makearmy/le-app
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

define canonical migration deployment paths

Browse source
This commit is contained in:
makearmy 2026-07-10 20:21:27 -04:00
parent ed1c84eb76
commit 27fd4f4ae3
4 changed files with 238 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/payload-migration/implementation-plan.md
View file

@ -17,29 +17,37 @@ Status: revised pre-implementation plan. Work stops at the Milestone 0 host-runt
- Verify forbidden production paths and sockets are inaccessible.
- Execute every positive and negative preflight in `host-runtime-plan.md` before application work.
3. **Repository/environment structure**
3. **Reversible canonical-path consolidation — separately approval-gated**
- Inventory the transitional Git roots, symlinks, credential filenames, rootful disposable containers, and volumes without reading secret values.
- Create the sole checkout at `/srv/le-payload-dev/lasereverything.net.db` and verify `migration/payload` commit/remote state.
- Copy and checksum the scrubbed source into root-owned read-only `/srv/le-payload-dev/source`.
- Create new nonproduction-only secrets and rootless MariaDB/PostgreSQL resources; do not reuse production credentials.
- Preserve all old resources through the rollback period. Delete nothing without a later explicit approval.
4. **Repository/environment structure**
- Add common Compose core, mode overlays/profiles, environment schemas/examples, proxy configuration, health contracts, and safe defaults.
- Complete Docker/build-context exclusions for every context.
- Add one-command wrappers with context/path/project safety checks.
- Add automated external-SMTP denial and forbidden-mount/context tests; make snapshot startup fail closed.
4. **Fixture stack**
5. **Fixture stack**
- Build exact pinned images under Node 24.18.0.
- Bring up proxy, frontend, Payload shell, PostgreSQL, Mailpit, deterministic CPU BGBye profile, and fixtures.
- Prove HTTPS cookies, forwarded headers, uploads, mail capture, health, logs, reset, and teardown.
5. **Snapshot/rehearsal stack**
6. **Snapshot/rehearsal stack**
- Mount only authorized scrubbed source and uploads read-only on finite jobs.
- Add disposable destination media/PostgreSQL and detailed-report exclusions.
- Add isolated legacy Directus reference profile using a writable clone and local-only credentials.
- Prove no production SMTP/OAuth/webhook/token configuration or outbound delivery.
- Keep authoritative source and `.migration.env` mounted only on finite inventory/import/validation jobs.
6. **Milestone 0 acceptance**
7. **Milestone 0 acceptance**
- Clean-checkout fixture startup and smoke test require no undocumented steps.
- Snapshot startup passes mount/secret/egress safety assertions.
- Same image digests run in fixture and snapshot modes.
- Rootless user can control only its nonproduction project resources.
- Production release dry-run proves a clean reviewed commit and immutable digests deploy only from `/var/www/lasereverything.net.db`.
## Milestone 1 — structural inventory and mapping