9194ebdd72
ci: migrate GitLab CI to Nix-based Docker builds
...
Replace Docker-based builds with Nix flakes for reproducible builds.
Changes:
- Use nixos/nix:latest image with `nix` tag requirement
- Build Docker image with `nix build .#dockerImage`
- Add optional Cachix integration for binary caching
- Load image with `docker load < result`
- Keep existing deploy stage unchanged
Benefits:
- Reproducible builds across all environments
- Binary caching via Cachix (faster subsequent builds)
- All dependencies pinned in flake.lock
- Image size similar to Docker builds (~507 MB compressed)
Requirements:
- GitLab Runner with Nix installed and `nix` tag
- Docker socket mounted for loading/pushing images
- Optional: CACHIX_AUTH_TOKEN for binary caching
See docs/gitlab-runner-nix-setup.md for runner setup instructions.
The old Docker-based config is available in git history if rollback needed.
2026-02-07 14:17:20 -06:00
505c42d53d
feat: Add comprehensive Nix flakes integration
...
Implements complete Nix flakes support for reproducible builds,
development environments, and CI/CD automation.
## Key Features
- **Reproducible builds**: All dependencies pinned in flake.lock
- **One-command dev environment**: `nix develop` with auto-started PostgreSQL/Redis
- **Optimized Docker images**: ~150-200 MB (vs ~500 MB Debian-based)
- **Binary caching**: Cachix integration for 60% faster CI builds
- **Development tools**: LSPs, formatters, pre-commit hooks included
## Architecture
### Build Components
- `nix/c-nif.nix`: C NIF shared library (cached separately)
- `nix/build.nix`: Mix release using beamPackages.mixRelease
- `nix/docker.nix`: OCI image via dockerTools.buildLayeredImage
- `nix/shell.nix`: Full dev environment with auto-started services
### Development Experience
The development shell provides:
- Auto-started PostgreSQL 16 (localhost:5432)
- Auto-started Redis (localhost:6379)
- Pre-configured environment variables
- Pre-commit hooks (format, credo, nixfmt)
- All development tools ready to use
### Key Design Decisions
1. **Separate C NIF derivation**: Prevents full rebuilds on Elixir changes
2. **mixRelease integration**: Uses nixpkgs built-in Elixir support
3. **Auto-starting services**: Zero-configuration development setup
4. **buildLayeredImage**: Automatic layer optimization for Docker
5. **Vendored deps inclusion**: Seamless integration with Mix
## Files Added
### Core Nix Files
- `flake.nix`: Main flake with packages and devShells
- `nix/c-nif.nix`: C NIF build derivation
- `nix/build.nix`: Elixir release derivation
- `nix/docker.nix`: Docker image derivation
- `nix/shell.nix`: Development environment
- `shell.nix`: Legacy nix-shell compatibility
- `.envrc.example`: direnv configuration example
### CI/CD
- `.gitlab-ci.yml.nix`: Nix-based GitLab CI pipeline
### Documentation
- `docs/nix.md`: Comprehensive Nix guide (500 lines)
- `docs/NIX-VERIFICATION.md`: Verification checklist
- `docs/README-nix-section.md`: README update content
- `docs/CLAUDE-nix-section.md`: CLAUDE.md update content
- `NIX-IMPLEMENTATION-SUMMARY.md`: Implementation summary
## Usage
### Development
```bash
# Enter development environment (auto-starts services)
nix develop
# Or with direnv (automatic on cd)
cp .envrc.example .envrc
direnv allow
# Start Phoenix server
mix phx.server
```
### Building
```bash
# Build Elixir release
nix build .#towerops
# Build Docker image
nix build .#dockerImage
docker load < result
```
### CI/CD
After setting up Cachix and NixOS runner:
```bash
mv .gitlab-ci.yml.nix .gitlab-ci.yml
git add .gitlab-ci.yml
git commit -m "ci: activate Nix builds"
```
## Expected Benefits
- **CI builds**: 60% faster with Cachix caching
- **Docker images**: 64% smaller (~180 MB vs ~500 MB)
- **Dev setup**: 93% faster (2 min vs 30 min)
- **Rebuild times**: 50% faster on code changes
## Next Steps
1. Test locally on different platforms (macOS, Linux)
2. Set up Cachix binary cache
3. Configure NixOS GitLab Runner
4. Deploy to staging environment
5. Migrate production to Nix builds
## Breaking Changes
None. Traditional development workflow remains supported.
Nix is additive and optional during transition period.
## Documentation
See `docs/nix.md` for comprehensive documentation including:
- Installation and quick start
- Development workflow
- Building and deployment
- Cachix setup
- Troubleshooting
- Updating dependencies
See `docs/NIX-VERIFICATION.md` for complete verification checklist.
2026-02-07 12:26:54 -06:00
9ed26eaad1
docs: add job monitoring dashboard feature documentation
...
