diff --git a/CHANGELOG.md b/CHANGELOG.md index d561c7c..322f71d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,9 @@ +## 2026-10-06 (evening) — wger serves its styles and photos (R-762): a small file server, proven on the bench and on 9202 + +**What runs on a box changed:** wger's definition (wger stays `lifecycle: hidden`; no box runs it): `DJANGO_DEBUG=False` (the image's entrypoint then runs `collectstatic` at every start, as upstream's production `prod.env`), a named `wger_static` volume, and a new service `wger-files` (`nginx:1.30.5-alpine`, 32M) that serves `/static/` and `/media/` read-only from the shared volumes. Traefik sends only those two paths to it (a longer rule, so a higher priority); every box gate wraps every router of the stack, so it is gated like wger. No nginx config file: the stock config serves `/usr/share/nginx/html`, where the volumes are mounted. `mem_limit` 384M → 416M. The step is a DEFINITION step, written by `upgrade-test.py --write-ladder --to-definition` from both verdicts; the superseded definition is kept at `steps/9edf34a3d53837df.yml`. + +Proven: bench LXC 9401 (harness v5, 600 s watch: wger anon peak 50.3 %, wger-files 15.9 %, 0 kills, 0 restarts; the login page's own hashed CSS 200 from wger-files, the same file straight at wger 404); scratch 9202 (the guarded Update done in 59.4 s, the seed read back; a progress photo posted BEFORE the step answered 404 and 200 / 178 B / image/png after; the CSS links 404 before, 200 after; wger-files 7.6 MiB). Known cost: the collected static files are 283 MB in a named volume, so they ride along in every backup of wger. Not changed: wger still runs Django's `runserver` (R-755's fact, now carried by R-762). Onboarding record rows 1.7 and 2.8 done. + ## 2026-10-06 (evening) — the bench can test a step that adds a service (R-762 tooling) **What runs on a box changed:** nothing. Test tools only. diff --git a/onboarding/wger.md b/onboarding/wger.md index 132fe11..71063a0 100644 --- a/onboarding/wger.md +++ b/onboarding/wger.md @@ -28,7 +28,7 @@ Measured on 9202 2026-10-01 from the drill catalog (e9f50b5, wger template ident 1.4 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt ; felhom.eu/documentation/audits/more-night-apps-2026-09-30/box/wger/step.txt — `DJANGO_PERFORM_MIGRATIONS=True`; the 2.6 -> 2.7 step migrated and read back on the box 1.5 | open | the container runs `manage.py runserver` — `WGER_USE_GUNICORN` is not set (R-755; C2) 1.6 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — of 15 key-like env reads: SECRET_KEY generated, JWT pair made at start (phone route 200), DB password unused by SQLite; the rest belong to features off here (S3, mail, reCAPTCHA, OIDC, PowerSync) -1.7 | open | two entrypoint switches are still undecided: `WGER_USE_GUNICORN` (R-755) and `DJANGO_DEBUG` — unset, so `collectstatic` never runs (R-762; C2, C8) +1.7 | done | `DJANGO_DEBUG=False` (R-762, 2026-10-06): `collectstatic` runs at start; the static files are served by `wger-files` (nginx) — the login page's own CSS links 200 on the bench and on 9202 (`felhom.eu/documentation/audits/design-build-2026-10-06/F/`). `WGER_USE_GUNICORN` stays unset (R-755, closed) 1.8 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — DEBUG False; an unknown page is a plain 404, no debug page 1.9 | n/a | SECRET_KEY signs sessions and reset links only; the JWT pair lives on the data volume and is backed up with it 2.1 | open | re-sweep 2026-10-02 with the fixed gate (felhom.eu/documentation/audits/persistence-sweep-2026-10-02/A/sweep/TABLE.md): UNDETERMINED — /home/wger/media stays empty after the seed (no upload in the seed); nothing written outside a preserved folder (R-807). The August CLEAN came from start-time writes alone @@ -38,7 +38,7 @@ Measured on 9202 2026-10-01 from the drill catalog (e9f50b5, wger template ident 2.5 | open | no backup -> remove -> restore -> read back of wger: the box has no per-app backup press outside an Update (R-648) and wger has no newer step yet (R-759) 2.6 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C7-remove.