Feat/working branch

.devcontainer/app/devcontainer.json

@@ -0,0 +1,14 @@
+{
+  "name": "relab-app",
+  "dockerComposeFile": ["../../compose.yaml", "../../compose.dev.yaml"],
+  "service": "app",
+  "runServices": ["app"],
+  "workspaceFolder": "/opt/relab/app",
+  "mounts": ["source=${localWorkspaceFolder},target=/opt/relab,type=bind,consistency=cached"],
+  "overrideCommand": true,
+  "postAttachCommand": "echo 'Relab app devcontainer ready.\\nUse this for focused app work; the root full-stack container is the default onboarding path.\\nRun just install if needed, then just dev or just check.\\nApp: http://127.0.0.1:8011'",
+  "features": {
+    "ghcr.io/devcontainers/features/git:1": {},
+    "ghcr.io/devcontainers-extra/features/expo-cli:1": {}
+  }
+}

.devcontainer/backend/devcontainer.json

@@ -6,7 +6,7 @@
   "workspaceFolder": "/opt/relab/backend",
   "mounts": ["source=${localWorkspaceFolder},target=/opt/relab,type=bind,consistency=cached"],
   "overrideCommand": true,
-  "postAttachCommand": "echo 'RELab backend devcontainer ready.\\nUse this for focused backend work; the root full-stack container is the default onboarding path.\\nRun just install if needed, then just dev or just check.\\nAPI: http://localhost:8011'",
+  "postAttachCommand": "echo 'Relab backend devcontainer ready.\\nUse this for focused backend work; the root full-stack container is the default onboarding path.\\nRun just install if needed, then just dev or just check.\\nAPI: http://127.0.0.1:8010'",
   "features": {
     "ghcr.io/devcontainers/features/git:1": {}
   },

.devcontainer/devcontainer.json

@@ -1,14 +1,14 @@
 {
   "name": "relab-fullstack",
   "dockerComposeFile": ["../compose.yaml", "../compose.dev.yaml"],
-  "service": "app-site",
-  "runServices": ["api", "redis", "postgres", "docs-site", "web-site", "app-site"],
+  "service": "app",
+  "runServices": ["api", "redis", "postgres", "docs", "www", "app"],
   "workspaceFolder": "/opt/relab",
   "mounts": ["source=${localWorkspaceFolder},target=/opt/relab,type=bind,consistency=cached"],
   "features": {
     "ghcr.io/devcontainers/features/git:1": {},
     "ghcr.io/devcontainers-extra/features/expo-cli:1": {},
     "ghcr.io/jsburckhardt/devcontainer-features/uv:1": {}
   },
-  "postAttachCommand": "echo 'RELab full-stack devcontainer ready.\\nPrimary workflow: run just install once, then use just dev / just ci from the repo root.\\nPlatform: http://localhost:8010\\nAPI: http://localhost:8011\\nDocs: http://localhost:8012\\nApp: http://localhost:8013'"
+  "postAttachCommand": "echo 'Relab full-stack devcontainer ready.\\nPrimary workflow: run just install once, then use just dev / just ci from the repo root.\\nAPI: http://127.0.0.1:8010\\nApp: http://127.0.0.1:8011\\nDocs: http://127.0.0.1:8012\\nLanding site: http://127.0.0.1:8013'"
 }

.devcontainer/docs/devcontainer.json

@@ -1,11 +1,11 @@
 {
   "name": "relab-docs",
   "dockerComposeFile": ["../../compose.yaml", "../../compose.dev.yaml"],
-  "service": "docs-site",
-  "runServices": ["docs-site"],
+  "service": "docs",
+  "runServices": ["docs"],
   "workspaceFolder": "/opt/relab/docs",
   "mounts": ["source=${localWorkspaceFolder},target=/opt/relab,type=bind,consistency=cached"],
-  "postAttachCommand": "echo 'RELab docs devcontainer ready.\\nUse this for focused docs work; the root full-stack container is the default onboarding path.\\nRun just install if needed, then just dev or just check.\\nDocs: http://localhost:8012'",
+  "postAttachCommand": "echo 'Relab docs devcontainer ready.\\nUse this for focused docs work; the root full-stack container is the default onboarding path.\\nRun just install if needed, then just dev or just check.\\nDocs: http://127.0.0.1:8012'",
   "features": {
     "ghcr.io/cirolosapio/devcontainers-features/alpine-bash:0": {},
     "ghcr.io/devcontainers/features/git:1": {}

