Commit Graph

4 Commits

Author SHA1 Message Date
type-two
5ebb997978 security(pii): keep customer SQL dumps out of git and the Docker image
customers.sql (610KB phpMyAdmin dump: wp_rmp_users password hashes + real
customer names/emails/phones/addresses) sat untracked but matched NEITHER
.gitignore NOR .dockerignore, and Dockerfile does COPY . . — so it was one
'git add .' from history and already bakeable into the public image.

- .gitignore:  customers*.sql  (schema.sql stays tracked)
- .dockerignore: *.sql  (startup DDL is inline in app/main.py; no .sql needed at runtime)

Working-tree customers.sql shredded. site-update.sql was already gitignored;
now dockerignored too.

NOTE: rebuild+redeploy the image to purge copies already baked into layers.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-05 02:04:45 +10:00
type-two
9e3c132a11 chore(security): purge distro raw dumps (supplier PII + account JWT) from git + image
The RareWaves/Inertia scrapes (rarw*.txt, inertia.txt, the SOH .xlsx) were tracked
in git AND baked into the Docker image (COPY . . with no exclusion). They carry a live
RareWaves buyer JWT and a supplier contact email — they don't belong in either.

- git rm --cached the 7 dumps; moved to local-only ingest_raw/
- .gitignore + .dockerignore: ingest_raw/, rarw*.txt, inertia.txt, *.xlsx
- nothing reads them by path (the xlsx ingest takes a base64 upload), so no code change

NOTE: still present in history (ef37063, 926468a) — scrub separately if the JWT is live.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-30 15:15:43 +10:00
type-two
bc59cc1c4c fix(deploy): stop excluding webstore/ from the image — it broke the /store 3D mount
The earlier build-context trim (to drop the 916MB disc_images/) also excluded webstore/ (924K), so
/app/webstore was missing → main.py skipped the /store mount → every 'Virtual store / 3D store' link
404'd. Only disc_images/ (volume-mounted) is worth excluding. Repo .dockerignore now matches the live
/opt/recordgod one; /store serves again.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-26 17:10:05 +10:00
9b8ecdb84d feat: deploy-ready — env-aware Discogs enrichment + Dockerfile
- app/mirror.py: centralised enrichment, DISCOGS_MIRROR_KIND selects full (ultra `release`)
  vs vps (`discogs_release`); virtual.py + wowplatter_v1.py use it.
- Dockerfile + .dockerignore for the VPS container.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-21 13:08:49 +10:00