6 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 4.8	0940dc6972	feat(crypto): fail loudly on unpersistable secret key; flag undecryptable secrets ... Follow-up to the incident where an unwritable /data made Steward silently mint a fresh ephemeral secret key on every boot, orphaning all encrypted secrets — only discovered when an Ansible run failed. Make both failure modes loud and visible. - config._resolve_secret_key: if a new key must be generated but can't be persisted (no STEWARD_SECRET_KEY, unwritable /data), raise RuntimeError and refuse to start, with an actionable fix (set STEWARD_SECRET_KEY, or make /data writable by uid 1000). Also raises a clear error if an existing key file can't be read. First-run on a writable volume still generates + persists normally. - core.settings: detect secrets stored as ciphertext that won't decrypt with the current key (scan_undecryptable_secrets at startup; _is_undecryptable helper). Cached in memory; set_setting discards a key on a fresh write so the banner clears without a restart. - app.py: run the scan after migrate_plaintext_secrets, log a warning, and inject undecryptable_secrets into the template context. - base.html: admin banner naming which secrets to re-enter, each linked to its settings tab. - compose.deploy.yml: document the uid-1000 /data write requirement and the STEWARD_SECRET_KEY option for multi-node Swarm. - Tests: secret-key resolver (reuse existing file, generate when writable, raise when unpersistable) and the undecryptable-secret detection helper. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Jg27rgypiW2efULXJDtMC	2026-06-19 13:52:27 -04:00
bvandeusenandClaude Opus 4.8	06dc5073ca	fix(deploy): explicit backend network for steward↔db traffic ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-05 11:37:10 -04:00
bvandeusenandClaude Opus 4.8	98edb12abb	fix(deploy): let app own secret key — remove STEWARD_SECRET_KEY from deploy compose ... The app auto-generates a key on first boot and persists it to /data/secret.key, which the app_data volume keeps across image updates. No reason to surface this as a user-facing env var in the deploy compose. Removed from .env.example too. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-05 11:28:53 -04:00
bvandeusen	ef6c90c022	Revert "fix(deploy): move POSTGRES_PASSWORD default into .env.example" ... This reverts commit 42d9a7ba07.	2026-06-05 11:25:31 -04:00
bvandeusenandClaude Opus 4.8	42d9a7ba07	fix(deploy): move POSTGRES_PASSWORD default into .env.example ... Plain ${POSTGRES_PASSWORD} in compose; default 'steward' lives in .env.example where it's visible and editable rather than buried in compose YAML. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-05 11:24:29 -04:00
bvandeusenandClaude Opus 4.8	fe57dde57b	feat(ci): publish steward image to the registry + remote-deploy compose ... Add the rule-46 image-publish lane: a `publish` job gated on [lint, unit, integration] that builds the runtime Dockerfile in ci-builder and pushes git.fabledsword.com/bvandeusen/steward:<sha> always, :dev on dev and :latest on main. Authenticates with the REGISTRY_TOKEN repo secret (the injected GITHUB_TOKEN lacks write:package). Steward is the first family app to implement the publish lane; mechanics mirror CI-runner's build-ci-python.yml. Add compose.deploy.yml for a persistent remote instance that pulls :dev (no source bind-mounts, persistent app_data+pgdata volumes, bundled Postgres), plus a README "Remote dev instance" runbook and the POSTGRES_PASSWORD env key. Fix .env.example's database URL var to the canonical STEWARD_DATABASE_URL (single underscore) and document the publish lane in ci-requirements.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-05 11:08:43 -04:00