Initial PHP rebuild of the app
This commit is contained in:
690 files changed
+33944
-12046
No files matched your search
Executable
+99
@@ -0,0 +1,99 @@
|
||||
#!/usr/bin/env bash
|
||||
set -Eeuo pipefail
|
||||
|
||||
usage() {
|
||||
echo "Usage: $0 <business-slug> <domain> [image-tag] [business-name]" >&2
|
||||
echo "Example: $0 blake-heritage blakeheritage.com nextchair:2026-09-04 \"Blake Heritage\"" >&2
|
||||
exit 2
|
||||
}
|
||||
|
||||
[[ $# -ge 2 && $# -le 4 ]] || usage
|
||||
business_slug="$1"
|
||||
domain="$2"
|
||||
image_tag="${3:-nextchair:latest}"
|
||||
business_name="${4:-$business_slug}"
|
||||
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
stack_root="${NEXTCHAIR_STACK_ROOT:-${repo_root}/stacks}"
|
||||
infra_env="${NEXTCHAIR_INFRA_ENV:-${repo_root}/.env.infra}"
|
||||
stack_dir="${stack_root}/${business_slug}"
|
||||
compose_template="${repo_root}/deploy/business-compose.yaml.template"
|
||||
|
||||
[[ "$business_slug" =~ ^[a-z0-9]+([a-z0-9-]*[a-z0-9])?$ ]] || { echo "Invalid slug: use lowercase letters, numbers, and hyphens." >&2; exit 2; }
|
||||
[[ ${#business_slug} -le 22 ]] || { echo "Invalid slug: maximum length is 22 characters." >&2; exit 2; }
|
||||
[[ "$domain" =~ ^[A-Za-z0-9.-]+$ ]] || { echo "Invalid domain." >&2; exit 2; }
|
||||
[[ "$image_tag" =~ ^[A-Za-z0-9._/@:-]+$ ]] || { echo "Invalid image tag." >&2; exit 2; }
|
||||
[[ -f "$infra_env" ]] || { echo "Missing $infra_env. Copy .env.infra.example first." >&2; exit 1; }
|
||||
[[ -f "$compose_template" ]] || { echo "Missing $compose_template." >&2; exit 1; }
|
||||
[[ ! -e "$stack_dir" ]] || { echo "Stack already exists: $stack_dir" >&2; exit 1; }
|
||||
|
||||
# shellcheck disable=SC1090
|
||||
source "$infra_env"
|
||||
[[ -n "${MYSQL_ROOT_PASSWORD:-}" ]] || { echo "MYSQL_ROOT_PASSWORD is required in $infra_env." >&2; exit 1; }
|
||||
|
||||
database_name="nextchair_${business_slug//-/_}"
|
||||
database_user="$database_name"
|
||||
database_password="$(openssl rand -hex 24)"
|
||||
auth_secret="$(openssl rand -base64 48 | tr -d '\n')"
|
||||
installation_token="$(openssl rand -hex 32)"
|
||||
cron_secret="$(openssl rand -hex 32)"
|
||||
|
||||
docker network inspect nextchair-db >/dev/null 2>&1 || docker network create nextchair-db >/dev/null
|
||||
docker network inspect nextchair-proxy >/dev/null 2>&1 || docker network create nextchair-proxy >/dev/null
|
||||
docker inspect nextchair-mysql >/dev/null 2>&1 || { echo "nextchair-mysql is not running. Start stacks/infra/compose.yaml first." >&2; exit 1; }
|
||||
|
||||
printf 'Creating database %s...\n' "$database_name"
|
||||
sql="CREATE DATABASE IF NOT EXISTS \`$database_name\` CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci; CREATE USER IF NOT EXISTS '$database_user'@'%' IDENTIFIED BY '$database_password'; ALTER USER '$database_user'@'%' IDENTIFIED BY '$database_password'; GRANT ALL PRIVILEGES ON \`$database_name\`.* TO '$database_user'@'%'; FLUSH PRIVILEGES;"
