Audit fixes: VIP self-grant, draft leak, onboarding flag, hero personalization, gated downloads

2026-10-09 16:20:55 +03:00
parent c34611dc36
commit 5ee706ebd6
150 changed files with 24054 additions and 0 deletions
@@ -0,0 +1,48 @@
+services:
+  db:
+    image: postgres:16
+    restart: unless-stopped
+    # Expose to the LAN so local dev (web/.env DATABASE_URI) can reach it.
+    ports:
+      - "5432:5432"
+    environment:
+      POSTGRES_USER: anwarpi
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_DB: anwarpi
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U anwarpi -d anwarpi"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  web:
+    build:
+      context: .
+      args:
+        NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL}
+    restart: unless-stopped
+    ports:
+      - "3000:3000"
+    volumes:
+      - media-uploads:/app/media
+      - files-uploads:/app/files-private
+    environment:
+      DATABASE_URI: postgres://anwarpi:${DB_PASSWORD}@db:5432/anwarpi
+      PAYLOAD_SECRET: ${PAYLOAD_SECRET}
+      AGENT_API_KEY: ${AGENT_API_KEY}
+      NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL}
+      # --- Stripe (pending mode until these are set) ---
+      # STRIPE_SECRET_KEY: sk_test_...
+      # STRIPE_PUBLISHABLE_KEY: pk_test_...
+      # STRIPE_PRICE_ID: price_...
+      # STRIPE_WEBHOOK_SECRET: whsec_...
+    depends_on:
+      db:
+        condition: service_healthy
+
+volumes:
+  db-data:
+  media-uploads:
+  files-uploads: