lorentz
01ecfacd04
Uncommitted work-in-progress from 2026-07-08, carried forward: - audit-engine: refine two-pass metadata + content-inspection audit model - audit-matching, content-inspector, shape-audit-spec: supporting matching and spec updates for the two-pass model - task-audit route/panel: UI and API polish - add @napi-rs/canvas dependency, Dockerfile/next.config adjustments for it - test updates and additions (audit-engine, audit-decision-logic, run-task-audit) - add loose dev notes (clone runbook, issues implementation, overdue filter bug report, shared count helper plan)
51 lines
3.8 KiB
Markdown
51 lines
3.8 KiB
Markdown
# Horizon Dev-Clone Runbook — 2026-06-25
|
|
|
|
Stand up a development instance of Horizon on a **separate Linux host** that runs the
|
|
**latest (working-tree) code** against an **exact copy of live production data**.
|
|
|
|
- **Target host:** `root@dev02.nb.wulf.cloud`
|
|
- **Dev domain:** `https://horizon-dev.seubert.cloud`
|
|
- **Source of truth (code):** `/opt/projects/OnDeck/ondeck` (working tree, incl. uncommitted changes)
|
|
- **Source of truth (stack):** `/opt/stacks/horizon`
|
|
- **Prod DB:** container `horizon-db`, database `horizon`, user `horizon_user`
|
|
|
|
## Decisions (locked)
|
|
| Decision | Choice |
|
|
|---|---|
|
|
| Where dev runs | Separate host `dev02.nb.wulf.cloud`, executed hands-on this session |
|
|
| Code version | Working tree as-is (includes uncommitted automation-settings / sync changes) |
|
|
| Auth | Entra (Azure AD) SSO — dev redirect URI added to app `f6c778cf-c850-47d0-85e7-aff1d1c3288b` |
|
|
| Data | Exact `pg_dump` restore of live `horizon` DB (real client PII on dev box) |
|
|
| Routing/TLS | New Pangolin **site** = `newt` client on dev host + resource for the dev domain |
|
|
|
|
## Target architecture
|
|
| Concern | Prod | Dev clone |
|
|
|---|---|---|
|
|
| App container | `horizon-app` :3000 | `horizon-dev-app` :3000 |
|
|
| DB container | `horizon-db` | `horizon-dev-db` (fresh volume) |
|
|
| Backup sidecar | `horizon-backup` | optional / off initially |
|
|
| Domain | `horizon.seubert.cloud` | `horizon-dev.seubert.cloud` |
|
|
| Routing | Pangolin via `newt` | new Pangolin site (`newt` on dev host) + resource |
|
|
| Auth | Entra SSO | Entra SSO + dev redirect URI |
|
|
| Secrets | prod | regenerated `NEXTAUTH_SECRET`, `DB_PASSWORD` |
|
|
|
|
## Execution sequence
|
|
1. **Pre-flight (dev host):** Docker + compose v2 present; ≥ ~10 GB free on `/`; outbound 443 reachable (newt → Pangolin).
|
|
2. **Pangolin:** create a new site; install/run `newt` on the dev host; add resource `horizon-dev.seubert.cloud` → `http://horizon-dev-app:3000`; verify DNS + cert. (Use the `pangolin` skill.)
|
|
3. **Azure AD:** add redirect URI `https://horizon-dev.seubert.cloud/api/auth/callback/azure-ad` to Entra app `f6c778cf-c850-47d0-85e7-aff1d1c3288b`.
|
|
4. **Ship code:** rsync `/opt/projects/OnDeck/ondeck` → dev host, excluding `node_modules`, `.next`, `.git`.
|
|
5. **Stack + env:** copy `/opt/stacks/horizon`; rename containers to `horizon-dev-*`; set `NEXTAUTH_URL=https://horizon-dev.seubert.cloud`; regenerate `NEXTAUTH_SECRET` and `DB_PASSWORD`; keep Azure creds; keep **read-only** AFW/AMS creds; leave `GRAPH_*` unset.
|
|
6. **Data copy:** `pg_dump` live `horizon-db` → gzip → transfer → restore into freshly-initialized `horizon-dev-db`; then `prisma migrate deploy` (or `db push`) to reconcile schema with working-tree code.
|
|
7. **Build & start:** `docker compose up -d horizon-dev-db` (wait healthy) → restore dump → `docker compose build horizon-dev-app && docker compose up -d`.
|
|
8. **Smoke test:** health endpoint; Entra login; spot-check real client/policy/task data present.
|
|
|
|
## Safety guards (dev must not perturb prod or external systems)
|
|
- **No external cron trigger** wired on dev → `/api/cron/*` stays gated by `CRON_SECRET`, nothing calls it (no auto-generated tasks / scheduled jobs firing).
|
|
- AFW/AMS uses **read-only** user `1100080_RO` → sync cannot mutate the AMS.
|
|
- `GRAPH_*` unset (as in prod) → no SharePoint/email writes.
|
|
- Dev `NEXTAUTH_SECRET` / `DB_PASSWORD` regenerated so dev secrets ≠ prod.
|
|
|
|
## Obligations / cleanup
|
|
- **PII:** dev box now holds a full copy of real client PII — ensure `dev02` is secured commensurately and the copy is removed when the dev instance is decommissioned.
|
|
- **Temp SSH key:** `claude-horizon-dev-clone-2026-06-25` added to `root@dev02:~/.ssh/authorized_keys`. Remove that line when finished.
|
|
- Consider a teardown step (drop dev DB volume, remove Pangolin resource + site, remove Azure redirect URI) when dev is no longer needed.
|