Major fixes for production deployment with Traefik:
1. API Path Fixes:
- Remove double /api prefix from all frontend service calls
- Fix auth.service.ts to use correct paths (/auth/admin/login)
- Update all services to use single /api prefix from base URL
- Fix template literal paths in photo services
2. Docker Configuration:
- Add build args for VITE_API_URL in docker-compose.prod.yml
- Create Dockerfile.prod with proper API URL configuration
- Ensure frontend is built with correct API base path
3. Documentation:
- Add comprehensive TRAEFIK_DEPLOYMENT.md guide
- Document proper Traefik labels and routing configuration
- Include troubleshooting steps for common issues
- Explain network configuration and SSL handling
This resolves:
- 502 Bad Gateway errors
- Double /api/api paths in requests
- Frontend unable to communicate with backend
- Login functionality not working
The frontend now correctly calls the backend API through Traefik's
routing, with all requests going to /api/* being forwarded to the
backend service on port 3000.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Change from bcryptjs to bcrypt to match installed dependency
- Fixes "Cannot find module 'bcryptjs'" error when creating admin user
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Major fixes for production deployment issues:
1. Migration System:
- Add safe migration runner that handles existing schema
- Create migration helper functions for idempotent operations
- Auto-detect existing tables and mark migrations as applied
- Handle "relation already exists" errors gracefully
2. Production Initialization:
- Create init-production.sh script for proper startup sequence
- Fix directory creation and permissions
- Add admin user creation from environment variables
- Ensure proper service initialization order
3. Documentation:
- Add comprehensive PRODUCTION_DEPLOYMENT_GUIDE.md
- Add MIGRATION_ERROR_FIX.md for immediate issue resolution
- Document all known production issues and solutions
- Include backup/restore procedures
4. Safety Improvements:
- Add migrate:safe npm script for production use
- Update wait-for-db.sh to use safe migrations in production
- Add proper error handling and logging
This resolves the "relation already exists" error and prevents similar
issues in future deployments. The safe migration system can handle both
fresh installations and existing databases.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix "no pg_hba.conf entry" error by disabling SSL for Docker network
- Use scram-sha-256 authentication method for better security
- Update knexfile.js to support SSL configuration via environment variable
- Add documentation about PostgreSQL connection requirements
The PostgreSQL container now accepts connections from the Docker network
without requiring SSL, which is appropriate for internal container communication.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix database connection error "getaddrinfo ENOTFOUND postgres"
- Add wait-for-db.sh script to ensure PostgreSQL is ready before starting
- Fix email processor initialization timing issue
- Add missing storage path environment variables
- Add database dependency to backend service
- Enhance health check endpoint with database connectivity check
- Update production database defaults to match docker-compose
- Install postgresql-client in Docker image for health checks
- Document all required environment variables in .env.example
Fixes immediate production deployment failures and ensures proper service startup order.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add pg package required for production PostgreSQL connections
- Fixes "Cannot find module 'pg'" error in production deployment
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix database configuration to use PostgreSQL in production
- Add knexfile.js to support both SQLite (dev) and PostgreSQL (prod)
- Create admin user creation script (scripts/create-admin.js)
- Clean up docker-compose files:
- Remove redundant docker-compose.yml and docker-compose.local.yml
- Create docker-compose.dev.yml for development
- Update docker-compose.prod.yml with proper DB configuration
- Clean up environment files:
- Update .env.example for development
- Update .env.production.example with proper settings
- Remove redundant .env.local
- Update backend .env.example with database configuration options
- Create comprehensive DEPLOYMENT.md with admin setup instructions
- Fix production database name consistency (picpeak instead of photoapp)
- Add URL utility functions for building resource URLs
- Update all components to use relative URLs in production
- Add production deployment documentation
- Update nginx config to proxy all required endpoints
- Add .env.production.example with proper configuration
- Add Gitea Actions workflow for automatic version bumping
- Update test workflow to run linting and tests
- Configure Drone to build images with version tags
- Separate concerns: Gitea Actions for versioning, Drone for Docker builds
- Version format: MAJOR.MINOR.PATCH (auto-increment patch)
- Add comprehensive CI/CD strategy documentation
This prevents race conditions between Gitea Actions and Drone CI by:
1. Gitea Actions handles version bump and creates git tag
2. Tag creation triggers Drone to build Docker images
3. Both systems work sequentially, not in parallel
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Configure custom Content Security Policy for React app compatibility
- Add Permissions-Policy header to disable unnecessary browser features
- Set HSTS to 1 year with preload flag for better transport security
- Update referrer policy to strict-origin-when-cross-origin
- Restrict CORS localhost origins to development environment only
- Production deployments now only allow configured FRONTEND_URL and ADMIN_URL