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C8b-remove-with-data.txt — both choices delete both volumes; for a no-drive app "keep data" keeps only the backups (the page says the app stored no drive data) 2.7 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C4-seed-photo-size.txt — 4.2 MB + 16 KB after the seed -2.8 | open | an uploaded photo is saved (201, file on the volume) but answers 404 through the front door — nothing serves /media/ (R-762; C4, C8) +2.8 | done | a progress photo posted to the gallery reads back through the front door: 200, 178 B, image/png (404 before the step) — 9202, 2026-10-06 (R-762; `felhom.eu/documentation/audits/design-build-2026-10-06/F/box/step.txt`) 3.1 | done | felhom.eu/documentation/audits/login-gate-2026-09-29/D/D2-live.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — class 3, measured 3.2 | done | felhom.eu/documentation/audits/login-gate-2026-09-29/D/D2-live.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt — default refused, generated signs in, wrong refused 3.3 | n/a | class 3: a known default login, not an open first-run screen diff --git a/templates/wger/.felhom.yml b/templates/wger/.felhom.yml index 7d77027..5a8c89e 100644 --- a/templates/wger/.felhom.yml +++ b/templates/wger/.felhom.yml @@ -10,7 +10,7 @@ subdomain: "fitness" slug: "wger" # catalog_since: the date THIS repo last changed this app's pinned images. Any commit that # changes an image: line must set this to the same day (see CLAUDE.md). -catalog_since: "2026-09-30" +catalog_since: "2026-10-06" # Operator ruling 2026-10-01: HIDDEN until R-762 (no CSS/JS and no uploaded photo is served) and R-763 (a stranger can # sign up after the setup; anonymous visits create guest accounts) are fixed — the fix session un-hides it. Hidden = @@ -20,7 +20,7 @@ lifecycle: hidden # --- Resource hints (displayed on deploy screen) --- resources: mem_request: "100M" - mem_limit: "384M" + mem_limit: "416M" # wger 384 + wger-files 32 (R-762) pi_compatible: true needs_hdd: false @@ -145,3 +145,4 @@ i18n: # gated by scripts/check-test-record.py. An image: move without a proven entry here is refused. update_ladder: - {"from": {"wger": "wger/server:2.6"}, "to": {"wger": "wger/server:2.7"}, "digest": {"wger": "sha256:1c5789b93bfe5eed0b7287255782d9177027b255de2b22b59f511a693a48db04"}, "verdict": "proven", "tested_at": "2026-09-30T16:25:03Z", "harness_version": 4, "evidence": "felhom.eu/documentation/audits/more-night-apps-2026-09-30/bench/apps/wger/bench/evidence/MV-wger/verdict.json", "box_evidence": "felhom.eu/documentation/audits/more-night-apps-2026-09-30/box/wger/step.txt", "memory_peak_pct": 49.8, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "memory_basis": "anon", "memory_cgroup_peak_pct": 78.6} + - {"from": {"wger": "wger/server:2.7"}, "to": {"wger": "wger/server:2.7", "wger-files": "nginx:1.30.5-alpine"}, "digest": {"wger": "sha256:1c5789b93bfe5eed0b7287255782d9177027b255de2b22b59f511a693a48db04", "wger-files": "sha256:0985e772fb9f729e6fa0980da05fca5d9c468e870eed43071545afa9d2e27d94"}, "verdict": "proven", "tested_at": "2026-10-06T13:03:58Z", "harness_version": 