Feature 07: Deployment, identity and backups #75

2026-10-05T20:30:09-04:00

dev_agent commented

2026-10-05 20:30:09 -04:00

Feature 07 - Deployment, Identity and Backups. Tasks done and independently reviewed:

3bab56a4 Production compose stack and env template (PR #54)
c26b14cd Authentik provider, application and group
180f2479 Host firewall allowlist unit (PR #72)
0c1dc172 Traefik route, DNS and TLS
d2f2e87e Litestream replication and proven restore (PR #73)
876134bc Deployment runbook (PR #74)

Open: bfe2ac1e Installed-PWA login check on Android and iOS (needs two physical devices; deferred by the owner's direction to promote the code now).

Verified live

https://mealquest.cubecraftlabs.com/health -> 200 with a valid Let's Encrypt certificate, on the LAN and externally.
Authentik login works; /auth/login 302s to the provider with the right client id/redirect/PKCE/scopes.
Firewall restricts 10.60.1.14:8090 to Traefik + the host.
Litestream replicates /data/mealquest.db to 10.60.1.50:/homes/Joshua/mealquest-backups with a proven restore (whole-DB checksum identical before/after); nightly media rsync installed.
deploy/RUNBOOK.md documents the deployment, identity, firewall, DNS and backup/restore procedures with actual values.

Feature 07 - Deployment, Identity and Backups. Tasks done and independently reviewed: - 3bab56a4 Production compose stack and env template (PR #54) - c26b14cd Authentik provider, application and group - 180f2479 Host firewall allowlist unit (PR #72) - 0c1dc172 Traefik route, DNS and TLS - d2f2e87e Litestream replication and proven restore (PR #73) - 876134bc Deployment runbook (PR #74) Open: bfe2ac1e Installed-PWA login check on Android and iOS (needs two physical devices; deferred by the owner's direction to promote the code now). ## Verified live - https://mealquest.cubecraftlabs.com/health -> 200 with a valid Let's Encrypt certificate, on the LAN and externally. - Authentik login works; /auth/login 302s to the provider with the right client id/redirect/PKCE/scopes. - Firewall restricts 10.60.1.14:8090 to Traefik + the host. - Litestream replicates /data/mealquest.db to 10.60.1.50:/homes/Joshua/mealquest-backups with a proven restore (whole-DB checksum identical before/after); nightly media rsync installed. - deploy/RUNBOOK.md documents the deployment, identity, firewall, DNS and backup/restore procedures with actual values.

dev_agent added 5 commits 2026-10-05 20:30:10 -04:00

Compose stack and env template (#54 )

CI / ci (push) Successful in 1m46s

Details

3b524ec118

Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>

Host firewall allowlist unit (DOCKER-USER, port 8090) (#72 )

CI / ci (push) Successful in 1m33s

Details

9d0e943fc3

Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>

Litestream replication and proven restore (#73 )

CI / ci (push) Successful in 1m36s

Details

ceb68cc26f

Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>

Complete the deployment runbook (#74 )

CI / ci (push) Successful in 1m35s

Details

b67ea7bb0e

Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>

Merge dev into Feature 07 branch before integration review

CI / ci (push) Successful in 1m40s

Details

CI / ci (pull_request) Successful in 1m42s

Details

36eb75bda0

review_agent requested changes

2026-10-05 20:36:20 -04:00

Dismissed

review_agent left a comment

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.

overseer added 1 commit 2026-10-05 20:47:59 -04:00

Start MealQuest only after the port 8090 firewall is applied

CI / ci (push) Successful in 1m43s

Details

CI / ci (pull_request) Successful in 1m42s

Details

7797b3958f

The firewall script deleted its rules before re-inserting them, and Docker
restarted the stack on its own (restart: unless-stopped) with no ordering
against the firewall unit, so port 8090 could be open to the LAN while the
rules were reapplied.

- mealquest-firewall.sh fails closed: if the chain is not already exactly
  right, it inserts the DROP at position 1 first, deletes its other tagged
  rules by number, then inserts the two RETURN rules above it. A correct
  chain is left untouched.
- New mealquest.service owns the compose stack: Requires= and After=
  mealquest-firewall.service, PartOf=docker.service.
- compose.yaml: restart: "no" on both services, so Docker never starts
  them before the firewall.
- RUNBOOK: deploy, rollback, restore and key rotation start and stop the
  stack with systemctl; documents the stack unit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review_agent approved these changes

2026-10-05 20:55:19 -04:00

review_agent left a comment

Independent Codex gpt-6-sol review: APPROVED for this exact commit.

approver_agent merged commit 67e44a506a into dev

2026-10-05 20:59:48 -04:00

dev_agent referenced this pull request

2026-10-05 21:01:51 -04:00

Promote dev to main: Feature 07 (deployment, identity and backups) #76

Sign in to join this conversation.