feat: dockerize dev stack and add first-run admin bootstrap

David commented

2026-05-04 05:29:09 +02:00

Owner

Dev stack in Docker:

Rename just dev-up to just dev to match the backup-manager convention; document the trailing-args pattern that goes to docker compose up.
Add mokosh-server service to compose.dev.yml. Builds from the dev Dockerfile, mounts source for live reload, depends on Infisical health, reaches the host PostgreSQL via host.docker.internal:host-gateway, and connects to Infisical inside the network as http://infisical:8080.
Publish the API on port 4301. Bind to the host's private LAN IP (br0/eth0) instead of 127.0.0.1. The just dev recipe discovers the IP at runtime with sys net | where name =~ 'eth0|br0' and writes MOKOSH_HOST_BIND_IP into .env. This keeps the port off the public internet on a VPS while still allowing sibling Docker containers on the host to connect.
Compose falls back to 127.0.0.1 for MOKOSH_HOST_BIND_IP when unset so just dev-down and just dev-clean parse cleanly before the first just dev.
Add DATABASE_URL_IN_CONTAINER, MOKOSH_PORT, JWT_SECRET, and ENCRYPTION_KEY to .env.dev with dev-only defaults.
Bump EXPOSE in the dev Dockerfile from 8080 to 4301 to match.

First-run admin bootstrap:

New src/modules/auth/bootstrap.rs. When both ADMIN_EMAIL and ADMIN_PASSWORD are set AND the users table is empty, the server creates a super_admin user under the default tenant on startup, marks it active with email_verified_at = NOW(), and hashes the password with the existing Argon2id helper. Once any user exists the env vars are ignored, so it is safe to leave them in place during development.
Mirrors the ADMIN_USERNAME/ADMIN_PASSWORD pattern in vervain-server.
Wired into main.rs after migrations; bootstrap failures are logged-but-non-fatal so the server still starts.
.env.dev ships dev defaults (admin@example.com / devpassword12); .env.example documents the pattern with blank fields.

Docs:

New README.md covering architecture, prerequisites, quick start, configuration, recipes, Infisical bootstrap, admin bootstrap, migrations, Docker images, repo layout, releases. Nushell syntax throughout.

Signed-off-by: David Randall David@NiceGuyIT.biz

Dev stack in Docker: - Rename `just dev-up` to `just dev` to match the backup-manager convention; document the trailing-args pattern that goes to `docker compose up`. - Add `mokosh-server` service to `compose.dev.yml`. Builds from the dev `Dockerfile`, mounts source for live reload, depends on Infisical health, reaches the host PostgreSQL via `host.docker.internal:host-gateway`, and connects to Infisical inside the network as `http://infisical:8080`. - Publish the API on port `4301`. Bind to the host's private LAN IP (br0/eth0) instead of `127.0.0.1`. The `just dev` recipe discovers the IP at runtime with `sys net | where name =~ 'eth0|br0'` and writes `MOKOSH_HOST_BIND_IP` into `.env`. This keeps the port off the public internet on a VPS while still allowing sibling Docker containers on the host to connect. - Compose falls back to `127.0.0.1` for `MOKOSH_HOST_BIND_IP` when unset so `just dev-down` and `just dev-clean` parse cleanly before the first `just dev`. - Add `DATABASE_URL_IN_CONTAINER`, `MOKOSH_PORT`, `JWT_SECRET`, and `ENCRYPTION_KEY` to `.env.dev` with dev-only defaults. - Bump `EXPOSE` in the dev `Dockerfile` from 8080 to 4301 to match. First-run admin bootstrap: - New `src/modules/auth/bootstrap.rs`. When both `ADMIN_EMAIL` and `ADMIN_PASSWORD` are set AND the `users` table is empty, the server creates a `super_admin` user under the default tenant on startup, marks it `active` with `email_verified_at = NOW()`, and hashes the password with the existing Argon2id helper. Once any user exists the env vars are ignored, so it is safe to leave them in place during development. - Mirrors the `ADMIN_USERNAME`/`ADMIN_PASSWORD` pattern in `vervain-server`. - Wired into `main.rs` after migrations; bootstrap failures are logged-but-non-fatal so the server still starts. - `.env.dev` ships dev defaults (`admin@example.com` / `devpassword12`); `.env.example` documents the pattern with blank fields. Docs: - New `README.md` covering architecture, prerequisites, quick start, configuration, recipes, Infisical bootstrap, admin bootstrap, migrations, Docker images, repo layout, releases. Nushell syntax throughout. Signed-off-by: David Randall <David@NiceGuyIT.biz>

David added 1 commit

2026-05-04 05:29:09 +02:00

feat: dockerize dev stack and add first-run admin bootstrap

Create release / Create release from merged PR (pull_request) Has been cancelled

Details

95dc9f253f

Dev stack in Docker:
- Rename `just dev-up` to `just dev` to match the backup-manager convention; document the trailing-args pattern that goes to `docker compose up`.
- Add `mokosh-server` service to `compose.dev.yml`. Builds from the dev `Dockerfile`, mounts source for live reload, depends on Infisical health, reaches the host PostgreSQL via `host.docker.internal:host-gateway`, and connects to Infisical inside the network as `http://infisical:8080`.
- Publish the API on port `4301`. Bind to the host's private LAN IP (br0/eth0) instead of `127.0.0.1`. The `just dev` recipe discovers the IP at runtime with `sys net | where name =~ 'eth0|br0'` and writes `MOKOSH_HOST_BIND_IP` into `.env`. This keeps the port off the public internet on a VPS while still allowing sibling Docker containers on the host to connect.
- Compose falls back to `127.0.0.1` for `MOKOSH_HOST_BIND_IP` when unset so `just dev-down` and `just dev-clean` parse cleanly before the first `just dev`.
- Add `DATABASE_URL_IN_CONTAINER`, `MOKOSH_PORT`, `JWT_SECRET`, and `ENCRYPTION_KEY` to `.env.dev` with dev-only defaults.
- Bump `EXPOSE` in the dev `Dockerfile` from 8080 to 4301 to match.

First-run admin bootstrap:
- New `src/modules/auth/bootstrap.rs`. When both `ADMIN_EMAIL` and `ADMIN_PASSWORD` are set AND the `users` table is empty, the server creates a `super_admin` user under the default tenant on startup, marks it `active` with `email_verified_at = NOW()`, and hashes the password with the existing Argon2id helper. Once any user exists the env vars are ignored, so it is safe to leave them in place during development.
- Mirrors the `ADMIN_USERNAME`/`ADMIN_PASSWORD` pattern in `vervain-server`.
- Wired into `main.rs` after migrations; bootstrap failures are logged-but-non-fatal so the server still starts.
- `.env.dev` ships dev defaults (`admin@example.com` / `devpassword12`); `.env.example` documents the pattern with blank fields.

Docs:
- New `README.md` covering architecture, prerequisites, quick start, configuration, recipes, Infisical bootstrap, admin bootstrap, migrations, Docker images, repo layout, releases. Nushell syntax throughout.

Signed-off-by: David Randall <David@NiceGuyIT.biz>