- Addresses security headers configuration issues from security scan
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add DOMPurify to sanitize HTML content in LegalPage component
- Prevents stored XSS vulnerabilities in CMS-managed content
- Maintains legitimate HTML formatting while removing malicious scripts
- Addresses critical XSS vulnerability from security scan
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Security Enhancements:
- Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries
- Add LIKE pattern escaping to prevent SQL injection in search functionality
- Implement account lockout protection (5 failed attempts = 30 min lockout)
- Add comprehensive login attempt tracking and audit trail
- Enhance JWT tokens with issuer validation, IP tracking, and password change detection
- Add logout endpoint and session management
- Prevent user enumeration with generic error messages
Database Changes:
- Add login_attempts table for authentication tracking
- Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled)
New Security Features:
- Brute force protection with configurable lockout duration
- Automatic cleanup of old login attempts
- Enhanced authentication middleware with stricter validation
- Monitoring scripts for security health checks
All fixes are backward compatible and production-ready with rollback plans included.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
BREAKING CHANGE: Admin password is now auto-generated on first setup
Security improvements:
- Remove hardcoded 'admin123' password completely
- Generate secure random password on first installation
- Save credentials to ADMIN_CREDENTIALS.txt (git-ignored)
- Force password change on first login
- Implement strong password requirements (12+ chars, mixed case, numbers, special)
- Add password strength validation
- Increase bcrypt rounds from 10 to 12
New features:
- Password generator utility with secure random generation
- Human-readable password format (e.g., SwiftEagle3847\!)
- Password reset script for existing installations
- Comprehensive admin setup documentation
- Must-change-password flag in database
Migration guide:
- New installations: Check ADMIN_CREDENTIALS.txt for generated password
- Existing installations: Run scripts/reset-admin-password.js
- All users must change password on first login after update
This fixes a critical vulnerability where all installations used the same
default admin password, allowing unauthorized access.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Replace short dev secrets with secure 64-character (256-bit) secrets
- Update docker-compose.yml with secure development secret
- Update docker-compose.local.yml with unique secure secret
- Improve .env.example with clear security instructions
- Add comprehensive security best practices documentation
- Create helper script to generate secure JWT secrets
Security improvements:
- All environments now use cryptographically secure 64-character secrets
- Clear warnings and instructions prevent use of weak secrets
- Documentation guides proper secret management
- Helper script makes it easy to generate new secrets
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
BREAKING CHANGE: Server now requires JWT_SECRET environment variable to be set
Security fixes:
- Remove hardcoded JWT secret fallback 'your-secret-key' from protectedImages.js
- Add startup validation to ensure JWT_SECRET is properly configured
- Reject insecure default values and short secrets
- Server will refuse to start without proper JWT_SECRET
This fixes a critical vulnerability where the application would use a publicly
known secret if JWT_SECRET was not set, completely compromising authentication.
Migration guide: docs/JWT_SECRET_MIGRATION.md
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add automated installation script for Gitea Act Runner
- Add docker-compose configuration for easy runner deployment
- Support both Docker and binary installation methods
- Include systemd service setup for Linux
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add simple test workflow to verify Gitea Actions functionality
- Create comprehensive setup guide for troubleshooting Actions
- Include runner installation and registration steps
- Document common issues and solutions
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update build script to use vite build directly
- Add build:check script for local development with TypeScript checking
- Fixes CI/CD build failures due to unused imports
- Configure automated Docker builds for backend and frontend
- Push images to local registry (registry.local.nothaft.cloud)
- Tag images with latest and commit SHA
- Add release pipeline for tagged versions
- Full configuration with security scanning saved as .drone.yml.full for future use
- Add GalleryPreview component that shows simplified gallery layouts
- Update ThemeEditorModal with split view: theme customizer on left, preview on right
- Add grid style selector above preview to switch between layouts
- Update BrandingPage to show live preview alongside theme customizer
- Add preview to CreateEventPageEnhanced when customizing themes
- Support all 6 gallery layouts: grid, masonry, carousel, timeline, hero, mosaic
- Add translation keys for preview layout and live preview
The preview accurately reflects different grid layouts and theme settings,
helping users visualize how their galleries will look before saving.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Make logout button show only icon on mobile (no text)
- Move upload button from top bar to sidebar menu on mobile
- Fix top bar layout with proper structure:
- Logo on left
- Gallery title centered
- Event date and expiration date shown below title on mobile
- Improve responsive design for header elements
- Ensure upload button only appears in menu when uploads are enabled
