinput
|
2026-10-27 08:42:19 -04:00
|
|
|
python manage.py createcachetable
|
Scaffold Phase 0: Django project, deploy config, base layout
Django 5.2 with dev/test/prod settings, SQLite tuned for Litestream
(WAL, IMMEDIATE transactions), ULID primary keys via a shared base
model, and a custom User model ahead of the first migration.
Minimal accessible base template with dark mode via color-scheme and
an optional theme picker. /healthz answers before host validation so
Fly checks pass.
Dockerfile (dev and prod targets), compose for local dev, fly.toml
with placeholder app/region, Litestream backups to B2, and a Forgejo
Actions workflow. Migrations run in bin/start because Fly release
machines don't mount volumes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 06:59:34 -04:00
|
|
|
exec $SERVER
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
# On a fresh volume, pull the latest backup before anything touches the database.
|
|
|
|
|
litestream restore -if-db-not-exists -if-replica-exists "$DB"
|
|
|
|
|
python manage.py migrate --noinput
|
2026-10-27 08:42:19 -04:00
|
|
|
python manage.py createcachetable
|
Scaffold Phase 0: Django project, deploy config, base layout
Django 5.2 with dev/test/prod settings, SQLite tuned for Litestream
(WAL, IMMEDIATE transactions), ULID primary keys via a shared base
model, and a custom User model ahead of the first migration.
Minimal accessible base template with dark mode via color-scheme and
an optional theme picker. /healthz answers before host validation so
Fly checks pass.
Dockerfile (dev and prod targets), compose for local dev, fly.toml
with placeholder app/region, Litestream backups to B2, and a Forgejo
Actions workflow. Migrations run in bin/start because Fly release
machines don't mount volumes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 06:59:34 -04:00
|
|
|
exec litestream replicate -exec "$SERVER"
|