Sam Rolfe
09639c5125
The morning briefs go out through the house Apprise API on `.35:8210`: one brief per boy and one combined brief to Jo and Sam (FR-9, FR-14). The service names an Apprise tag (`harry_email`, `joanna_whatsapp`, ...) and never holds an address, a phone number or an SMTP password (AGENTS.md §10 rule 3). - internal/apprise: keyed and stateless client, tag filtering, and error redaction so nothing sensitive reaches a log, a row or a screen. - internal/brief: builds the per-boy and the combined brief, delivers on email and WhatsApp, records every attempt in `notifications` (migration 004 adds scope, channel, tag, ok and error) and fails loudly. - Send panel (§5 screen 4): recipients, channels, an exact preview, Send now, plus the Send action on a stored draft (FR-10). The dashboard shows a Morning briefs banner and the Sends list. - POST /notify/morning: the bearer-token endpoint the 6:00am n8n schedule calls. 207 when a channel or a scan failed; `dry_run=1` checks the wiring without messaging the family. - scripts/morning-brief.sh: scan both children, then send. It is the n8n job; deploy/n8n-morning-brief.json is the ready-to-import workflow (06:00 daily). - FR-12: a failed scan is never "nothing due" -- the brief says so, and the run exits non-zero. A failed delivery is recorded with no sent_at. - The long no-due-date tail is capped in the sent brief so it stays brief (§10 rule 6); overdue work is never capped. Verified live: 8 deliveries recorded (4 email, 4 WhatsApp) with HTTP 200 and sent_at, and the endpoint answers 401/200/207 as documented. Evidence in docs/phase-7-notify-notes.md. Co-Authored-By: Paperclip <noreply@paperclip.ing>
112 lines
3.9 KiB
Markdown
112 lines
3.9 KiB
Markdown
# Deployment — Compass / NHS (school.lab.audasmedia.com.au)
|
|
|
|
Own image, own container, own port **8792**, host `.13` (nixos-desktop). Caddy
|
|
on `.35` (sam-ubuntu1) terminates TLS and proxies to `192.168.20.13:8792`.
|
|
|
|
## Ports
|
|
|
|
| Port | Service |
|
|
|---|---|
|
|
| 8792 | Compass / NHS (this project) |
|
|
|
|
## Host (.13)
|
|
|
|
1. Project folder: `/home/sam/paseo/projects/compass_teams_nhs`.
|
|
2. Data: the named volume `compass-teams-nhs_compass-teams-nhs-data` at `/data`
|
|
(SQLite `school.db`).
|
|
3. Create the environment file from the example:
|
|
|
|
```bash
|
|
cd /home/sam/paseo/projects/compass_teams_nhs
|
|
cp environment.d/school-service.env.example environment.d/school-service.env
|
|
chmod 600 environment.d/school-service.env
|
|
# fill SCHOOL_SESSION_SECRET, SCHOOL_ADMIN_PASSWORD_HASH
|
|
```
|
|
|
|
4. Build and start:
|
|
|
|
```bash
|
|
docker compose up -d --build
|
|
docker compose ps # compass-teams-nhs Up (healthy) 0.0.0.0:8792->8792/tcp
|
|
```
|
|
|
|
5. Verify:
|
|
|
|
```bash
|
|
make verify-phase1
|
|
```
|
|
|
|
## Caddy (.35)
|
|
|
|
1. SSH: `ssh sam@192.168.20.35`.
|
|
2. Append `deploy/caddy/Caddyfile.snippet` to `/Docker/Containers/caddy/Caddyfile`.
|
|
3. Validate and reload (never restart):
|
|
|
|
```bash
|
|
docker exec caddy caddy validate --config /etc/caddy/Caddyfile
|
|
docker exec caddy caddy reload --config /etc/caddy/Caddyfile
|
|
```
|
|
|
|
4. Test: `curl -sS -o /dev/null -w '%{http_code}\n' https://school.lab.audasmedia.com.au/health`
|
|
|
|
## Notes
|
|
|
|
- `.13` has every default Docker address pool subnetted out. This single-container
|
|
service therefore uses `network_mode: bridge` and publishes 8792; it does not
|
|
create a project network.
|
|
- The env file is gitignored. School credentials and harness session state are
|
|
secrets (AGENTS.md §10 rule 3); they never enter git.
|
|
|
|
## Phase 7 — notifications (Apprise)
|
|
|
|
The morning briefs are delivered through the house **Apprise** API on `.35:8210`
|
|
(container `apprise`, host port 8210 → container 8000). Caddy exposes it at
|
|
`https://apprise.lab.audasmedia.com.au` behind basic auth; the service talks to
|
|
the API directly on the internal address.
|
|
|
|
1. Create (or reuse) the Apprise **stored configuration** that holds every
|
|
destination, using these tags:
|
|
|
|
| Tag | Destination |
|
|
|---|---|
|
|
| `harry_email`, `finn_email`, `joanna_email`, `sam_email` | email |
|
|
| `harry_whatsapp`, `finn_whatsapp`, `joanna_whatsapp`, `sam_whatsapp` | WhatsApp (CallMeBot) |
|
|
|
|
2. Copy its **key** into `environment.d/school-service.env` as
|
|
`SCHOOL_APPRISE_KEY`, and generate the n8n token:
|
|
|
|
```bash
|
|
docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.5.0-phase7 gen-secret
|
|
# -> SCHOOL_NOTIFY_TOKEN=<the value>
|
|
```
|
|
|
|
3. Restart the service, then prove the whole path without messaging anyone:
|
|
|
|
```bash
|
|
make preview # prints both boys + the combined brief
|
|
curl -s -X POST -H "Authorization: Bearer $SCHOOL_NOTIFY_TOKEN" \
|
|
'http://127.0.0.1:8792/notify/morning?dry_run=1' | jq .
|
|
```
|
|
|
|
4. Send for real (this messages the family):
|
|
|
|
```bash
|
|
make notify # from the latest scan
|
|
make morning-brief # scan both children, then send
|
|
docker exec compass-teams-nhs /app/school notify status
|
|
```
|
|
|
|
5. Import `deploy/n8n-morning-brief.json` in n8n, set `SCHOOL_NOTIFY_TOKEN` in
|
|
the n8n environment, and activate the workflow (06:00 daily, Australia/Melbourne).
|
|
|
|
Notes:
|
|
|
|
- The destination URLs (addresses, phone numbers, SMTP passwords) live only in
|
|
the Apprise configuration. `GET /json/urls/{key}` prints `callmebot://` for a
|
|
WhatsApp entry because Apprise masks credentials in privacy mode; the entry is
|
|
real, and the container log shows `CallMeBot SUCCESS`.
|
|
- The scan stays a host step: patchright and its browser are on `.13`, not in the
|
|
service image. `scripts/morning-brief.sh` runs the scan and the send in order.
|
|
- A run that cannot deliver exits non-zero, and the endpoint answers `207`, so a
|
|
broken morning is visible in n8n instead of silent (FR-12).
|