|
||||
printf '%s\n' "$sql" | docker exec -i nextchair-mysql mysql -uroot -p"$MYSQL_ROOT_PASSWORD"
|
||||
|
||||
mkdir -p "$stack_dir"
|
||||
sed \
|
||||
-e "s|\${BUSINESS_SLUG}|$business_slug|g" \
|
||||
-e "s|\${NEXTCHAIR_IMAGE:-nextchair:latest}|$image_tag|g" \
|
||||
"$compose_template" > "$stack_dir/compose.yaml"
|
||||
cat > "$stack_dir/.env" <<EOF
|
||||
DOMAIN="$domain"
|
||||
DATABASE_HOST="nextchair-mysql"
|
||||
DATABASE_PORT=3306
|
||||
DATABASE_NAME="$database_name"
|
||||
DATABASE_USER="$database_user"
|
||||
DATABASE_PASSWORD="$database_password"
|
||||
DATABASE_CONNECTION_LIMIT=5
|
||||
DATABASE_CONNECT_TIMEOUT_MS=10000
|
||||
DATABASE_SSL=false
|
||||
AUTH_SECRET="$auth_secret"
|
||||
AUTH_TRUST_HOST=true
|
||||
NEXT_PUBLIC_APP_URL="https://$domain"
|
||||
INSTALLATION_TOKEN="$installation_token"
|
||||
CRON_SECRET="$cron_secret"
|
||||
NEXTCHAIR_IMAGE="$image_tag"
|
||||
EOF
|
||||
|
||||
caddy_sites_dir="${NEXTCHAIR_CADDY_SITES_DIR:-${stack_root}/caddy/sites}"
|
||||
mkdir -p "$caddy_sites_dir"
|
||||
cat > "$caddy_sites_dir/$business_slug.caddy" <<EOF
|
||||
$domain {
|
||||
reverse_proxy nextchair-$business_slug:3000
|
||||
}
|
||||
EOF
|
||||
|
||||
registry_file="$stack_root/registry.json"
|
||||
REGISTRY_FILE="$registry_file" BUSINESS_NAME="$business_name" BUSINESS_SLUG="$business_slug" BUSINESS_DOMAIN="$domain" BUSINESS_IMAGE="$image_tag" node <<'NODE'
|
||||
const fs = require("node:fs");
|
||||
const file = process.env.REGISTRY_FILE;
|
||||
const items = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, "utf8")) : [];
|
||||
const now = new Date().toISOString();
|
||||
items.push({
|
||||
name: process.env.BUSINESS_NAME,
|
||||
slug: process.env.BUSINESS_SLUG,
|
||||
domain: process.env.BUSINESS_DOMAIN,
|
||||
image: process.env.BUSINESS_IMAGE,
|
||||
createdAt: now,
|
||||
updatedAt: now,
|
||||
});
|
||||
fs.writeFileSync(file, `${JSON.stringify(items, null, 2)}\n`, { mode: 0o600 });
|
||||
NODE
|
||||
|
||||
chmod 600 "$stack_dir/.env"
|
||||
printf '\nCreated Dockge stack: %s\n' "$stack_dir"
|
||||
printf 'Created Caddy route: %s/%s.caddy\n' "$caddy_sites_dir" "$business_slug"
|
||||
printf 'Start it from Dockge, or run: docker compose -f %s up -d\n' "$stack_dir/compose.yaml"
|
||||
@@ -0,0 +1,83 @@
|
||||
/**
|
||||
* Idempotent Super Administrator provisioning, run on every container
|
||||
* start (see docker/entrypoint.sh) — NOT part of the installation wizard,
|
||||
* per the brief's explicit requirement that this account come from
|
||||
* environment variables. Safe to run repeatedly: re-hashes and syncs the
|
||||
* password/name from the env vars every run, so rotating
|
||||
* SUPER_ADMIN_PASSWORD and restarting the container is how you change it.
