# Where Woof — Toolchain

Everything used to build and run the project, with where it fits.

## Product stack (public site — "GOAT")

| Tool | Version | Used for |
|---|---|---|
| Go | 1.26 | Frontend: stdlib `net/http` (no framework), `html/template`, Go 1.22+ ServeMux routing |
| HTMX | 1.9.12 | Inline editing, account panel swaps, contact forms (no page reloads) |
| Alpine.js | 3.x | Live phone validation, small client behaviours |
| Tailwind CSS | CDN | Utility-first styling (swap to a build step in Phase 3 polish later) |
| Postgres | 16 | Single shared database (`wherewoof-db` on .13) |
| pgx | v5 | Postgres driver + pool for Go |
| sqlc | 1.31.1 | Type-safe query generation from SQL (compiled-checked queries) |
| gorilla/sessions | — | Signed cookie sessions |
| bcrypt | — | Password hashing |

## Admin stack

| Tool | Version | Used for |
|---|---|---|
| Laravel | 13 (PHP 8.3) | Admin backend; Eloquent reads the shared Postgres schema |
| Filament | v3 | Admin panel UI: CRUD resources (User/Tag/Product/Order), dashboard widgets |
| Livewire | (Filament dep) | Reactive admin pages |
| Docker | — | Laravel dev (.27:3030) + prod (.13:3031); Postgres container |

## Infrastructure & deployment

| Tool | Role |
|---|---|
| NixOS | .27/.13/.51 hosts; systemd user services; firewall via config |
| systemd | `where-woof.service` (frontend, auto-restart, linger) |
| Docker Compose | Postgres, admin, other services |
| Caddy | Reverse proxy + TLS on .35 (public domains) |
| Pi-hole | Local DNS (`.home.lab` domains) |
| rsync | Deploy artifacts to .13 |
| Gitea | Git hosting (`sam/where_woof`) |

## SMS

| Tool | Role |
|---|---|
| SMSGlobal HTTP API | Live SMS (`api.smsglobal.com/http-api.php`, action=sendsms) — verified number as sender |
| `internal/sms` (Go) | Swappable `Sender` interface: `LogSender` (dev), `HTTPClient` (live), `smsglobal` REST client (unused fallback) |

## Development workflow

| Tool | Role |
|---|---|
| OpenSpec | Spec-driven development: `openspec/changes/*` (proposal → design → specs → tasks), validated |
| plannotator | Plan review (browser UI) for the first two phases |
| pi subagents | Master/worker delegation: `database`, `coder-pro`, `code-analysis`, `devops` |
| Makefile | `db-up`, `seed`, `seed-registry`, `run`, `build`, `generate`, `psql` |
| Verify suites | `/tmp/verify.sh` (22 checks), `verify2.sh` (19), `verify3.sh` (12) — HTTP-level regression tests |

## Security tooling (guards package installs)

SafeDep Vet (`vet`), npq (typosquatting), Socket Firewall (`socket`) — the npm-security skill wraps installs.

## Notes / gotchas (hard-won)

- Filament v3: production 403 unless the User model implements `FilamentUser`.
- Behind Caddy, force `URL::forceScheme('https')` to avoid mixed-content asset blocks.
- sqlc: nullable columns → `pgtype.*`; explicit INSERT column lists must include new columns.
- NixOS: `CGO_ENABLED=0` for Go builds (no gcc); `make` via nix profile; `psql` via `docker exec`.
- Admin files created by Docker are root-owned — edit via `docker cp`.