mirror of
https://github.com/Memo-2023/mana-monorepo.git
synced 2026-05-14 21:01:08 +02:00
This commit bundles two unrelated changes that were swept together by an
accidental `git add -A` in another working session. Documented here so the
history reflects what's actually inside.
═══════════════════════════════════════════════════════════════════════
1. fix(mana-auth): /api/v1/auth/login mints JWT via auth.handler instead
of api.signInEmail
═══════════════════════════════════════════════════════════════════════
Previous attempt (commit 55cc75e7d) tried to fix the broken JWT mint in
/api/v1/auth/login by switching the cookie name from `mana.session_token`
to `__Secure-mana.session_token` for production. That was necessary but
not sufficient: Better Auth's session cookie value isn't just the raw
session token, it's `<token>.<HMAC>` where the HMAC is derived from the
better-auth secret. Reconstructing the cookie from auth.api.signInEmail's
JSON response only gave us the raw token, so /api/auth/token's
get-session middleware still couldn't validate it and the JWT mint kept
silently failing.
Real fix: do the sign-in via auth.handler (the HTTP path) rather than
auth.api.signInEmail (the SDK path). The handler returns a real fetch
Response with a Set-Cookie header containing the fully signed cookie
envelope. We capture that header verbatim and forward it as the cookie
on the /api/auth/token request, which now passes validation and mints
the JWT correctly.
Verified end-to-end on auth.mana.how:
$ curl -X POST https://auth.mana.how/api/v1/auth/login \
-d '{"email":"...","password":"..."}'
{
"user": {...},
"token": "<session token>",
"accessToken": "eyJhbGciOiJFZERTQSI...", ← real JWT now
"refreshToken": "<session token>"
}
Side benefits:
- Email-not-verified path is now handled by checking
signInResponse.status === 403 directly, no more catching APIError
with the comment-noted async-stream footgun.
- X-Forwarded-For is forwarded explicitly so Better Auth's rate limiter
and our security log see the real client IP.
- The leftover catch block now only handles unexpected exceptions
(network errors etc); the FORBIDDEN-checking logic in it is dead but
harmless and left in for defense in depth.
═══════════════════════════════════════════════════════════════════════
2. chore: remove the entire self-hosted Matrix stack (Synapse, Element,
Manalink, mana-matrix-bot)
═══════════════════════════════════════════════════════════════════════
The Matrix subsystem ran parallel to the main Mana product without any
load-bearing integration: the unified web app never imported matrix-js-sdk,
the chat module uses mana-sync (local-first), and mana-matrix-bot's
plugins duplicated features the unified app already ships natively.
Keeping it alive cost a Synapse + Element + matrix-web + bot container
quartet, three Cloudflare routes, an OIDC provider plugin in mana-auth,
and a steady drip of devlog/dependency churn.
Removed:
- apps/matrix (Manalink web + mobile, ~150 files)
- services/mana-matrix-bot (Go bot with ~20 plugins)
- docker/matrix configs (Synapse + Element)
- synapse/element-web/matrix-web/mana-matrix-bot services in
docker-compose.macmini.yml
- matrix.mana.how/element.mana.how/link.mana.how Cloudflare tunnel routes
- OIDC provider plugin + matrix-synapse trustedClient + matrixUserLinks
table from mana-auth (oauth_* schema definitions also removed)
- MatrixService import path in mana-media (importFromMatrix endpoint)
- Matrix notification channel in mana-notify (worker, metrics, config,
channel_type enum, MatrixOptions handler)
- Matrix entries from shared-branding (mana-apps + app-icons),
notify-client, the i18n bundle, the observatory map, the credits
app-label list, the landing footer/apps page, the prometheus + alerts
+ promtail tier mappings, and the matrix-related deploy paths in
cd-macmini.yml + ci.yml
Devlog/manascore/blueprint entries that mention Matrix are left intact
as historical record. The oauth_* + matrix_user_links Postgres tables
stay on existing prod databases — code can no longer write to them, drop
them in a follow-up migration if you want them gone for real.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
148 lines
5.6 KiB
Bash
Executable file
148 lines
5.6 KiB
Bash
Executable file
#!/bin/bash
|
|
#
|
|
# Mac Mini Deployment Script v2 — New Architecture (Hono + Bun + Go)
|
|
#
|
|
# Deploys the complete Mana stack:
|
|
# - Infrastructure: PostgreSQL, Redis, MinIO, SearXNG
|
|
# - Core Services: mana-auth, mana-credits, mana-user, mana-subscriptions, mana-analytics
|
|
# - Go Services: mana-sync, mana-search, mana-crawler, mana-api-gateway, mana-notify
|
|
# - Python AI: mana-llm, mana-stt, mana-tts, mana-image-gen
|
|
# - App Frontends: 19 SvelteKit web apps
|
|
#
|
|
# Usage:
|
|
# ./scripts/mac-mini/deploy-v2.sh # Full deploy
|
|
# ./scripts/mac-mini/deploy-v2.sh --quick # Skip builds, just restart
|
