5 Commits

Include renames

Author	SHA1	Message	Date
mrhid6andClaude Opus 5	372a8c5ddf	feat(admin): lapse sweep and the four renewal notices ... Hourly sweep marks expired Free instances lapsed and sends at most one notice per instance per pass, most urgent first, recorded on the document so a restart cannot re-send. Deletion warnings are suppressed when the reaper is off. Promising a deletion that will never happen is a lie, and a scarier one than silence. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-26 13:20:00 +01:00
mrhid6andClaude Opus 5	983655d2a1	feat(admin): cloudprov, the instance provisioning write path ... Admin's second and final write path into the control plane. It creates instances and users and nothing else; inject still owns exactly three licence fields and is untouched. The owner's password hash is copied from the HQ account, not shared. The two diverge on the next password change, which is accepted: propagating a hash across two databases is worse than two passwords that started equal. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-26 13:14:12 +01:00
mrhid6andClaude Opus 5	4bb7400b8e	feat(admin): session probe, self-hosted signup and the relink cap ... Adds GET /auth/me so the admin site's route guards can know who is signed in, POST /auth/signup for self-hosted customers, and max_relinks on the account payload so the UI never hardcodes a rule the backend enforces. Signup follows sitesvc's proven shape: honeypot answered as success, a generic 201 when the address already exists, and nothing usable until the emailed link is opened. Also fixes a lockout found while verifying it. When the verification email failed, the account was rolled back but the customer_users row survived -- an orphan that can never be signed in to and that holds the unique index on email, so every later signup with that address got a cheerful 201 and the customer was locked out of their own address with no visible error. CreateCustomerUser now undoes its own insert. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 20:48:09 +01:00
mrhid6andClaude Opus 5	58c37bf81b	feat(admin): support authenticated Redis, and point at the external server ... Adds REDIS_USERNAME and REDIS_PASSWORD. Both are optional, so an unauthenticated instance still works unchanged. Redis 6+ ACL auth takes both; a legacy requirepass instance takes the password with an empty username, which is what go-redis needs to send single-argument AUTH. Admin now defaults to the external Redis at 10.10.10.2:6379 rather than the compose-local one, and no longer declares depends_on: redis -- it is not starting that container any more. The base stack keeps its own Redis for `server`, which still has no auth support. Also fixes SMTP_PASSWORD in the admin block: it read `$SMTP_PASSWORD:-}` rather than `${SMTP_PASSWORD:-}`, which appended a literal `:-}` to the password and would have failed SMTP auth at the first verification email. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 19:50:19 +01:00
mrhid6andClaude Opus 5	64eac6dbc7	feat(admin): module skeleton, config and two database connections ... Adds the admin module: env config with fail-fast validation, two MongoDB connections (its own vantage_admin database plus a narrow path into the control plane), the boot sequence and the image. Config refuses to start without a signing key, and both Mongo URIs must name their database inline -- admin talks to two databases, so a bare MONGO_DB would be ambiguous about which. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 18:58:44 +01:00