hermes-config/skills/self-hosting/shop-pro-quote/references/phase3-server-audit.md

Phase 3 Server-Side Audit — Quick Check Recipe

Before starting any Phase 3 roadmap item, run this block to determine what's already live vs. what actually needs work. The roadmap's "NOT DONE" status is frequently stale — Phase 3.3/3.4 were fully deployed in prior sessions with no roadmap update.

One-shot audit block

# 3.1 GlitchTip — does the stack exist?
ls /opt/glitchtip 2>/dev/null || echo "3.1: not installed"

# 3.2 PB SMTP/superadmin env vars — are any set?
docker inspect pocketbase --format '{{range .Config.Env}}{{println .}}{{end}}' 2>/dev/null | grep -iE 'SMTP|SUPERADMIN' || echo "3.2: no SMTP/superadmin env"

# 3.2 PB backup cron — is one installed?
crontab -l 2>/dev/null | grep -iE 'spq|pocketbase|pb_data' || echo "3.2: no pb backup cron"

# 3.3/3.4 nginx — is the server block serving the SPA + proxying /pb?
# (If both exist, 3.3/3.4 are DONE regardless of roadmap status)
cat /etc/nginx/sites-enabled/shopproquote 2>/dev/null | head -40
curl -sI https://shopproquote.graj-media.com/ | grep -iE 'HTTP/|content-security|x-frame'

# 3.5 Structured logging — json log format in nginx?
grep -l 'json_combined\|log_format.*json' /etc/nginx/nginx.conf 2>/dev/null && echo "3.5: has json format" || echo "3.5: no json format"

# 3.5 PB log rotation — driver + limits?
docker inspect pocketbase --format '{{.HostConfig.LogConfig.Type}} {{.HostConfig.LogConfig.Config}}' 2>/dev/null
# json-file with no max-size/max-file = no rotation (needs fixing)

# 3.6 Offline banner — does the component exist?
ls src/components/OfflineBanner.tsx 2>/dev/null && echo "3.6: file exists" || echo "3.6: missing"

# 3.7 Dependency audit
npm audit 2>&1 | head -3

Interpretation

• 3.1 — Only needs work if /opt/glitchtip doesn't exist. If it does, check docker compose ps inside it.
• 3.2 — SMTP env vars and backup cron are both > APPROVAL REQUIRED (AGENTS.md). Never set passwords without asking.
• 3.3/3.4 — If the nginx site block exists and serves dist/ on 443 with try_files ... /index.html and a /pb/ location, these are DONE. Do NOT re-implement from the roadmap spec.
• 3.5 — PB container always uses json-file driver by default, but without max-size/max-file opts there's no rotation. The fix is docker update --log-driver json-file --log-opt max-size=10m --log-opt max-file=5 pocketbase — needs go-ahead.
• 3.6 — Pure frontend, no approval needed. If the file exists and is wired in App.tsx, it's done.
• 3.7 — npm audit only. If 0 vulnerabilities, it's done. Minor patch updates don't need action.

Approval rules (from AGENTS.md)

• Do not touch nginx config without explaining the exact change and getting go-ahead.
• Do not set or change passwords (PB superadmin, SMTP, GlitchTip DB) without explicit permission.
• Do not make PocketBase schema changes without confirming with the user.
• Frontend-only changes (3.6, 3.7) need no approval — just build/lint/test after.