dependabot[bot]
93a253a6e6
ci: bump webfactory/ssh-agent from 0.9.0 to 0.9.1
...
Bumps [webfactory/ssh-agent](https://github.com/webfactory/ssh-agent ) from 0.9.0 to 0.9.1.
- [Release notes](https://github.com/webfactory/ssh-agent/releases )
- [Changelog](https://github.com/webfactory/ssh-agent/blob/master/CHANGELOG.md )
- [Commits](https://github.com/webfactory/ssh-agent/compare/v0.9.0...v0.9.1 )
---
updated-dependencies:
- dependency-name: webfactory/ssh-agent
dependency-version: 0.9.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2025-12-25 18:41:13 +00:00
Wuesteon
4d15d9e764
🔒 security(auth): migrate to EdDSA JWT and add automated monitoring
...
BREAKING: JWT keys are now auto-managed by Better Auth (EdDSA/Ed25519)
- Remove all JWT_PRIVATE_KEY, JWT_PUBLIC_KEY, JWT_SECRET references
- Keys stored in auth.jwks database table (auto-generated on first run)
- Delete obsolete generate-keys.sh and generate-staging-secrets.sh scripts
- Clean up legacy AUTH_*.md analysis files from root
Security Improvements:
- Add security_events table for audit logging
- Add SecurityEventsService for tracking auth events
- Enhanced security headers (HSTS, CSP, X-Frame-Options)
- Rate limiting configuration
Monitoring Setup:
- Add auth-health-check.sh for automated testing
- Add generate-dashboard.sh for HTML status dashboard
- Tests: health endpoint, JWKS (EdDSA), security headers, response time
- Ready for Hetzner cron deployment
Documentation:
- Update deployment docs with Better Auth notes
- Update environment variable references
- Add security improvements documentation
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-18 21:42:47 +01:00
Wuesteon
dcdc15f154
🚀 ci(picture): add picture app to CI/CD deployment pipeline
...
- Add picture-backend and picture-web to CI Docker build matrix
- Add picture services to staging deployment workflow
- Add picture-backend to production deployment workflow
- Create Dockerfile and docker-entrypoint.sh for picture-web
- Fix picture-backend Dockerfile port (3003→3006) and health endpoint
- Add picture routes to Caddyfile.staging
- Add REPLICATE_API_TOKEN and MANA_CORE_SERVICE_KEY env vars
2025-12-17 18:47:42 +01:00
Wuesteon
8af01724d7
✨ feat(db): add production-safe migration system with advisory locks
...
- Add migrate.ts script with PostgreSQL advisory locks to prevent concurrent migrations
- Add retry logic with exponential backoff for transient connection errors
- Update CI/CD workflows to run migrations before deployment with health polling
- Create comprehensive DATABASE_MIGRATIONS.md documentation covering:
- Drizzle ORM internals (push vs generate/migrate modes)
- Migration tracking (journal files, __drizzle_migrations table)
- Advisory lock architecture and timeout handling
- Zero-downtime migration patterns (expand-contract)
- Troubleshooting guide
- Update .claude/guidelines/database.md with migration quick reference
- Remove stale migration files that caused schema conflicts
2025-12-09 02:13:11 +01:00
Wuesteon
8de629dd2d
🚀 ci: add dev branch workflow with PR validation
...
- Rename ci-main.yml to ci.yml for clarity
- Add PR-based validation (type-check, lint) for dev and main branches
- Add path filtering to skip CI on docs-only changes
- Trigger staging deployment only on push to dev branch
- Keep production deployment manual with confirmation
2025-12-08 12:54:25 +01:00
Wuesteon
74dc6892ab
first implementation
2025-11-27 17:26:18 +01:00