5, "evidence": "felhom.eu/documentation/audits/design-build-2026-10-06/F/bench", "box_evidence": "felhom.eu/documentation/audits/design-build-2026-10-06/F/box", "memory_peak_pct": 50.3, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "memory_basis": "anon", "memory_cgroup_peak_pct": 100.0} diff --git a/templates/wger/docker-compose.yml b/templates/wger/docker-compose.yml index ac73e39..47a9fc6 100644 --- a/templates/wger/docker-compose.yml +++ b/templates/wger/docker-compose.yml @@ -78,9 +78,15 @@ services: - DJANGO_DB_HOST=localhost - DJANGO_DB_PORT=5432 - SITE_URL=https://${SUBDOMAIN}.${DOMAIN} + # R-762 (2026-10-06): production mode, as upstream's own prod.env (wger-project/docker config/prod.env). With + # DJANGO_DEBUG=False the image's entrypoint runs `collectstatic` at every start (entrypoint.sh:27) into + # /home/wger/static, and Django stops serving /static and /media itself (it never did in production — upstream + # puts nginx in front). wger-files below serves both from the shared volumes. + - DJANGO_DEBUG=False volumes: - wger_data:/home/wger/db - wger_media:/home/wger/media + - wger_static:/home/wger/static networks: - traefik-public deploy: @@ -101,9 +107,45 @@ services: - "traefik.http.routers.wger.tls.certresolver=letsencrypt" - "traefik.http.services.wger.loadbalancer.server.port=8000" + # R-762 (2026-10-06): the file server upstream's production compose puts in front of wger (its `nginx` service and + # config/nginx.conf: `location /static/ { alias /wger/static/; }`, `location /media/ { alias /wger/media/; }`). + # Here traefik is already the front door, so traefik sends ONLY /static/ and /media/ to this nginx and everything + # else to wger as before — no config file is needed: nginx's stock config serves /usr/share/nginx/html, and the two + # volumes are mounted there read-only. Every gate the box puts in front of the app wraps EVERY router of the stack + # (stacks/setup_gate.go, family_gate.go), so this router is gated exactly like wger's own. + wger-files: + image: nginx:1.30.5-alpine + container_name: wger-files + restart: unless-stopped + depends_on: + - wger + volumes: + - wger_static:/usr/share/nginx/html/static:ro + - wger_media:/usr/share/nginx/html/media:ro + networks: + - traefik-public + deploy: + resources: + limits: + memory: 32M + healthcheck: + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1/"] + interval: 30s + timeout: 5s + retries: 3 + start_period: 10s + labels: + - "traefik.enable=true" + - "traefik.http.routers.wger-files.rule=Host(`${SUBDOMAIN}.${DOMAIN}`) && (PathPrefix(`/static/`) || PathPrefix(`/media/`))" + - "traefik.http.routers.wger-files.entrypoints=websecure" + - "traefik.http.routers.wger-files.tls=true" + - "traefik.http.routers.wger-files.tls.certresolver=letsencrypt" + - "traefik.http.services.wger-files.loadbalancer.server.port=80" + volumes: wger_data: wger_media: + wger_static: networks: traefik-public: diff --git a/templates/wger/steps/9edf34a3d53837df.felhom.yml b/templates/wger/steps/9edf34a3d53837df.felhom.yml new file mode 100644 index 0000000..2feee6e --- /dev/null +++ b/templates/wger/steps/9edf34a3d53837df.felhom.yml @@ -0,0 +1,141 @@ +# ============================================================================= +# .felhom.yml - App metadata for felhom-controller +# ============================================================================= + +# --- Display info (shown on dashboard) --- +display_name: "wger" +description: "Edzésnapló és fitnesz tervező" +category: "home" +subdomain: "fitness" +slug: "wger" +# catalog_since: the date THIS repo last changed this app's pinned images. Any