ali_mohaghegh/ERP - ERP - Gitea: Git with a cup of tea

151 Commits 21 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
whqreza	887a3af84f	refactor(monitoring): move grafana into the main compose stack Owner request: one 'docker compose up -d' should bring the whole system up — no separate monitoring project to start for the dashboards. - docker-compose.yml: grafana service (procurement-grafana, loopback :3001, default+shared networks, obs datasource env) + grafana_data volume; provisioning and dashboard JSONs stay in ./monitoring/grafana/ (no file moves, provisioning unchanged) - docker-compose.prod.yml: GRAFANA_ADMIN_PASSWORD forced via the existing ${VAR:?} pattern (local keeps a lenient default, prod refuses defaults) - monitoring/docker-compose.monitoring.yml: grafana service + volume removed (no name/port conflict); glitchtip/prometheus/loki stay server-side as before - docs updated: grafana restarts on app deploys are harmless (settings live in the volume); SSH-tunnel posture unchanged Verified locally: both compose files validate; 'docker compose up -d' starts all 10 services incl. procurement-grafana; BotPostgres datasource health OK; all 3 dashboards provisioned in the fresh volume; monitoring compose no longer contains grafana; old monitoring-grafana container removed; port still loopback-only.	2026-10-27 01:43:31 +03:30
MMD	43e317eeba	chore(security): remove committed secrets/dumps, .env-based config, hardened deploy webhook - Delete backups/*.dump and all real credentials from README/docs (prod MinIO creds, Casdoor passwords, server IP, admin password) - All stack secrets now come from git-ignored .env (.env.example added); docker-compose.prod.yml refuses to boot without them (${VAR:?}) - seed_casdoor.py: bcrypt password hashing, generated console/client secrets - Harden infra/deploy-webhook: HMAC-verified Gitea webhook receiver + systemd unit + README (replaces unauthenticated deploy endpoint) - docs/SECRET-MANAGEMENT.md: secret inventory + rotation checklist	2026-09-18 21:55:24 +03:30
ali_mohaghegh	8825f333a7	infra: single postgres instance (casdoor DB merged) + Traefik v3 edge - remove the separate casdoor-postgres container; casdoor uses the main postgres (db casdoor, created by sql/02-casdoor-db.sql on fresh volumes); data migrated via pg_dump/pg_restore (backups kept outside the repo) - Traefik v3.6 as the public edge (ports 80/443): docker provider pinned to the dedicated traefik_network (fixed-name network), host rules for app/api/auth/s3/storage (env-overridable, localhost defaults), frontend nginx demoted to internal SPA server; docker-compose.prod.yml adds real domains + Let's Encrypt + HTTP→HTTPS redirect (redirect middleware in infra/traefik-dynamic.yml) - v3.6 required (Traefik <=3.3 fails against Docker Engine 29.x); socket mounted rw (Docker Desktop rejects :ro) - start.ps1: app URL now http://localhost, casdoor + db notes	2026-09-01 17:28:33 +03:30

Author

SHA1

Message

Date

whqreza

887a3af84f

refactor(monitoring): move grafana into the main compose stack

Owner request: one 'docker compose up -d' should bring the whole system up —
no separate monitoring project to start for the dashboards.

- docker-compose.yml: grafana service (procurement-grafana, loopback :3001,
  default+shared networks, obs datasource env) + grafana_data volume;
  provisioning and dashboard JSONs stay in ./monitoring/grafana/ (no file
  moves, provisioning unchanged)
- docker-compose.prod.yml: GRAFANA_ADMIN_PASSWORD forced via the existing
  ${VAR:?} pattern (local keeps a lenient default, prod refuses defaults)
- monitoring/docker-compose.monitoring.yml: grafana service + volume removed
  (no name/port conflict); glitchtip/prometheus/loki stay server-side as before
- docs updated: grafana restarts on app deploys are harmless (settings live
  in the volume); SSH-tunnel posture unchanged

Verified locally: both compose files validate; 'docker compose up -d' starts
all 10 services incl. procurement-grafana; BotPostgres datasource health OK;
all 3 dashboards provisioned in the fresh volume; monitoring compose no
longer contains grafana; old monitoring-grafana container removed; port
still loopback-only.

2026-10-27 01:43:31 +03:30

MMD

43e317eeba

chore(security): remove committed secrets/dumps, .env-based config, hardened deploy webhook

- Delete backups/*.dump and all real credentials from README/docs
  (prod MinIO creds, Casdoor passwords, server IP, admin password)
- All stack secrets now come from git-ignored .env (.env.example added);
  docker-compose.prod.yml refuses to boot without them (${VAR:?})
- seed_casdoor.py: bcrypt password hashing, generated console/client secrets
- Harden infra/deploy-webhook: HMAC-verified Gitea webhook receiver
  + systemd unit + README (replaces unauthenticated deploy endpoint)
- docs/SECRET-MANAGEMENT.md: secret inventory + rotation checklist

2026-09-18 21:55:24 +03:30

ali_mohaghegh

8825f333a7

infra: single postgres instance (casdoor DB merged) + Traefik v3 edge

- remove the separate casdoor-postgres container; casdoor uses the main
  postgres (db casdoor, created by sql/02-casdoor-db.sql on fresh volumes);
  data migrated via pg_dump/pg_restore (backups kept outside the repo)
- Traefik v3.6 as the public edge (ports 80/443): docker provider pinned to
  the dedicated traefik_network (fixed-name network), host rules for
  app/api/auth/s3/storage (env-overridable, localhost defaults), frontend
  nginx demoted to internal SPA server; docker-compose.prod.yml adds real
  domains + Let's Encrypt + HTTP→HTTPS redirect (redirect middleware in
  infra/traefik-dynamic.yml)
- v3.6 required (Traefik <=3.3 fails against Docker Engine 29.x); socket
  mounted rw (Docker Desktop rejects :ro)
- start.ps1: app URL now http://localhost, casdoor + db notes

2026-09-01 17:28:33 +03:30