openspec: deploy-admin change — Laravel admin to .13:3030

openspec/changes/deploy-admin/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-08-07

openspec/changes/deploy-admin/README.md

@@ -0,0 +1,3 @@
+# deploy-admin
+
+Deploy Laravel+Filament admin to .13:3030 (Docker, shared Postgres localhost); admin.where-woof.com via existing Caddy block

openspec/changes/deploy-admin/design.md

@@ -0,0 +1,39 @@
+## Context
+
+Phase 4 built the admin (Docker Laravel + Filament on .27:3030). Phase 7 deployed the frontend to .13 (systemd service, port 3020, firewall opened). The Caddy block for `admin.where-woof.com` → `.13:3030` has been on .35 since Phase 7, and the user has now added the `admin` + `www.admin` A records. Phase 8 replicates the dev Docker setup on .13.
+
+## Goals / Non-Goals
+
+**Goals:**
+- Admin live on .13:3030 via the same Docker pattern as dev.
+- Connects to the shared Postgres (already on .13 — `localhost:5434` from .13).
+- `admin.where-woof.com` reachable through Caddy once DNS propagates.
+
+**Non-Goals:**
+- New features (Phase 5+).
+- HTTPS specifics (Caddy handles; cert issuance will work once the A record propagates — until then Caddy logs cert errors but serves HTTP).
+
+## Decisions
+
+1. **Replicate the .27 Docker setup on .13** — copy `admin/Dockerfile` + `docker-compose.yml` + `app/` (source only) to `/home/sam/Docker/Containers/wherewoof-admin/` on .13 (the established Docker location there — wherewoof-db, omniroute etc.). Build the image on .13 (php:8.3-cli + pdo_pgsql/intl/gd/zip — same Dockerfile), `composer install` via the container.
+2. **`.env` on .13**: `DB_HOST=192.168.20.13` `DB_PORT=5434` (the published port is LAN-reachable — proven from .27); APP_KEY generated on .13; SESSION_DRIVER=file. Secrets stay out of the repo.
+3. **No re-seed**: the admin user lives in the shared DB and is already there.
+4. **Firewall**: `.13` needs `networking.firewall.allowedTCPPorts = [3030]` added (same as 3020) — user NixOS step, flagged.
+5. **Restart policy**: compose `restart: unless-stopped` (unlike dev) so it survives reboots.
+
+## Risks / Trade-offs
+
+- [Image build time on .13] → one-time; Docker layer cache after.
+- [DNS not yet propagated] → cert issuance for admin.where-woof.com may fail initially (Caddy logs it); it auto-retries — non-blocking.
+- [Same DB, two admin instances (dev + live)] → fine; both read/write the shared DB; only the live one is public.
+
+## Migration Plan
+
+1. rsync admin source → .13 (exclude vendor/node_modules/.env/storage logs).
+2. Build image + composer install on .13.
+3. Write .env + `docker compose up -d` (port 3030, restart unless-stopped).
+4. Verify localhost:3030 on .13; firewall 3030 (user); then Caddy path once DNS propagates.
+
+## Open Questions
+
+- None blocking.

openspec/changes/deploy-admin/proposal.md

@@ -0,0 +1,26 @@
+## Why
+
+The Laravel admin works in dev on .27:3030 (Phase 4). Phase 8 puts it **live on .13:3030** behind the existing `admin.where-woof.com` Caddy block (user has added the DNS A records). Same shared Postgres, running via the same Docker approach as dev — no code changes.
+
+## What Changes
+
+- **Deploy `admin/` to .13** (`/home/sam/Docker/Containers/wherewoof-admin/`): rsync source (exclude vendor/node_modules/.env), build the php:8.3 image on .13, `composer install` there, write `.env` pointing at the local Postgres (`192.168.20.13:5434`), `docker compose up -d` on **:3030**.
+- **Firewall**: port 3030 must be allowed on .13's NixOS firewall (same as 3020) — user step.
+- **Admin user**: already in the shared DB (`admin@where-woof.com`, is_admin) — no re-seed needed.
+- **Verify**: `localhost:3030` on .13 → 200; `admin.where-woof.com` via .35 Caddy once DNS propagates.
+
+## Capabilities
+
+### New Capabilities
+
+- `admin-live`: the Laravel admin runs on .13:3030 as a Docker service, reachable via `admin.where-woof.com` through Caddy.
+
+### Modified Capabilities
+
+<!-- none -->
+
+## Impact
+
+- **On .13**: `/home/sam/Docker/Containers/wherewoof-admin/` (Dockerfile, compose, app source), built image, port 3030.
+- **Repo**: no code changes; deploy docs updated.
+- Shared DB, users, tags all unchanged.

openspec/changes/deploy-admin/tasks.md

@@ -0,0 +1,19 @@
+## 1. Transfer & Build
+
+- [ ] 1.1 rsync `admin/Dockerfile`, `admin/docker-compose.yml`, `admin/app/` (exclude vendor, node_modules, .env, storage/logs) → `sam@192.168.20.13:/home/sam/Docker/Containers/wherewoof-admin/`
+- [ ] 1.2 On .13: `docker compose build` (php:8.3 image) + `composer install` via container
+
+## 2. Configure & Run
+
+- [ ] 2.1 Write `.env` on .13 (DB 192.168.20.13:5434, APP_KEY generated, SESSION_DRIVER=file); add `restart: unless-stopped` to compose
+- [ ] 2.2 `docker compose up -d` → verify `localhost:3030` on .13 returns 200 (login page)
+
+## 3. Caddy / Firewall
+
+- [ ] 3.1 User: open port 3030 on .13 NixOS firewall (networking.firewall.allowedTCPPorts = [3030])
+- [ ] 3.2 Verify `admin.where-woof.com` via .35 Caddy once DNS propagates (cert issuance retries automatically)
+
+## 4. Verification
+
+- [ ] 4.1 Smoke: admin login on .13 works (shared DB admin user); resources render
+- [ ] 4.2 `openspec validate deploy-admin`; commit