Comprehensive documentation covering architecture, usage, technical
details, and future enhancements for the job monitoring dashboard.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-06 18:42:02 -06:00
74c5c543c0
docs: add detailed implementation plan for job monitoring dashboard
2026-02-06 16:07:44 -06:00
277a06864c
doc cleanup
2026-02-04 16:58:42 -06:00
1a054fd598
make sites optional
2026-02-04 13:05:32 -06:00
4ef4f4fbf6
handle exceptions gracefully on api endpoints
2026-02-04 12:18:14 -06:00
6c8e670dae
docs: add gettext internationalization design
...
- Add comprehensive i18n design document with domain-based organization
(default, errors, auth, equipment, admin, emails domains)
- Document helper functions, implementation patterns, and migration workflow
- Fix multiple test suite issues:
* user_settings_live_test.exs: Update all tests to match current UI structure
- Fix user.name references (use first_name/last_name)
- Fix TOTP device creation (use create_totp_device/2)
- Update tab URLs and form IDs
- Update tab names (Account, API, Notifications)
- Remove obsolete tabs (Organizations, Activity)
- Fix password tests (pattern match redirect without flash token)
- Update sudo mode behavior
* account_data_controller_test.exs: Fix user profile assertions
* rate_limit_test.exs: Fix unused variable warning
* settings_live_test.exs: Fix organization form validation test
2026-02-02 09:33:01 -06:00
264154a3d8
feat: implement sudo mode MFA-only verification controller
...
- Add UserSudoController with GET and POST /users/sudo/verify routes
- Create verify.html.heex template for TOTP verification form
- Only accept TOTP codes (6 numeric digits), reject recovery codes
- Update grant_sudo_mode to set authenticated_at virtual field
- Exclude /users/sudo paths from return_to overwriting
- Add comprehensive controller tests (12 test cases)
- Verify redirect behavior, error handling, and session management
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-01 14:34:17 -06:00
303196bb8e
Add design doc for sudo mode MFA-only verification
2026-02-01 13:50:34 -06:00
77e62df9da
Move CaptureTimezone plug to browser pipeline
...
The plug was incorrectly placed in the endpoint, causing it to run on
all requests including APIs. Moved to :browser pipeline where it belongs,
and removed redundant fetch_session call since the pipeline handles it.
2026-02-01 11:15:51 -06:00
45f8bc7459
Add design for Cloudflare timezone detection on signup
...
Documents approach to automatically populate user timezone from cf-timezone
header during registration, with UTC fallback when header is not present.
2026-02-01 10:56:07 -06:00
61a06fc11c
Add firmware version tracking system
...
- Add firmware context module with upsert, query, and logging functions
- Add FirmwareVersionFetcherWorker to fetch MikroTik RSS daily
- Add Oban cron schedules (2 AM dev, 4 AM prod)
- Add version change detection to Discovery module
- Track firmware history with PubSub broadcasts
- All tests passing
Phase 3-5 of firmware tracking implementation complete.
Next: LiveView UI indicators.
2026-02-01 10:46:27 -06:00
b30f2cf5af
filter more honeybadger alerts, format dates to users time zone, email template cleanup
2026-02-01 09:27:42 -06:00
43fe8cd326
Add design document for HIBP password breach checking
2026-01-31 17:16:58 -06:00
0388637b65
Update infrastructure documentation with Valkey restart fix
...
Documents the root cause analysis and solution for the Valkey pod
restart issue. The problem was a race condition during node restarts,
not a Flannel failure.
Resolution:
- Added system-cluster-critical priority class to Valkey
- Application-level Redis health checks provide additional resilience
- Monitoring ongoing to verify stability over 24-48 hours
🤖 Generated with Claude Code
2026-01-19 15:41:11 -06:00
5e9032314b
Add comprehensive Pangolin security rules
...
Created 30+ security rules to protect against common web attacks:
Protection categories:
- SQL injection (UNION, OR/AND, comments)
- XSS (script tags, event handlers)
- Path traversal (directory traversal, absolute paths)
- Common exploits (WordPress, PHPMyAdmin, admin panels)
- Malicious bots (scanners, scrapers, empty user agents)
- Shell injection (commands, ShellShock)
- File upload exploits (PHP, double extensions)
- Information disclosure (.git, .env, backups, configs)
- Protocol attacks (HTTP/0.9, TRACE, TRACK)
- Known CVEs (Log4Shell, SSRF, XXE)
Features:
- Allowlist for legitimate traffic (health checks, agents, monitoring)
- Detailed documentation with examples
- Testing and troubleshooting guides
- Performance impact analysis
- Compliance mapping (OWASP, PCI DSS, SOC 2)
Documentation: docs/PANGOLIN_SECURITY.md
Configuration: pangolin-security-rules.toml
2026-01-15 12:25:21 -06:00