.devcontainer/www/devcontainer.json

@@ -0,0 +1,13 @@
+{
+  "name": "relab-www",
+  "dockerComposeFile": ["../../compose.yaml", "../../compose.dev.yaml"],
+  "service": "www",
+  "runServices": ["www"],
+  "workspaceFolder": "/opt/relab/www",
+  "mounts": ["source=${localWorkspaceFolder},target=/opt/relab,type=bind,consistency=cached"],
+  "overrideCommand": true,
+  "postAttachCommand": "echo 'Relab web devcontainer ready.\\nUse this for focused web work; the root full-stack container is the default onboarding path.\\nRun just install if needed, then just dev or just check.\\nWeb: http://127.0.0.1:8013'",
+  "features": {
+    "ghcr.io/devcontainers/features/git:1": {}
+  }
+}

.dockerignore

@@ -0,0 +1,54 @@
+# Version control
+.git/
+.gitignore
+
+# Local environments and secrets
+.env
+.env.*
+!.env.example
+secrets/
+backups/
+
+# Python environments and caches
+.venv/
+**/.venv/
+__pycache__/
+**/__pycache__/
+.ruff_cache/
+.pytest_cache/
+.mypy_cache/
+.ty/
+
+# Node dependencies and package-manager stores
+node_modules/
+**/node_modules/
+.pnpm-store/
+
+# Build outputs and test reports
+dist/
+**/dist/
+coverage/
+**/coverage/
+playwright-report/
+**/playwright-report/
+test-results/
+**/test-results/
+.astro/
+**/.astro/
+.expo/
+**/.expo/
+web-build/
+**/web-build/
+reports/
+**/reports/
+
+# Editor and OS files
+.vscode/
+.idea/
+.DS_Store
+
+# Debug logs
+npm-debug.*
+yarn-debug.*
+yarn-error.*
+pnpm-debug.*

