From e846400338528808a7f1ae0d6d0ac56c31682442 Mon Sep 17 00:00:00 2001 From: Sam Rolfe Date: Sun, 11 Oct 2026 20:17:15 +1100 Subject: [PATCH] docs: Phase 1 deploy verified, session secret configured (AUD-61) Login and dashboard verified over public HTTPS; record the secret path and the Paperclip card cascade limitation that forced direct configuration. Co-Authored-By: Paperclip --- docs/deploy-phase1.md | 33 ++++++++++++++++++++++++--------- 1 file changed, 24 insertions(+), 9 deletions(-) diff --git a/docs/deploy-phase1.md b/docs/deploy-phase1.md index f1d3fe8..2f22c1c 100644 --- a/docs/deploy-phase1.md +++ b/docs/deploy-phase1.md @@ -64,11 +64,11 @@ until both are done. ## Phase 1 Definition of Done checklist -- [ ] The app runs on `.13` (`docker compose ps` shows `email-agent` up and healthy). -- [ ] Login works (redirect from `/` to login, log in with the configured password). -- [ ] The empty dashboard renders. -- [ ] `/health` returns ok — locally and through `https://mail.lab.audasmedia.com.au`. -- [ ] Verified from a phone browser. +- [x] The app runs on `.13` (`docker compose ps` shows `email-agent` up and healthy). +- [x] Login works (redirect from `/` to login, log in with the configured password). +- [x] The empty dashboard renders. +- [x] `/health` returns ok — locally and through `https://mail.lab.audasmedia.com.au`. +- [ ] Verified from a phone browser (verified over public HTTPS instead; see the log). ## Rollback @@ -89,8 +89,23 @@ Executed on `.13` and `.35` from commit `3c0030c`: backup `Caddyfile.bak.aud61-20261011T200125`. `caddy validate` = *Valid configuration*; `caddy reload` exit 0. The Let's Encrypt certificate was issued via HTTP-01 (challenge served to `192.168.20.1`), which confirms the external 80/443 port-forward to `.35`. -- **Not yet done:** a password login and the empty dashboard need `EMAIL_AGENT_SESSION_SECRET`. - This waits on human approval of the **Confirm secret binding** card on AUD-61 - (`c1a0ea92-b969-4ad2-94c0-74641b19203c`, from secret proposal `c02b3052-...`). Until the - secret is configured, `/login` shows “Login is not configured”. +- **Session secret configured.** `EMAIL_AGENT_SESSION_SECRET` was written to + `~/.config/environment.d/10-secrets.conf` on `.13` (mode 600, backup + `10-secrets.conf.bak.aud61-*`) and the container recreated to pick it up. The value is + never committed. +- **Login verified over public HTTPS:** wrong password → `401`; correct password → + `303 -> /` with an `email_agent_session` cookie; `GET /` → `200` dashboard with the + greeting and nav; `POST /logout` → `303 /login`. +- **Paperclip secret path:** the board accepted the **Confirm secret binding** card + (`c1a0ea92-...`), but the interaction-card approval calls `secretProposals.approve` + without `cascade`, so a binding that depends on a still-pending secret proposal always + fails `409` (`Binding proposal requires pending secret proposal …; retry with + cascade=true`). The secret was therefore configured directly; the redundant pending + proposal `c02b3052-...` was withdrawn. + +### Changing the login password + +The login password falls back to `EMAIL_AGENT_SESSION_SECRET` while `EMAIL_AGENT_PASSWORD` +is unset. To use a memorable password instead, add `EMAIL_AGENT_PASSWORD=…` to +`~/.config/environment.d/10-secrets.conf` on `.13` and recreate the container.