Files

Sam Rolfe 7b98e487c0 Phase 1: Compass/NHS skeleton (Go, SQLite, session login, Docker, Caddy)

Phase 1 of AGENTS.md §11: the app runs on .13 in its own container on port
8792, behind Caddy at school.lab.audasmedia.com.au, with its own session login
and GET /health.

- Go service (Go 1.25, modernc SQLite, no cgo) with its own image.
- SQLite schema per AGENTS.md §7: children, items, scans, notifications,
  session (internal/store/migrations/001_init.sql).
- Separate session login (signed cookie, CSRF double-submit), not SSO.
- HTMX server-rendered shell using the Family Home Lab tokens.css: canvas
  #f6f5f4, action blue #0075de, Inter, 8px grid, hairline borders, pill CTAs,
  dark mode, phone-friendly.
- Fail loudly (FR-12): a missing or failed scan shows as an explicit warning or
  error banner, never as an empty day.
- Dockerfile + docker-compose.yml (own container, own port 8792; uses
  network_mode bridge because .13 has no free default Docker address pool).
- Caddy snippet for .35 in deploy/caddy/, deployment notes, and
  deploy/verify-phase1.sh.

No school scan in this phase; the Compass login and fetch are Phase 2.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-10-15 13:21:20 +11:00

1.7 KiB

Raw Blame History

Deployment — Compass / NHS (school.lab.audasmedia.com.au)

Own image, own container, own port 8792, host .13 (nixos-desktop). Caddy on .35 (sam-ubuntu1) terminates TLS and proxies to 192.168.20.13:8792.

Ports

Port	Service
8792	Compass / NHS (this project)

Host (.13)

Project folder: /home/sam/paseo/projects/compass_teams_nhs.
Data: the named volume compass-teams-nhs_compass-teams-nhs-data at /data (SQLite school.db).

Create the environment file from the example:

cd /home/sam/paseo/projects/compass_teams_nhs
cp environment.d/school-service.env.example environment.d/school-service.env
chmod 600 environment.d/school-service.env
# fill SCHOOL_SESSION_SECRET, SCHOOL_ADMIN_PASSWORD_HASH

Build and start:

docker compose up -d --build
docker compose ps          # compass-teams-nhs  Up (healthy)  0.0.0.0:8792->8792/tcp

Verify:
```
make verify-phase1
```

Caddy (.35)

SSH: ssh sam@192.168.20.35.
Append deploy/caddy/Caddyfile.snippet to /Docker/Containers/caddy/Caddyfile.

Validate and reload (never restart):

docker exec caddy caddy validate --config /etc/caddy/Caddyfile
docker exec caddy caddy reload   --config /etc/caddy/Caddyfile

Test: curl -sS -o /dev/null -w '%{http_code}\n' https://school.lab.audasmedia.com.au/health

Notes

.13 has every default Docker address pool subnetted out. This single-container service therefore uses network_mode: bridge and publishes 8792; it does not create a project network.
The env file is gitignored. School credentials and harness session state are secrets (AGENTS.md §10 rule 3); they never enter git.

1.7 KiB Raw Blame History