where_woof/openspec/changes/deploy-admin/design.md

Context

Phase 4 built the admin (Docker Laravel + Filament on .27:3030). Phase 7 deployed the frontend to .13 (systemd service, port 3020, firewall opened). The Caddy block for admin.where-woof.com → .13:3030 has been on .35 since Phase 7, and the user has now added the admin + www.admin A records. Phase 8 replicates the dev Docker setup on .13.

Goals / Non-Goals

Goals:

• Admin live on .13:3030 via the same Docker pattern as dev.
• Connects to the shared Postgres (already on .13 — localhost:5434 from .13).
• admin.where-woof.com reachable through Caddy once DNS propagates.

Non-Goals:

• New features (Phase 5+).
• HTTPS specifics (Caddy handles; cert issuance will work once the A record propagates — until then Caddy logs cert errors but serves HTTP).

Decisions

1. Replicate the .27 Docker setup on .13 — copy admin/Dockerfile + docker-compose.yml + app/ (source only) to /home/sam/Docker/Containers/wherewoof-admin/ on .13 (the established Docker location there — wherewoof-db, omniroute etc.). Build the image on .13 (php:8.3-cli + pdo_pgsql/intl/gd/zip — same Dockerfile), composer install via the container.
2. .env on .13: DB_HOST=192.168.20.13 DB_PORT=5434 (the published port is LAN-reachable — proven from .27); APP_KEY generated on .13; SESSION_DRIVER=file. Secrets stay out of the repo.
3. No re-seed: the admin user lives in the shared DB and is already there.
4. Firewall: .13 needs networking.firewall.allowedTCPPorts = [3030] added (same as 3020) — user NixOS step, flagged.
5. Restart policy: compose restart: unless-stopped (unlike dev) so it survives reboots.

Risks / Trade-offs

• [Image build time on .13] → one-time; Docker layer cache after.
• [DNS not yet propagated] → cert issuance for admin.where-woof.com may fail initially (Caddy logs it); it auto-retries — non-blocking.
• [Same DB, two admin instances (dev + live)] → fine; both read/write the shared DB; only the live one is public.

Migration Plan

1. rsync admin source → .13 (exclude vendor/node_modules/.env/storage logs).
2. Build image + composer install on .13.
3. Write .env + docker compose up -d (port 3030, restart unless-stopped).
4. Verify localhost:3030 on .13; firewall 3030 (user); then Caddy path once DNS propagates.

Open Questions

• None blocking.