|
||||
*
|
||||
* Deliberately does NOT create a StaffProfile — that's what keeps the
|
||||
* Super Administrator out of the Team list, the customer-facing barber
|
||||
* picker, and off the Appointment.staffId foreign key entirely, by
|
||||
* construction rather than a filter. See src/lib/auth/permissions.ts
|
||||
* (hasPermission's isSuperAdmin short-circuit) and
|
||||
* src/lib/business/get-acting-business-context.ts.
|
||||
*
|
||||
* Uses relative imports (not the "@/..." alias) and constructs its own
|
||||
* PrismaClient, matching prisma/seed.ts — both scripts run under `tsx`
|
||||
* outside Next's own module resolution/bundling.
|
||||
*/
|
||||
import "dotenv/config";
|
||||
import bcrypt from "bcryptjs";
|
||||
import { PrismaClient } from "../generated/prisma/client";
|
||||
import { PrismaMariaDb } from "@prisma/adapter-mariadb";
|
||||
import { buildMysqlPoolConfig } from "../src/lib/db/mysql-pool-config";
|
||||
|
||||
const BCRYPT_COST = 12; // matches src/features/installation/installer.service.ts
|
||||
|
||||
async function main() {
|
||||
const email = process.env.SUPER_ADMIN_EMAIL?.trim().toLowerCase();
|
||||
if (!email) {
|
||||
console.log("[ensure-super-admin] SUPER_ADMIN_EMAIL not set — skipping (no Super Administrator configured).");
|
||||
return;
|
||||
}
|
||||
|
||||
const password = process.env.SUPER_ADMIN_PASSWORD;
|
||||
if (!password || password.length < 8) {
|
||||
console.error(
|
||||
"[ensure-super-admin] SUPER_ADMIN_EMAIL is set but SUPER_ADMIN_PASSWORD is missing or shorter than 8 characters. Refusing to provision a Super Administrator with no usable password.",
|
||||
);
|
||||
process.exitCode = 1;
|
||||
return;
|
||||
}
|
||||
|
||||
const firstName = process.env.SUPER_ADMIN_FIRST_NAME?.trim() ?? "";
|
||||
const lastName = process.env.SUPER_ADMIN_LAST_NAME?.trim() ?? "";
|
||||
const name = [firstName, lastName].filter(Boolean).join(" ") || null;
|
||||
|
||||
const adapter = new PrismaMariaDb(buildMysqlPoolConfig());
|
||||
const prisma = new PrismaClient({ adapter });
|
||||
|
||||
try {
|
||||
const passwordHash = await bcrypt.hash(password, BCRYPT_COST);
|
||||
const existing = await prisma.user.findUnique({ where: { email } });
|
||||
|
||||
if (existing && !existing.isSuperAdmin) {
|
||||
console.error(
|
||||
`[ensure-super-admin] A user with email ${email} already exists and is not a Super Administrator. Refusing to overwrite it — use a different SUPER_ADMIN_EMAIL or remove the conflicting account first.`,
|
||||
);
|
||||
process.exitCode = 1;
|
||||
return;
|
||||
}
|
||||
|
||||
if (existing) {
|
||||
await prisma.user.update({
|
||||
where: { id: existing.id },
|
||||
data: { name, passwordHash, emailVerified: existing.emailVerified ?? new Date() },
|
||||
});
|
||||
console.log(`[ensure-super-admin] Synced credentials for existing Super Administrator (${email}).`);
|
||||
} else {
|
||||
await prisma.user.create({
|
||||
data: { email, name, passwordHash, isSuperAdmin: true, emailVerified: new Date() },
|
||||
});
|
||||
console.log(`[ensure-super-admin] Created Super Administrator (${email}).`);
|
||||
}
|
||||
} finally {
|
||||
await prisma.$disconnect();
|
||||
}
|
||||
}
|
||||
|
||||
main().catch((error) => {
|
||||
console.error("[ensure-super-admin] Failed:", error);
|
||||
process.exitCode = 1;
|
||||
});
|
||||
Reference in new issue
Block a user