.env.example

@@ -1,49 +1,59 @@
-# Root .env — committed template for host-local secrets.
-# Copy to `.env` on each deploy host (prod, staging, dev laptop) and fill in
-# values. This file is auto-loaded by `docker compose` for `${VAR}`
-# interpolation.
+# Root .env.example - deploy operator checklist.
+# Copy to `.env` on each deploy host and fill every required value.
 #
-# Non-secret per-environment config (APP_ENV, URLs, worker counts, …) lives
-# in the committed `.env.prod.compose` / `.env.staging.compose` files at repo
-# root — do not duplicate them here. The justfile `prod_compose` /
-# `staging_compose` recipes pick the right one per environment.
-
-COMPOSE_BAKE=true
-
-# --- Cloudflare tunnel -----------------------------------------------
-TUNNEL_TOKEN=your_token   # 🔀 prod or staging token depending on this host
-
-# --- Central monitoring stack (optional) ----------------------------
-# All three vars below are OPTIONAL. Setting an endpoint enables the
-# corresponding exporter; leaving it unset disables it. There is no separate
-# on/off flag — the endpoint IS the switch.
-#
-# Auth pattern (when the central ingress is public-but-protected, e.g. behind a
-# Cloudflare WAF rule requiring Authorization: Basic …):
-#   printf '%s:%s' relab "$SECRET" | base64   # → <base64>
-# Loki driver has no custom-header config → auth goes in the URL.
-# OTEL SDK reads OTEL_EXPORTER_OTLP_HEADERS → pass it there (URL-encode the space).
+# Variable types:
+# - Non-secret: safe to commit or place in `.env` when host-local review is easier.
+# - Secret: never commit real values. Application/runtime secrets normally live
+#   in `secrets/<env>/`; only host/Compose helper secrets that must be
+#   interpolated by Compose are shown here.
 #
-# One-time, per host, before enabling Loki shipping:
-#   docker plugin install grafana/loki-docker-driver:latest \
-#     --alias loki --grant-all-permissions
-
-# Logs → Loki push endpoint (auth embedded in URL)
-# LOKI_URL=https://relab:<secret>@logs.cml-relab.org/loki/api/v1/push
-
-# Traces/metrics → OTLP HTTP collector (+ matching auth header)
-# OTEL_EXPORTER_OTLP_ENDPOINT=https://otlp.cml-relab.org
+# Committed prod/staging public environment identity lives in `deploy/env/*.compose.env`:
+# ENVIRONMENT, API_PUBLIC_URL, APP_PUBLIC_URL, SITE_PUBLIC_URL, DOCS_PUBLIC_URL,
+# and FEATURED_PRODUCT_ID.
+
+# --- Required host-local deploy inputs --------------------------------
+
+# Type: secret | Consumer: Cloudflare tunnel | Purpose: authenticates this host's tunnel.
+CLOUDFLARE_TUNNEL_TOKEN=replace-me
+
+# Type: non-secret | Consumer: backend auth | Purpose: OAuth public client IDs.
+GOOGLE_OAUTH_CLIENT_ID=replace-me
+GITHUB_OAUTH_CLIENT_ID=replace-me
+
+# Type: non-secret | Consumer: backend email | Purpose: outbound email identity.
+# Use `smtp` for SMTP relays, or `microsoft_graph` for Microsoft 365 Graph mail.
+# Compose requires the shared identity fields below. Backend startup validation
+# enforces the provider-specific fields and matching secret files.
+EMAIL_PROVIDER=smtp
+EMAIL_FROM="Relab <relab@example.org>"
+EMAIL_REPLY_TO=relab@example.org
+
+# Type: non-secret | Consumer: backend email | Purpose: required when EMAIL_PROVIDER=smtp.
+SMTP_HOST=smtp.example.org
+SMTP_USERNAME=relab@example.org
+# Secret file required for SMTP: secrets/<env>/smtp_password
+
+# Type: non-secret | Consumer: backend email | Purpose: required when EMAIL_PROVIDER=microsoft_graph.
+# MICROSOFT_GRAPH_TENANT_ID=replace-me
+# MICROSOFT_GRAPH_CLIENT_ID=replace-me
+# MICROSOFT_GRAPH_SENDER_USER=relab@example.org
+# Secret file required for Microsoft Graph: secrets/<env>/microsoft_graph_client_secret
+
+# Type: non-secret | Consumer: backend bootstrap | Purpose: initial superuser identity.
+BOOTSTRAP_SUPERUSER_EMAIL=admin@example.org
+
+# Application/runtime secrets go in `secrets/<env>/`, not in this file.
+# Create missing secret files with:
+#   just deploy-secrets-template prod
+#   just deploy-secrets-template staging
+
+# --- Optional host-local deploy inputs --------------------------------
+
+# Type: secret URL/header | Consumer: telemetry | Purpose: optional central monitoring.
+# See deployment docs before enabling Loki/OTLP shipping.
+# LOKI_PUSH_URL=https://relab:<secret>@<loki-push-host>/loki/api/v1/push
+# OTEL_EXPORTER_OTLP_ENDPOINT=https://otel.cml-relab.org
 # OTEL_EXPORTER_OTLP_HEADERS=Authorization=Basic%20<base64>
 
-# --- Backup destinations ---------------------------------------------
-BACKUP_DIR=./backups
-
-# Remote rsync backup config (for use of backend/scripts/backup/rsync_backup.sh script)
-BACKUP_RSYNC_REMOTE_HOST=user@host              # 🔀
-BACKUP_RSYNC_REMOTE_PATH=/path/to/remote/backup # 🔀
-
-# Remote rclone backup config (for use of backend/scripts/backup/rclone_backup.sh script)
-BACKUP_RCLONE_REMOTE=myremote:/path/to/remote/backup # 🔀
-BACKUP_RCLONE_MULTI_THREAD_STREAMS=16
-BACKUP_RCLONE_TIMEOUT=5m
-BACKUP_RCLONE_USE_COOKIES=false
+# Type: non-secret | Consumer: backup | Purpose: local restic repository path.
+BACKUP_HOST_DIR=./backups