2 Commits

Include renames

Author	SHA1	Message	Date
MMD	43e317eeba	chore(security): remove committed secrets/dumps, .env-based config, hardened deploy webhook ... - Delete backups/*.dump and all real credentials from README/docs (prod MinIO creds, Casdoor passwords, server IP, admin password) - All stack secrets now come from git-ignored .env (.env.example added); docker-compose.prod.yml refuses to boot without them (${VAR:?}) - seed_casdoor.py: bcrypt password hashing, generated console/client secrets - Harden infra/deploy-webhook: HMAC-verified Gitea webhook receiver + systemd unit + README (replaces unauthenticated deploy endpoint) - docs/SECRET-MANAGEMENT.md: secret inventory + rotation checklist	2026-09-18 21:55:24 +03:30
ali_mohaghegh	8825f333a7	infra: single postgres instance (casdoor DB merged) + Traefik v3 edge ... - remove the separate casdoor-postgres container; casdoor uses the main postgres (db casdoor, created by sql/02-casdoor-db.sql on fresh volumes); data migrated via pg_dump/pg_restore (backups kept outside the repo) - Traefik v3.6 as the public edge (ports 80/443): docker provider pinned to the dedicated traefik_network (fixed-name network), host rules for app/api/auth/s3/storage (env-overridable, localhost defaults), frontend nginx demoted to internal SPA server; docker-compose.prod.yml adds real domains + Let's Encrypt + HTTP→HTTPS redirect (redirect middleware in infra/traefik-dynamic.yml) - v3.6 required (Traefik <=3.3 fails against Docker Engine 29.x); socket mounted rw (Docker Desktop rejects :ro) - start.ps1: app URL now http://localhost, casdoor + db notes	2026-09-01 17:28:33 +03:30