|
# ./scripts/mac-mini/deploy-v2.sh --status # Just show status
|
|
|
|
set -e
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
|
|
COMPOSE_FILE="$PROJECT_ROOT/docker-compose.macmini.yml"
|
|
ENV_FILE="$PROJECT_ROOT/.env.macmini"
|
|
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
RED='\033[0;31m'
|
|
BLUE='\033[0;34m'
|
|
NC='\033[0m'
|
|
|
|
cd "$PROJECT_ROOT"
|
|
|
|
# ─── Helper Functions ────────────────────────────────────────
|
|
|
|
check_health() {
|
|
local name=$1
|
|
local url=$2
|
|
local status
|
|
status=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 3 "$url" 2>/dev/null || echo "000")
|
|
if [ "$status" = "200" ]; then
|
|
echo -e " ${GREEN}✓${NC} $name"
|
|
else
|
|
echo -e " ${RED}✗${NC} $name ($status)"
|
|
fi
|
|
}
|
|
|
|
# ─── Status Only ─────────────────────────────────────────────
|
|
|
|
if [ "$1" = "--status" ]; then
|
|
echo -e "${BLUE}=== Mana Service Status ===${NC}"
|
|
echo ""
|
|
echo "Core (Hono + Bun):"
|
|
check_health "mana-auth (3001)" "http://localhost:3001/health"
|
|
check_health "mana-credits (3061)" "http://localhost:3061/health"
|
|
check_health "mana-user (3062)" "http://localhost:3062/health"
|
|
check_health "mana-subscriptions (3063)" "http://localhost:3063/health"
|
|
check_health "mana-analytics (3064)" "http://localhost:3064/health"
|
|
echo ""
|
|
echo "Go Services:"
|
|
check_health "mana-sync (3050)" "http://localhost:3050/health"
|
|
check_health "mana-search (3021)" "http://localhost:3021/health"
|
|
check_health "mana-api-gateway (3060)" "http://localhost:3060/health"
|
|
echo ""
|
|
echo "Infrastructure:"
|
|
check_health "PostgreSQL (5432)" "http://localhost:5432" # Won't return 200, but tests connectivity
|
|
docker compose -f "$COMPOSE_FILE" ps --format "table {{.Name}}\t{{.Status}}" 2>/dev/null | head -30
|
|
exit 0
|
|
fi
|
|
|
|
# ─── Pre-flight Checks ──────────────────────────────────────
|
|
|
|
echo -e "${BLUE}=== Mana Deployment v2 ===${NC}"
|
|
echo ""
|
|
|
|
if [ ! -f "$ENV_FILE" ]; then
|
|
echo -e "${RED}Missing $ENV_FILE — copy from .env.macmini.example${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
# ─── Pull Latest Code ───────────────────────────────────────
|
|
|
|
echo -e "${YELLOW}Pulling latest code...${NC}"
|
|
git pull --rebase origin main 2>/dev/null || echo "Pull skipped (not on main or no remote)"
|
|
echo ""
|
|
|
|
# ─── Create Databases ───────────────────────────────────────
|
|
|
|
echo -e "${YELLOW}Ensuring databases exist...${NC}"
|
|
|
|
# Start just postgres first
|
|
docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" up -d postgres
|
|
sleep 5
|
|
|
|
# Create all needed databases
|
|
for db in mana_auth mana_credits mana_user mana_subscriptions mana_analytics mana_sync \
|
|
chat todo calendar contacts storage cards music nutriphi planta \
|
|
questions traces context citycorners photos presi skilltree; do
|
|
docker compose -f "$COMPOSE_FILE" exec -T postgres \
|
|
psql -U postgres -c "CREATE DATABASE $db;" 2>/dev/null || true
|
|
done
|
|
echo -e "${GREEN}Databases ready.${NC}"
|
|
echo ""
|
|
|
|
# ─── Build & Start Services ─────────────────────────────────
|
|
|
|
if [ "$1" != "--quick" ]; then
|
|
echo -e "${YELLOW}Building images...${NC}"
|
|
docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" build --parallel 2>&1 | tail -5
|
|
echo ""
|
|
fi
|
|
|
|
echo -e "${YELLOW}Starting all services...${NC}"
|
|
docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" up -d
|
|
echo ""
|
|
|
|
# ─── Wait & Health Check ────────────────────────────────────
|
|
|
|
echo -e "${YELLOW}Waiting for services to start (20s)...${NC}"
|
|
sleep 20
|
|
echo ""
|
|
|
|
echo -e "${BLUE}=== Health Checks ===${NC}"
|
|
echo ""
|
|
echo "Core (Hono + Bun):"
|
|
check_health "mana-auth" "http://localhost:3001/health"
|
|
check_health "mana-credits" "http://localhost:3061/health"
|
|
check_health "mana-user" "http://localhost:3062/health"
|
|
check_health "mana-subscriptions" "http://localhost:3063/health"
|
|
check_health "mana-analytics" "http://localhost:3064/health"
|
|
|
|
echo ""
|
|
echo "Go Services:"
|
|
check_health "mana-sync" "http://localhost:3050/health"
|
|
check_health "mana-search" "http://localhost:3021/health"
|
|
check_health "mana-api-gateway" "http://localhost:3060/health"
|
|
|
|
echo ""
|
|
echo "Infrastructure:"
|
|
check_health "PostgreSQL" "http://localhost:5432"
|
|
check_health "Redis" "http://localhost:6379"
|
|
check_health "MinIO" "http://localhost:9000/minio/health/live"
|
|
|
|
echo ""
|
|
echo -e "${GREEN}=== Deployment complete ===${NC}"
|
|
echo ""
|
|
echo "Useful commands:"
|
|
echo " ./scripts/mac-mini/deploy-v2.sh --status # Check health"
|
|
echo " docker compose -f docker-compose.macmini.yml logs -f mana-auth # View logs"
|
|
echo " docker compose -f docker-compose.macmini.yml restart mana-auth # Restart service"
|