commit that +# changes an image: line must set this to the same day (see CLAUDE.md). +catalog_since: "2026-09-30" + +# Operator ruling 2026-10-01: HIDDEN until R-762 (no CSS/JS and no uploaded photo is served) and R-763 (a stranger can +# sign up after the setup; anonymous visits create guest accounts) are fixed — the fix session un-hides it. Hidden = +# not offered for new installs; an installed wger keeps working in full (none reported to the hub on 2026-09-30). +lifecycle: hidden + +# --- Resource hints (displayed on deploy screen) --- +resources: + mem_request: "100M" + mem_limit: "416M" # wger 384 + wger-files 32 (R-762) + pi_compatible: true + needs_hdd: false + +# --- Deploy fields (first deployment only) --- +deploy_fields: + - env_var: DOMAIN + label: "Domain" + type: domain + description: "A szerver domain neve" + locked_after_deploy: true + + - env_var: SUBDOMAIN + label: "Aldomain" + type: subdomain + default: "fitness" + required: true + locked_after_deploy: true + description: "Az alkalmazás aldomainje" + + - env_var: SECRET_KEY + label: "Titkosítási kulcs" + type: secret + generate: "hex:32" + locked_after_deploy: true + + # `09` §3 decision 45: wger starts with admin / adminadmin. The box replaces that password with this generated + # one right after the install (after_install below); the app page shows it as the first password. + - env_var: ADMIN_PASSWORD + label: "Admin jelszó (admin)" + type: password + generate: "password:24" + description: "Az első bejelentkezéshez: admin és ez a jelszó. Utána a beállításokban módosítható." + locked_after_deploy: true + +# --- App info (info page content) --- +app_info: + tagline: "Edzésnapló - edzéstervek, haladás követés és testsúly napló" + default_creds: "admin / adminadmin" + docs_url: "https://wger.readthedocs.io/" + + use_cases: + - 'Edzéstervek létrehozása és követése' + - 'Testsúly és testméretek nyilvántartása grafikonokkal' + - 'Gyakorlatok adatbázisa képekkel és leírásokkal' + - 'Kalória és tápanyag követés' + - 'API támogatás fitnesz alkalmazás integrációkhoz' + + first_steps: + - 'Nyisd meg a fitness.DOMAIN címet a böngészőben' + - 'Jelentkezz be: admin és a Beállítások oldalon látható első jelszó' + - 'Add meg az email címedet a beállításokban' + - 'Hozd létre az edzéstervedet' + - 'Kezdd el naplózni az edzéseidet' + + +# --- After a fresh install (controller >= 0.279.0, decision 45) --- +# Django's own set_password on the seeded admin. Measured on 9202 2026-09-29: afterwards adminadmin no longer signs in +# at /en/user/login, the new one does. +after_install: + service: wger + env: [ADMIN_PASSWORD] + # The password is the LAST ARGUMENT (sys.argv[1]), never pasted into the code: a quote in it cannot break or change + # the program (security review 2026-09-29). Django is set up the way manage.py does it (settings.main). + command: ["python3", "-c", "import os, sys; sys.path.insert(0, '/home/wger/src'); os.chdir('/home/wger/src'); os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'settings.main'); import django; django.setup(); from django.contrib.auth.models import User; u = User.objects.get(username='admin'); u.set_password(sys.argv[1]); u.save(); print('FELHOM_AFTER_INSTALL_OK')", "${ADMIN_PASSWORD}"] + success: "FELHOM_AFTER_INSTALL_OK" + +# --- App-email (password reset) through the box's mail relay; plaintext :2526 (see the compose comment, R-764) --- +smtp_mapping: + tls_mode: plaintext + host_var: EMAIL_HOST + port_var: EMAIL_PORT + from_var: FROM_EMAIL + from_local: wger + extra: + # The gate: wger reads the EMAIL_* group only when this is true (compose default False = mail off). + ENABLE_EMAIL: "True" + +# --- Controller-side health probe --- +healthcheck: + checks: + - type: http + # 8000, not 80: gunicorn listens on 8000 inside the container; 80 is only + # what traefik publishes. wger's own compose healthcheck dials 127.0.0.1:8000 (R-618). + port: 8000 + +# --- English copy (localisation slice 5, R-560) -------------------------------------------- +# The Hungarian above is UNCHANGED. A box on English reads this block field by field; a missing +# field shows the Hungarian one; a controller older than 0.257.0 ignores the block entirely. +i18n: + en: + description: 'A workout log and fitness planner' + app_info: + tagline: 'A workout log - training plans, progress and a weight diary' + default_creds: 'admin / adminadmin' + use_cases: + - 'Build training plans and follow them' + - 'Track your weight and measurements on a graph' + - 'An exercise database with pictures and descriptions' + - 'Track calories and nutrition' + - 'An API, for fitness app integrations' + first_steps: + - 'Open fitness.DOMAIN in your browser' + - 'Sign in: admin and the first password shown on the settings page' + - 'Add your e-mail address in the settings' + - 'Build your training plan' + - 'Start logging your workouts' + deploy_fields: + - env_var: DOMAIN + label: 'Domain' + description: 'The server domain name' + - env_var: SUBDOMAIN + label: 'Subdomain' + description: 'The subdomain this app answers on' + - env_var: SECRET_KEY + label: 'Encryption key' + - env_var: ADMIN_PASSWORD + label: 'Admin password (admin)' + description: 'For the first sign-in: admin and this password. Change it in the settings afterwards.' diff --git a/templates/wger/steps/9edf34a3d53837df.yml b/templates/wger/steps/9edf34a3d53837df.yml new file mode 100644 index 0000000..ac73e39 --- /dev/null +++ b/templates/wger/steps/9edf34a3d53837df.yml @@ -0,0 +1,110 @@ +# wger - Edzésnapló és fitnesz tervező +# Domain: ${SUBDOMAIN}.${DOMAIN} +# Database: None (file-based) +# RAM: ~100M (mem_limit: 384M) | Pi-compatible: Yes +# +# Environment variables: +# DOMAIN - Your domain (e.g., demo-felhom.eu) +# SECRET_KEY - Titkosítási kulcs (auto-generated) + +services: + wger: + image: wger/server:2.7 + container_name: wger + # R-737 (2026-09-30): wger's app login API (the mobile app's) signs JWTs with JWT_PRIVATE_KEY / JWT_PUBLIC_KEY — an + # RSA pair the deploy's generators cannot make, and without it a CORRECT password answered 500. So the pair is made + # ONCE by wger's own `manage.py generate-jwt-keys`, kept 0600 on wger's own data volume (a restore brings the same + # key back), and loaded before the image's own entrypoint. Never printed. + entrypoint: + - /bin/sh + - -c + - | + K=/home/wger/db/.felhom-jwt.env + if [ ! -s "$$K" ]; then + (cd /home/wger/src && python3 manage.py generate-jwt-keys 2>/dev/null) | grep -E '^JWT_(PRIVATE|PUBLIC)_KEY=' > "$$K.tmp" + if [ "$$(grep -c . "$$K.tmp")" = 2 ]; then mv "$$K.tmp" "$$K" && chmod 600 "$$K"; else rm -f "$$K.tmp"; echo "felhom: JWT keys could not be made" >&2; fi + fi + if [ -s "$$K" ]; then set -a; . "$$K"; set +a; fi + exec /home/wger/entrypoint.sh + restart: unless-stopped + environment: + - TZ=Europe/Budapest + - SECRET_KEY=${SECRET_KEY} + # A wger 2.4+ a TELJES DJANGO_DB_* halmazt beolvassa, akkor is, ha az + # engine sqlite -- enélkül indulás nélkül kilép ("Set the DJANGO_DB_USER + # environment variable"). Az USER/PASSWORD/HOST/PORT értékeket az sqlite + # backend figyelmen kívül hagyja, de jelen kell lenniük. + # A DATABASE a wger_data kötetre mutat (/home/wger/db), oda, ahol a wger + # saját alapértelmezett sqlite fájlja is volt -- így meglévő telepítés + # adatai nem "tűnnek el" egy másik útvonalra. + # R-712 (measured 2026-09-29 on 9202): behind traefik wger saw the request as http and refused a browser's + # https Origin with "CSRF verification failed" — nobody could sign in from a browser. + - CSRF_TRUSTED_ORIGINS=https://${SUBDOMAIN}.