ray
50 lines
2.9 KiB
Markdown
50 lines
2.9 KiB
Markdown
# Phase 3 Server-Side Audit — Quick Check Recipe
|
|
|
|
Before starting any Phase 3 roadmap item, run this block to determine what's already live vs. what actually needs work. The roadmap's "NOT DONE" status is frequently stale — Phase 3.3/3.4 were fully deployed in prior sessions with no roadmap update.
|
|
|
|
## One-shot audit block
|
|
|
|
```bash
|
|
# 3.1 GlitchTip — does the stack exist?
|
|
ls /opt/glitchtip 2>/dev/null || echo "3.1: not installed"
|
|
|
|
# 3.2 PB SMTP/superadmin env vars — are any set?
|
|
docker inspect pocketbase --format '{{range .Config.Env}}{{println .}}{{end}}' 2>/dev/null | grep -iE 'SMTP|SUPERADMIN' || echo "3.2: no SMTP/superadmin env"
|
|
|
|
# 3.2 PB backup cron — is one installed?
|
|
crontab -l 2>/dev/null | grep -iE 'spq|pocketbase|pb_data' || echo "3.2: no pb backup cron"
|
|
|
|
# 3.3/3.4 nginx — is the server block serving the SPA + proxying /pb?
|
|
# (If both exist, 3.3/3.4 are DONE regardless of roadmap status)
|
|
cat /etc/nginx/sites-enabled/shopproquote 2>/dev/null | head -40
|
|
curl -sI https://shopproquote.graj-media.com/ | grep -iE 'HTTP/|content-security|x-frame'
|
|
|
|
# 3.5 Structured logging — json log format in nginx?
|
|
grep -l 'json_combined\|log_format.*json' /etc/nginx/nginx.conf 2>/dev/null && echo "3.5: has json format" || echo "3.5: no json format"
|
|
|
|
# 3.5 PB log rotation — driver + limits?
|
|
docker inspect pocketbase --format '{{.HostConfig.LogConfig.Type}} {{.HostConfig.LogConfig.Config}}' 2>/dev/null
|
|
# json-file with no max-size/max-file = no rotation (needs fixing)
|
|
|
|
# 3.6 Offline banner — does the component exist?
|
|
ls src/components/OfflineBanner.tsx 2>/dev/null && echo "3.6: file exists" || echo "3.6: missing"
|
|
|
|
# 3.7 Dependency audit
|
|
npm audit 2>&1 | head -3
|
|
```
|
|
|
|
## Interpretation
|
|
|
|
- **3.1** — Only needs work if `/opt/glitchtip` doesn't exist. If it does, check `docker compose ps` inside it.
|
|
- **3.2** — SMTP env vars and backup cron are both > APPROVAL REQUIRED (AGENTS.md). Never set passwords without asking.
|
|
- **3.3/3.4** — If the nginx site block exists and serves dist/ on 443 with `try_files ... /index.html` and a `/pb/` location, these are DONE. Do NOT re-implement from the roadmap spec.
|
|
- **3.5** — PB container always uses `json-file` driver by default, but without `max-size`/`max-file` opts there's no rotation. The fix is `docker update --log-driver json-file --log-opt max-size=10m --log-opt max-file=5 pocketbase` — needs go-ahead.
|
|
- **3.6** — Pure frontend, no approval needed. If the file exists and is wired in App.tsx, it's done.
|
|
- **3.7** — `npm audit` only. If 0 vulnerabilities, it's done. Minor patch updates don't need action.
|
|
|
|
## Approval rules (from AGENTS.md)
|
|
|
|
- **Do not** touch nginx config without explaining the exact change and getting go-ahead.
|
|
- **Do not** set or change passwords (PB superadmin, SMTP, GlitchTip DB) without explicit permission.
|
|
- **Do not** make PocketBase schema changes without confirming with the user.
|
|
- Frontend-only changes (3.6, 3.7) need no approval — just build/lint/test after. |