Sam Rolfe
7b98e487c0
Phase 1 of AGENTS.md §11: the app runs on .13 in its own container on port 8792, behind Caddy at school.lab.audasmedia.com.au, with its own session login and GET /health. - Go service (Go 1.25, modernc SQLite, no cgo) with its own image. - SQLite schema per AGENTS.md §7: children, items, scans, notifications, session (internal/store/migrations/001_init.sql). - Separate session login (signed cookie, CSRF double-submit), not SSO. - HTMX server-rendered shell using the Family Home Lab tokens.css: canvas #f6f5f4, action blue #0075de, Inter, 8px grid, hairline borders, pill CTAs, dark mode, phone-friendly. - Fail loudly (FR-12): a missing or failed scan shows as an explicit warning or error banner, never as an empty day. - Dockerfile + docker-compose.yml (own container, own port 8792; uses network_mode bridge because .13 has no free default Docker address pool). - Caddy snippet for .35 in deploy/caddy/, deployment notes, and deploy/verify-phase1.sh. No school scan in this phase; the Compass login and fetch are Phase 2. Co-Authored-By: Paperclip <noreply@paperclip.ing>
Compass / NHS
A school service for Harry and Finn: Compass for the daily schedule and notices, Teams for homework and assignments. It stores what is due per child, puts overdue work first, and tells the family before work is late.
Build spec:
AGENTS.md. This repository is at Phase 1 (the skeleton). See §11 of the spec for the phase order.
Status — Phase 1
Built and deployed on .13:
- Go service, SQLite schema for
children,items,scans,notifications,session(internal/store/migrations/001_init.sql). - The service's own session login — a signed cookie, not SSO.
- Server-rendered HTMX shell using the Family Home Lab design tokens
(
internal/web/static/tokens.css), phone-friendly with dark mode. GET /health.- Its own container and port 8792, behind Caddy at
school.lab.audasmedia.com.au.
Not built yet (later phases): the Compass login and fetch, parsing, both children's data, the dashboard data, the calendar write, notifications, and the Hub API. It does not scan the school in this phase.
Fail loudly (FR-12)
A missing or failed scan is shown as an explicit warning or error, never as an
empty day. The dashboard reads the scans table and shows one of:
- NO SCAN HAS RUN YET — amber banner.
- SCAN FAILED — red banner with the failure on record.
- Last scan completed — green banner.
Layout
cmd/school/ service entry point
internal/config/ environment configuration
internal/store/ SQLite: schema, migrations, queries
internal/auth/ session login (signed cookies, CSRF)
internal/web/ HTTP handlers, templates, static assets
deploy/ Caddy snippet, deployment notes, verify script
environment.d/ env example (the real file is gitignored)
Run
cp environment.d/school-service.env.example environment.d/school-service.env
chmod 600 environment.d/school-service.env # then fill in the secrets
docker compose up -d --build
Generate secrets with the built image:
docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.1.0-phase1 gen-secret
docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.1.0-phase1 hash-password 'the-password'
Note: Docker Compose interpolates $VAR inside env_file. A bcrypt hash
contains $, so escape each one as $$ in the env file.
Verify
make verify-phase1
It checks the container is healthy, GET /health returns 200, the login page
renders and a session login succeeds, and Caddy serves the public URL.
Rules
- Read-only against the school. Never post, message, or submit anything.
- A failed scan must be loud — never report an empty day as "nothing due".
- School credentials and harness session state are secrets; never commit them.
- This project has its own folder, container, and port.