${DOMAIN} + - X_FORWARDED_PROTO_HEADER_SET=True + # R-738: the image runs `manage.py migrate` at start ONLY with this switch (entrypoint.sh). Without it an update + # that brings migrations leaves wger serving its front page over an unmigrated database (login 500). + - DJANGO_PERFORM_MIGRATIONS=True + # R-752 (decided by CC unattended 2026-10-01, `09` §3 decision 58 — operator may reverse): django-axes locked by + # ip_address, and behind the tunnel every visitor has the tunnel's address (R-753) — a stranger's 10 wrong tries + # locked out EVERY household member for 30 min. Now only the targeted name, for 5 min (each try during a lock + # restarts it — wger 2.7 hard-codes that — so short is kinder), counted in the database (the default cache + # handler warns axes.W001). Measured on 9202: the other member unaffected; the targeted one in again at 7.5 min. + - AXES_LOCKOUT_PARAMETERS=username + - AXES_COOLOFF_TIME=5 + - AXES_HANDLER=axes.handlers.database.AxesDatabaseHandler + # R-763 (2026-10-05): the image defaults both to True. After the install the admin exists (after_install sets its + # password), so nobody needs wger's own sign-up: a stranger could make an account through the front door, and every + # anonymous visit to the dashboard made a guest user row (wger's middleware create_temporary_user). Both read by + # settings/main.py as env.bool (wger 2.7 L179-180); the sign-up view then redirects to the features page. + - ALLOW_REGISTRATION=False + - ALLOW_GUEST_USERS=False + # R-764 (2026-10-05): mail through the box's relay (smtp_mapping in .felhom.yml, tls_mode plaintext -> :2526). + # wger 2.7 settings/main.py:162 reads the EMAIL_* group ONLY when ENABLE_EMAIL is true, and then env.str() with + # no default on EMAIL_HOST_USER / EMAIL_HOST_PASSWORD — so both stay defined-EMPTY here (the relay takes no + # login; an absent one would stop wger at start). ENABLE_EMAIL is the gate: False unless the mail toggle injects + # "True". EMAIL_USE_TLS False: Django's STARTTLS verifies the certificate and the relay's is self-signed. + - ENABLE_EMAIL=${ENABLE_EMAIL:-False} + - EMAIL_HOST=${EMAIL_HOST:-} + - EMAIL_PORT=${EMAIL_PORT:-2526} + - EMAIL_HOST_USER= + - EMAIL_HOST_PASSWORD= + - EMAIL_USE_TLS=False + - EMAIL_USE_SSL=False + - FROM_EMAIL=${FROM_EMAIL:-wger Workout Manager } + - DJANGO_DB_ENGINE=django.db.backends.sqlite3 + - DJANGO_DB_DATABASE=/home/wger/db/database.sqlite + - DJANGO_DB_USER=wger + - DJANGO_DB_PASSWORD=wger + - DJANGO_DB_HOST=localhost + - DJANGO_DB_PORT=5432 + - SITE_URL=https://${SUBDOMAIN}.${DOMAIN} + volumes: + - wger_data:/home/wger/db + - wger_media:/home/wger/media + networks: + - traefik-public + deploy: + resources: + limits: + memory: 384M + healthcheck: + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:8000"] + interval: 30s + timeout: 5s + retries: 3 + start_period: 30s + labels: + - "traefik.enable=true" + - "traefik.http.routers.wger.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)" + - "traefik.http.routers.wger.entrypoints=websecure" + - "traefik.http.routers.wger.tls=true" + - "traefik.http.routers.wger.tls.certresolver=letsencrypt" + - "traefik.http.services.wger.loadbalancer.server.port=8000" + +volumes: + wger_data: + wger_media: + +networks: + traefik-public: + external: true