Files

Sam Rolfe 047af0f31d Phase 6b/7b: per-child decoded periods, separate brief blocks, idempotent calendar (AUD-119)

- Parse each child's own "Today" day widget for the timetable (FR-16); drop the
  school-wide week calendar's lesson grid and clean the leaked routine rows.
- Add the editable codes map (FR-17): subjects, rooms, teachers and period
  labels, seeded, an unknown code falls back to the raw code; `school codes` CLI.
- Brief: Finn's block first, then Harry's, four sections always present (FR-9);
  periods decoded into plain English; the undated tail is one counted line (FR-18).
- Calendar: write periods + work due + work overdue + major events, per child,
  on every pass. Identity is the stable per-item key, so a re-run never re-inserts
  (FR-8). morning-brief.sh now runs scan -> calendar push -> notify.
- Day-widget labels are 12-hour: 1-6 read as PM, fixing afternoon periods.

Proven live on .13: image 0.6.2-phase6b7b; both children's briefs decoded and
separate; 35 events in calendar.school; runs 2 and 3 of the scan added nothing.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-10-16 10:25:55 +11:00

4.9 KiB

Raw Blame History

Deployment — Compass / NHS (school.lab.audasmedia.com.au)

Own image, own container, own port 8792, host .13 (nixos-desktop). Caddy on .35 (sam-ubuntu1) terminates TLS and proxies to 192.168.20.13:8792.

Ports

Port	Service
8792	Compass / NHS (this project)

Host (.13)

Project folder: /home/sam/paseo/projects/compass_teams_nhs.
Data: the named volume compass-teams-nhs_compass-teams-nhs-data at /data (SQLite school.db).

Create the environment file from the example:

cd /home/sam/paseo/projects/compass_teams_nhs
cp environment.d/school-service.env.example environment.d/school-service.env
chmod 600 environment.d/school-service.env
# fill SCHOOL_SESSION_SECRET, SCHOOL_ADMIN_PASSWORD_HASH

Build and start:

docker compose up -d --build
docker compose ps          # compass-teams-nhs  Up (healthy)  0.0.0.0:8792->8792/tcp

Verify:
```
make verify-phase1
```

Caddy (.35)

SSH: ssh sam@192.168.20.35.
Append deploy/caddy/Caddyfile.snippet to /Docker/Containers/caddy/Caddyfile.

Validate and reload (never restart):

docker exec caddy caddy validate --config /etc/caddy/Caddyfile
docker exec caddy caddy reload   --config /etc/caddy/Caddyfile

Test: curl -sS -o /dev/null -w '%{http_code}\n' https://school.lab.audasmedia.com.au/health

Notes

.13 has every default Docker address pool subnetted out. This single-container service therefore uses network_mode: bridge and publishes 8792; it does not create a project network.
The env file is gitignored. School credentials and harness session state are secrets (AGENTS.md §10 rule 3); they never enter git.

Phase 7 — notifications (Apprise)

The morning briefs are delivered through the house Apprise API on .35:8210 (container apprise, host port 8210 → container 8000). Caddy exposes it at https://apprise.lab.audasmedia.com.au behind basic auth; the service talks to the API directly on the internal address.

Create (or reuse) the Apprise stored configuration that holds every destination, using these tags:

Tag Destination

harry_email, finn_email, joanna_email, sam_email email

harry_whatsapp, finn_whatsapp, joanna_whatsapp, sam_whatsapp WhatsApp (CallMeBot)

Tag	Destination
`harry_email`, `finn_email`, `joanna_email`, `sam_email`	email
`harry_whatsapp`, `finn_whatsapp`, `joanna_whatsapp`, `sam_whatsapp`	WhatsApp (CallMeBot)

Copy its key into environment.d/school-service.env as SCHOOL_APPRISE_KEY, and generate the n8n token:

docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.6.2-phase6b7b gen-secret
# -> SCHOOL_NOTIFY_TOKEN=<the value>

Restart the service, then prove the whole path without messaging anyone:

make preview                      # prints both boys + the combined brief
curl -s -X POST -H "Authorization: Bearer $SCHOOL_NOTIFY_TOKEN" \
     'http://127.0.0.1:8792/notify/morning?dry_run=1' | jq .

Send for real (this messages the family):

make notify                       # from the latest scan
make morning-brief                # scan both children, then send
docker exec compass-teams-nhs /app/school notify status

Schedule the 06:00 daily run in n8n (Phase 7a, AUD-115):
```
deploy/setup-n8n-scan-key.sh --apply      # restricted SSH key for the trigger
deploy/import-n8n-morning-brief.sh --apply # credential + workflow + publish + restart n8n
```
The workflow is Schedule Trigger -> SSH node -> a Code check that makes a non-zero exit red. The SSH node authenticates with the restricted key and runs scripts/morning-brief.sh on the host. (n8n 2.x disables the Execute Command node by default, so a command node cannot activate.) It needs no SCHOOL_NOTIFY_TOKEN in n8n — the host script reads the project env file. See docs/phase-7a-n8n-schedule.md for the design and the failure drill.

Notes:

The destination URLs (addresses, phone numbers, SMTP passwords) live only in the Apprise configuration. GET /json/urls/{key} prints callmebot:// for a WhatsApp entry because Apprise masks credentials in privacy mode; the entry is real, and the container log shows CallMeBot SUCCESS.
The scan stays a host step: patchright and its browser are on .13, not in the service image. scripts/morning-brief.sh runs the scan and the send in order.
A run that cannot deliver exits non-zero, and the endpoint answers 207, so a broken morning is visible in n8n instead of silent (FR-12).
The 06:00 schedule is the n8n workflow Compass / NHS — 6:00am morning brief (deploy/n8n-morning-brief.json), triggered over a restricted SSH key. It runs on the shared n8n service on .13. Sam approved plan revision 2 and the workflow was imported, published, and activated on 2026-10-16; the first automatic run is 06:00 on 2026-10-17. n8n 2.x disables the Execute Command node by default, so the workflow uses the SSH node plus a Code check that fails the run on a non-zero exit.

4.9 KiB Raw Blame History