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add clickable gallery links in all email templates
- Include application logo in email header and footer (custom or PicPeak default)
- Redesign emails with professional styling matching gallery login page
- Gray background with white content box
- PicPeak green header with centered logo
- Clean typography and proper spacing
- Responsive design for mobile devices
- Styled call-to-action buttons
- Footer with branding and copyright
- Update email processor to fetch branding settings dynamically
- Use proper API URLs for logo images in emails
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fixed mobile gallery login box sizing and layout
- Fixed header button layout for mobile screens
- Fixed duplicate logo issue on logout
- Fixed '0' rendering when upload button is hidden
- Fixed horizontal scrolling on small screens
- Implemented comprehensive theme system with gallery layouts
- Added 6 different gallery layouts: Grid, Masonry, Carousel, Timeline, Hero, Mosaic
- Created enhanced theme customizer with layout selection
- Added theme presets for different event types
- Updated event creation with theme preview and customization
- Fixed all TypeScript compilation errors
- Added missing translation keys for create event page
- Added translations for theme customization features
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
GalleryLayout improvements:
- Stack header elements vertically on mobile
- Hide company branding on small screens
- Make dates stack vertically
- Responsive text sizes and padding
- Icon-only logout button on mobile
- Improved button layout with proper wrapping
PhotoFilterBar improvements:
- Stack search and sort vertically on mobile
- Full-width sort button on mobile
- Horizontally scrollable category filters
- Responsive text sizes
- Mobile-friendly dropdown positioning
PhotoGrid improvements:
- Responsive selection controls
- Touch-friendly photo overlays
- Larger selection checkboxes on mobile
- Improved button text for small screens
- Responsive gaps between photos
Gallery grid CSS:
- Smaller gaps on mobile devices
- Maintains 2 columns on smallest screens
GalleryPage login:
- Responsive padding and margins
- Smaller text and icon sizes on mobile
- Better card spacing
- Responsive form elements
UserPhotoUpload modal:
- Full-screen modal on mobile (slides up from bottom)
- Responsive padding and text sizes
- Mobile-optimized upload area
- Sticky footer on mobile
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Change AdminLayout to use h-screen instead of min-h-screen
- Add overflow-hidden to prevent scrollbar on outer container
- Update sidebar to use h-screen for proper height reference
- Add flex-shrink-0 to header and bottom sections
- Add min-h-0 to navigation to allow proper overflow
- Add overflow-y-auto to main content area
The version info and storage usage now properly stick to the bottom of the viewport instead of the bottom of the page content.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add missing translation keys for event creation form
- Replace all hardcoded strings with translation keys in CreateEventPage
- Add validation error message translations
- Add event types and color theme translations
- Add errors and validation sections to translation files
- Update German translations with corresponding keys
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix photo upload cross-device link error
- Changed fs.rename to fs.copyFile + fs.unlink to handle Docker volume mounts
- This fixes EXDEV errors when uploading photos from /tmp to storage
- Improve gallery login error handling
- Add console logging for debugging
- Prevent form refresh with stopPropagation
- Show specific error messages based on status codes
- Keep password field populated on error for retry
- Map 404 to gallery not found message
- Enhanced upload error messages
- Show specific error message for each failed file
- Display backend error messages in toast notifications
These fixes resolve:
1. Photo uploads failing silently with cross-device link errors
2. Login errors not displaying and form refreshing
3. Upload errors not showing user-friendly messages
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix user upload feature not showing in gallery
- Add allow_user_uploads and upload_category_id to auth response
- These fields are required for the gallery to show the upload button
- Improve gallery login error messages
- Add specific translations for wrong password vs rate limiting
- Map backend error messages to user-friendly translations
- Added auth.wrongPassword and auth.tooManyAttempts keys
- Gallery pages already have full translation support
- GalleryPage and GalleryView use i18n properly
- All text is translated based on selected language
These fixes resolve:
1. User upload button not showing even when enabled
2. Generic error messages for wrong passwords
3. No feedback for rate limiting
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix system version endpoint to read package.json using fs instead of require
- Prevents MODULE_NOT_FOUND error in Docker container
- Uses path.join to find package.json reliably
- Fix event creation email queue error
- Change email_type from 'creation' to 'gallery_created' to match template key
- Update email_data to include all required template variables
- Added missing created_at and updated_at columns to email_queue table
- Fix file watcher duplicate photo insertion
- Add check to prevent re-inserting existing photos on backend restart
These fixes resolve:
1. 500 error when accessing /api/admin/system/version
2. 500 error when creating new events
3. Email queue processing errors
4. Photo duplication issue
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Gitea Actions Bot
paul