Simon
f8a3cc4c47
## Description of the implemented changes The changes were: - [ ] Bugfixing - [x] New Feature - [ ] Breaking Change - [x] Refactoring **Seeds run only on first startup.** On every application start (e.g. `just run`, Docker entrypoint), seed scripts are still invoked, but they exit immediately when the admin user already exists. This avoids duplicate seed data (e.g. join requests), keeps startup fast after the first run, and works the same in dev and production. ## What has been changed? - **`lib/mv/release.ex`** - Added `bootstrap_seeds_applied?/0`: returns whether the admin user (from `ADMIN_EMAIL` or default `admin@localhost`) exists. We check the admin *user*, not the Admin *role*, so we do not skip when only migrations have run (migrations can create the Admin role for the system actor). - `run_seeds/0`: if `bootstrap_seeds_applied?()` is true, prints “Seeds already applied (admin user exists). Skipping.” and returns without running bootstrap or dev seeds; otherwise unchanged behaviour. - Module docs updated for the new function and the skip behaviour. - **`priv/repo/seeds.exs`** - Ensures the app is started (`Application.ensure_all_started(:mv)`). - If `Mv.Release.bootstrap_seeds_applied?()` is true, prints the same skip message and does not run bootstrap or dev seeds; otherwise runs as before (bootstrap + dev seeds in dev/test). - Comment at the top updated to describe the skip behaviour. - **Documentation** - `CODE_GUIDELINES.md` §1.2.1: seeds run on every start but exit early when already applied; mentions `bootstrap_seeds_applied?/0`. - `docs/admin-bootstrap-and-oidc-role-sync.md`: run_seeds skips when admin user exists; description of `run_seeds/0` updated. - `CHANGELOG.md` [Unreleased]: new “Seeds run only when needed” entry under Changed. ## Definition of Done ### Code Quality - [x] No new technical depths - [x] Linting passed - [x] Documentation is added where needed ### Accessibility - [x] New elements are properly defined with html-tags *(no new UI)* - [x] Colour contrast follows WCAG criteria *(no new UI)* - [x] Aria labels are added when needed *(no new UI)* - [x] Everything is accessible by keyboard *(no new UI)* - [x] Tab-Order is comprehensible *(no new UI)* - [x] All interactive elements have a visible focus *(no new UI)* ### Testing - [x] Tests for new code are written *(existing seeds and release tests cover behaviour; idempotency test still passes when second run skips)* - [x] All tests pass - [x] axe-core dev tools show no critical or major issues *(no UI changes)* ## Additional Notes - **Review focus:** Logic in `Mv.Release` and `priv/repo/seeds.exs`; the “already applied” check is a single DB read for the admin user. On failure (e.g. DB down), `bootstrap_seeds_applied?/0` returns `false`, so seeds run (safe for first deploy). - **Suggested check:** Run `mix test test/seeds_test.exs test/mv/release_test.exs` to confirm seeds and release behaviour. Reviewed-on: #475 Co-authored-by: Simon <s.thiessen@local-it.org> Co-committed-by: Simon <s.thiessen@local-it.org>
56 lines
2.3 KiB
Text
56 lines
2.3 KiB
Text
# Production Environment Variables for docker-compose.prod.yml
|
|
# Copy this file to .env and fill in the actual values
|
|
|
|
# Required: Phoenix secrets (generate with: mix phx.gen.secret)
|
|
SECRET_KEY_BASE=changeme-run-mix-phx.gen.secret
|
|
TOKEN_SIGNING_SECRET=changeme-run-mix-phx.gen.secret
|
|
|
|
# Required: Hostname for URL generation
|
|
PHX_HOST=localhost
|
|
|
|
# Recommended: Association settings
|
|
ASSOCIATION_NAME="Sportsclub XYZ"
|
|
|
|
# Optional: Admin user (created/updated on container start via Release.seed_admin)
|
|
# In production, set these so the first admin can log in. Change password without redeploy:
|
|
# bin/mv eval "Mv.Release.seed_admin()" (with new ADMIN_PASSWORD or ADMIN_PASSWORD_FILE)
|
|
# FORCE_SEEDS=true re-runs bootstrap seeds even when admin user exists (e.g. after changing roles/custom fields).
|
|
# ADMIN_EMAIL=admin@example.com
|
|
# ADMIN_PASSWORD=secure-password
|
|
# ADMIN_PASSWORD_FILE=/run/secrets/admin_password
|
|
|
|
# Optional: OIDC Configuration
|
|
# These have defaults in docker-compose.prod.yml, only override if needed
|
|
# OIDC_CLIENT_ID=mv
|
|
# OIDC_BASE_URL=http://localhost:8080/auth/v1
|
|
# OIDC_REDIRECT_URI=http://localhost:4001/auth/user/oidc/callback
|
|
# OIDC_CLIENT_SECRET=your-oidc-client-secret
|
|
|
|
# Optional: OIDC group → Admin role sync (e.g. Authentik groups from profile scope)
|
|
# If OIDC_ADMIN_GROUP_NAME is set, users in that group get Admin role on registration/sign-in.
|
|
# OIDC_GROUPS_CLAIM defaults to "groups" (JWT claim name for group list).
|
|
# OIDC_ADMIN_GROUP_NAME=admin
|
|
# OIDC_GROUPS_CLAIM=groups
|
|
|
|
# Optional: Show only OIDC sign-in on login page (hide password form).
|
|
# When set to true and OIDC is configured, users see only the Single Sign-On button.
|
|
# OIDC_ONLY=true
|
|
|
|
# Optional: Vereinfacht accounting integration (finance-contacts sync)
|
|
# If set, these override values from Settings UI; those fields become read-only.
|
|
# VEREINFACHT_API_URL=https://api.verein.visuel.dev/api/v1
|
|
# VEREINFACHT_API_KEY=your-api-key
|
|
# VEREINFACHT_CLUB_ID=2
|
|
# VEREINFACHT_APP_URL=https://app.verein.visuel.dev
|
|
|
|
# Optional: Mail / SMTP (transactional emails). If set, overrides Settings UI.
|
|
# Export current UI settings to .env: mix mv.export_smtp_to_env
|
|
# SMTP_HOST=smtp.example.com
|
|
# SMTP_PORT=587
|
|
# SMTP_USERNAME=user
|
|
# SMTP_PASSWORD=secret
|
|
# SMTP_PASSWORD_FILE=/run/secrets/smtp_password
|
|
# SMTP_SSL=tls
|
|
# SMTP_VERIFY_PEER=false
|
|
# MAIL_FROM_EMAIL=noreply@example.com
|
|
# MAIL_FROM_NAME=Mila
|