bvandeusenandClaude Opus 5
02c932260e
Three things, all needed before the update loop can be tested. The public signing key is committed. Verified before trusting it: algorithm `Ed`, key ID 90E96FEA2F6D9B6A matching its own comment, 32-byte Ed25519 key. Dev builds now carry a version that RISES. Every build took its version from Cargo.toml, so each one was 0.1.0 — an installed 0.1.0 would read a manifest advertising 0.1.0, conclude it was current, and never update. The rolling channel would have looked broken while working exactly as written. Dev builds are now 0.1.<ci-run-number>, from one helper shared by both bundle jobs and the manifest writer, because three separate derivations of "what version is this" is three chances for the binary and the manifest to disagree. Plain semver, not a `-dev.N` prerelease: prerelease versions sort BELOW the release they qualify, so a tagged build would never update to a newer dev one, and Windows installer metadata wants a numeric X.Y.Z regardless. Bumping the minor still beats any dev build on the old line — 0.2.0 > 0.1.2932. The Windows job also gets the signing environment it was missing, so its NSIS installer is signed too. Without that the manifest would have had a Linux entry and nothing for the platform actually being tested. docker-compose.yml is now the production stack, per request: it pulls the published image instead of building, keeps Postgres OFF the host network, sets restart policies, health checks and log rotation, and refuses to start without a POSTGRES_PASSWORD rather than shipping a known one. Volume names are deliberately unchanged so an existing deployment upgrades in place instead of silently coming up against an empty database. Development keeps its own clearly-named file. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi
55 lines
2.3 KiB
Bash
55 lines
2.3 KiB
Bash
# ThoughtSync production settings. Copy to `.env` and edit:
|
|
#
|
|
# cp .env.example .env
|
|
#
|
|
# Only POSTGRES_PASSWORD has no default — compose refuses to start without it.
|
|
# Everything else here is optional. Anything NOT in this file (site name, signups,
|
|
# attachment limits, trash retention, link previews) is configured in the admin
|
|
# Settings UI and stored in the database, not here.
|
|
|
|
# --- required ---------------------------------------------------------------
|
|
|
|
# Generate one and keep it: changing it later means also changing it inside the
|
|
# database, or Postgres will reject the app's connection.
|
|
#
|
|
# openssl rand -base64 24 | tr -d '/+=' | head -c 32
|
|
#
|
|
# Stick to letters and digits. This value goes into a connection URL, so a `@`,
|
|
# `/`, `:` or `#` in it will be misparsed as URL structure rather than password.
|
|
POSTGRES_PASSWORD=
|
|
|
|
# --- optional ---------------------------------------------------------------
|
|
|
|
# Which build to run.
|
|
#
|
|
# latest tracks the `main` branch — the production line (default)
|
|
# dev tracks the `dev` branch — newer, less settled
|
|
# <commit sha> pins one exact build; every push publishes one, and this is
|
|
# the rollback lever when an upgrade misbehaves
|
|
#
|
|
# NOTE: `main` can sit well behind `dev`. If a feature you expect is missing,
|
|
# check which branch it actually landed on before assuming a bug.
|
|
#THOUGHTSYNC_TAG=latest
|
|
|
|
# The host port the app is published on.
|
|
#THOUGHTSYNC_PORT=5000
|
|
|
|
# Which interface to bind. The default (all interfaces) is what lets desktop
|
|
# clients on your network reach the server. Behind a reverse proxy, set this to
|
|
# 127.0.0.1 so only the proxy can talk to it.
|
|
#THOUGHTSYNC_BIND=0.0.0.0
|
|
|
|
# Database identity. Changing these AFTER the first start does not rename anything
|
|
# that already exists — the volume keeps whatever the first run created.
|
|
#POSTGRES_USER=thoughtsync
|
|
#POSTGRES_DB=thoughtsync
|
|
|
|
# --- a note on HTTPS --------------------------------------------------------
|
|
#
|
|
# The app marks its session cookie Secure automatically when a request arrives over
|
|
# HTTPS, directly or via a proxy setting X-Forwarded-Proto — no setting needed.
|
|
#
|
|
# Worth knowing if you use the desktop app: typing a bare hostname there defaults to
|
|
# https://, deliberately, so a device token never crosses the wire in cleartext by
|
|
# accident. Serving over plain HTTP means typing the `http://` yourself.
|